---
title: "Correspondent banking due diligence: FATF, EU, UK and US | Elucidate"
description: "What correspondent banking due diligence requires under FATF Recommendation 13, EU, UK and US rules, nested relationships, the Wolfsberg CBDDQ and directory data."
url: https://elucidate.co/correspondent-banking-due-diligence
---

[Guides](https://elucidate.co/guides) / Correspondent banking Reviewed 2 November 2026

Guide · Correspondent banking

# Correspondent banking due diligence

What a correspondent bank must know about the institutions it holds accounts for, what the FATF, EU, UK and US rules require, how nested relationships work, and what public data shows about a respondent.

In short

Correspondent banking due diligence is the assessment a correspondent bank makes of each respondent: the bank or other financial institution for which it holds accounts and makes payments. Under FATF Recommendation 13, the correspondent understands the respondent’s business, its reputation and the quality of its supervision, assesses its anti-money-laundering and counter-terrorist-financing controls, obtains senior management approval before opening the relationship and documents each side’s responsibilities. For accounts the respondent’s customers use directly, it must be satisfied with the respondent’s due diligence on them. No relationship may be opened or kept with a shell bank. The correspondent assesses the respondent, not the respondent’s own customers. Many respondents answer the Wolfsberg Group’s Correspondent Banking Due Diligence Questionnaire (CBDDQ).

## A bank that banks for other banks

The Committee on Payments and Market Infrastructures (CPMI) describes correspondent banking as an arrangement under which one bank, the correspondent, holds deposits owned by other banks, its respondents, and provides payment and other services to them. The services include accounts, cross-border payments, foreign exchange, cash management and cheque clearing. Through them, a respondent can pay in currencies and countries where it has no access of its own. See [how a cross-border payment travels](https://elucidate.co/guides/how-cross-border-payments-work).

The risk is that the correspondent makes payments for people it does not know. It sees each payment, with the payer and the payee, but the customers behind them are the respondent’s. The correspondent therefore relies on the respondent’s own controls, and its due diligence is an assessment of them.

## What the rules require

| Rule | What it requires |
| --- | --- |
| FATF Recommendations, Recommendation 13 | For cross-border correspondent relationships, in addition to normal customer due diligence: understand the respondent’s business, its reputation and the quality of its supervision, including any money laundering or terrorist financing investigation or regulatory action; assess its controls; obtain senior management approval; understand each institution’s responsibilities; and, for payable-through accounts, be satisfied with the respondent’s due diligence on the customers that use them. No relationship with a shell bank, and none with a respondent that lets a shell bank use its accounts. |
| EU Anti-Money Laundering Directive, Directive (EU) 2015/849, Articles 19 and 24 | The same enhanced measures for cross-border correspondent relationships with respondents in third countries, and the ban on correspondent relationships with shell banks. |
| EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, Articles 36 to 39 | Replaces the Directive’s rules from 10 July 2027. Article 36 covers credit and financial institutions, Article 37 crypto-asset service providers, Article 38 measures concerning individual respondents, and Article 39 the ban on shell institutions. |
| EBA ML/TF Risk Factors Guidelines, EBA/GL/2021/02, Guideline 8 | The sectoral guideline for correspondent relationships: risk factors, and the measures for respondents in and outside the European Economic Area. |
| UK Money Laundering Regulations, SI 2017/692, regulation 34 | Enhanced due diligence for correspondent relationships involving the execution of payments with a respondent in a third country, and the ban on shell banks. A regulation 34A, inserted in 2026 and in force from 1 February 2027, covers cryptoasset correspondent relationships. |
| United States, 31 CFR 1010.610 and 1010.630 | A risk-based due diligence programme for correspondent accounts for foreign financial institutions, with enhanced measures for banks under an offshore licence or in designated jurisdictions, including checks on the foreign bank’s own correspondent accounts for other foreign banks. A ban on correspondent accounts for foreign shell banks; the correspondent can rely on a certification from the foreign bank, renewed at least every three years. |

FATF standards define a shell bank as a bank incorporated and licensed in a country where it has no physical presence, and which is not part of a regulated financial group subject to effective consolidated supervision.

## The respondent, not its customers

The FATF’s guidance on correspondent banking services, published in October 2016, addressed a practice that had spread among correspondents: asking respondents about their own customers, known as know your customer’s customer. The FATF’s answer: “There is no expectation, intention or requirement for the correspondent institution to conduct customer due diligence on its respondent institution’s customers.”

The correspondent still monitors the payments it makes for the respondent. When a payment or a pattern of payments raises a question, it can ask the respondent for information on that transaction. The guidance was part of the response to a decline in correspondent relationships, which the Financial Stability Board set out to address in an action plan in 2015.

