Fraud & Compliance / Learning brief
Correspondent banking risk
Your notes
In simple terms / 01
What this means in plain language
Correspondent banking lets one bank move money through another's accounts to reach places it cannot serve directly. That reliance on a customer's customers raises financial-crime risk, so it is managed through structured due diligence.
A correspondent relationship is when one bank holds an account for another bank so payments can reach countries or currencies the first bank cannot serve alone. The convenience carries a specific risk: the correspondent moves funds for customers it never onboarded and