## Nested relationships and payable-through accounts

A nested, or downstream, relationship is one in which a respondent offers its account with the correspondent to other banks, which hold accounts with the respondent. Their payments reach the correspondent through the respondent’s account, though the correspondent has no relationship with them.

A nested relationship

1.  Customers of Bank Z: known to Bank Z
2.  Bank Z: the nested bank, with an account at Bank Y
3.  Bank Y: the respondent, with an account at Bank X
4.  Bank X: the correspondent, which assessed Bank Y only

Payments for the customers of Bank Z pass through Bank Y’s account at Bank X.

Nesting is a normal part of correspondent banking, but it widens what the correspondent relies on. The US rules ask the correspondent, in its enhanced due diligence, to find out whether the foreign bank maintains correspondent accounts for other foreign banks and to take reasonable steps to assess and mitigate their risks. The CBDDQ asks the respondent whether it offers correspondent banking services and allows downstream relationships, and with which kinds of institution.

A payable-through account goes one step further: the respondent’s customers use the correspondent’s account directly, for example through sub-accounts. The FATF standards, EU and UK law ask the correspondent to be satisfied that the respondent has carried out due diligence on those customers and can provide the information on request. The US rules ask it to identify the persons who can direct transactions through the account.

## The Wolfsberg questionnaire

The Wolfsberg Group, an association of global banks, publishes the Correspondent Banking Due Diligence Questionnaire (CBDDQ) as a common format for the information correspondents ask for. It covers the respondent’s ownership, products and services, its anti-money-laundering, counter-terrorist-financing and sanctions programme, anti-bribery and corruption, risk assessment, customer due diligence, monitoring and reporting, payment transparency, sanctions, training, testing and audit. The current version, 1.4, was published on 10 February 2023 and added a section on fraud.

Some institutions publish their completed questionnaire on their website. Of the 1,532 researched institutions whose website answered when Elucidate’s crawler checked it (1 November 2026), 149 had a completed CBDDQ there, or 9.7%, in 51 countries. Others share it on request or through due diligence platforms.

**Find a published CBDDQ.** The directory lists the institutions that publish their questionnaire, with its version and signing date, and links each to its source.

[See the questionnaires](https://elucidate.co/directory/wolfsberg-cbddq)

## What public data shows about a respondent

Several of the facts Recommendation 13 asks for are on public registers and lists. Elucidate’s directory gathers them for every institution in Swift’s BIC directory, 36,546 institutions as at 24 October 2026.

### Identity and group

Of the institutions that hold a BIC, 55% have an LEI mapped, which links the BIC to a legal entity and to the parents that entity reports to the Global LEI System. Through branches and subsidiaries, the 29 global systemically important banks (G-SIBs) on the Financial Stability Board’s 2025 list account for 1,914 of them.

### Reach through correspondents

Of the institutions that hold a BIC, 51% are passive participants: their BIC is registered for identification, and messages reach them through a correspondent (BIC data as at 24 October 2026). The member list of Swift GPI, Swift’s service for tracked cross-border payments, matches 1,163 institutions in 146 countries (24 October 2026).

### Country

The table counts the institutions in the directory, with or without a BIC, in the countries each list names, as at 24 October 2026. A country list describes the country, not each institution in it.

| List | Countries | Institutions |
| --- | --- | --- |
| Call for action, FATF, June 2026 plenary | Iran, Myanmar (Burma) and North Korea | 86 |
| Increased monitoring, FATF, June 2026 plenary | 22 | 1,049 |
| High-risk third countries, European Commission, Delegated Regulation (EU) 2016/1675, consolidated 29 January 2026 | 26 | 1,406 |

Under EU law, a correspondent relationship with a respondent in a high-risk third country also falls under the enhanced measures for business relationships involving those countries.

### Sanctions and enforcement

Of the institutions that hold a BIC, 209 appear on the OFAC or EU sanctions lists (OFAC lists as at 21 October 2026, EU list as at 23 October 2026). Sanctions listings are matched on the BIC and on the LEI mapped to it, so they cover institutions that hold a BIC only. Institutions that do not hold a BIC are not screened. Listings name entities; see [how sanctions reach the companies a listed person owns](https://elucidate.co/guides/sanctions-ownership-50-percent-rule). Institution pages also show enforcement actions from the public registers of US, UK and EU authorities that name the institution, one of its branches or its holding company.

-   [Institutions on the OFAC and EU sanctions lists](https://elucidate.co/directory/sanctions)
-   [Global systemically important banks and their BICs](https://elucidate.co/directory/g-sib)
-   [Swift GPI members](https://elucidate.co/directory/swift-gpi)
-   [Enterprise-wide risk assessment (EWRA)](https://elucidate.co/ewra), and what correspondents ask about it

## What public data does not show

-   **Whether a respondent’s controls work.** Registers and lists identify an institution and record what authorities have published about it. They do not assess its controls.
-   **Who the respondent serves.** Its customers, and the banks nested in its accounts, are not on any public register.
-   **That an institution is not listed, licensed or sanctioned.** Records are matched on BICs and LEIs. Absence from a register, a list or the questionnaire crawl is not evidence that the institution has no licence, listing or questionnaire.
-   **The current position.** Each figure on this page has a date. Screen against the official lists, and check a licence on the regulator’s own register.

**Look up a respondent.** The directory shows an institution’s BICs, LEI, licences, supervisors, group, sanctions listings and published CBDDQ, with the source of each.

[Search the directory](https://elucidate.co/directory/search)

## Sources

-   [The FATF Recommendations](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html), Recommendation 13 and the glossary. Financial Action Task Force (FATF).
-   [Guidance on correspondent banking services](https://www.fatf-gafi.org/content/dam/fatf-gafi/guidance/Guidance-Correspondent-Banking-Services.pdf), October 2016. FATF.
-   [Correspondent banking](https://www.bis.org/cpmi/publ/d147.htm), July 2016. Committee on Payments and Market Infrastructures (CPMI).
-   [Directive (EU) 2015/849](https://eur-lex.europa.eu/eli/dir/2015/849/oj), Articles 19 and 24. EUR-Lex.
-   [Regulation (EU) 2024/1624](https://eur-lex.europa.eu/eli/reg/2024/1624/oj), Articles 36 to 39. EUR-Lex.
-   [Guidelines on ML/TF risk factors (EBA/GL/2021/02)](https://www.eba.europa.eu/sites/default/files/document_library/Publications/Guidelines/2021/963637/Final%20Report%20on%20Guidelines%20on%20revised%20ML%20TF%20Risk%20Factors.pdf), Guideline 8. European Banking Authority (EBA).
-   [The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017](https://www.legislation.gov.uk/uksi/2017/692/regulation/34), regulation 34, and [the Money Laundering and Terrorist Financing (Amendment) Regulations 2026](https://www.legislation.gov.uk/uksi/2026/621/made). legislation.gov.uk.
-   [31 CFR part 1010, subpart F](https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1010/subpart-F), sections 1010.610 and 1010.630. Electronic Code of Federal Regulations.
-   [Correspondent Banking Due Diligence Questionnaire (CBDDQ)](https://wolfsberg-group.org/resources/correspondent-banking), version 1.4. The Wolfsberg Group.
-   [High-risk and other monitored jurisdictions](https://www.fatf-gafi.org/en/topics/high-risk-and-other-monitored-jurisdictions.html). FATF. FATF lists as restated in HM Treasury’s advisory notice of 22 June 2026. Contains public sector information licensed under the [Open Government Licence v3.0](https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/).
-   [Commission Delegated Regulation (EU) 2016/1675](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R1675-20260129), consolidated text. EU lists: © European Union, https://eur-lex.europa.eu, 1998–2026.
-   [How the directory is built](https://elucidate.co/directory/methodology): sources, matching and coverage of every figure on this page. Elucidate.

Reviewed 2 November 2026. Rules and lists change: the publisher’s own text is always the authority. The directory figures are refreshed with each build of this page.

## Cite this page

Use this reference to cite the guide. Add the date you read it if your citation style asks for one.

Elucidate. “Correspondent banking due diligence”. Guides to identifiers, payments and due diligence, reviewed 2 November 2026. https://elucidate.co/correspondent-banking-due-diligence

## Read next

-   [Guide · Payments How a cross-border payment travels Correspondents, nostro and vostro accounts, serial and cover payments, the ISO 20022 messages and the UETR.](https://elucidate.co/guides/how-cross-border-payments-work)
-   [Directory · Due diligence Institutions that publish their Wolfsberg CBDDQ Each questionnaire found on an institution’s own website, with its version, signing date and next update due.](https://elucidate.co/directory/wolfsberg-cbddq)
-   [Guide · Sanctions When sanctions reach the companies a listed person owns OFAC’s 50 Percent Rule and the EU and UK ownership and control tests, with a worked example.](https://elucidate.co/guides/sanctions-ownership-50-percent-rule)

FinCrime Index

## Assess every respondent in your network

Public registers and lists identify a respondent. They do not assess it. The Elucidate FinCrime Index (EFI) is an independent score of the financial crime risk of banks and payment firms. Ask what it covers for the counterparties you deal with.

[Get the score](https://elucidate.co/directory/score) [For correspondent banks](https://elucidate.co/network-banks)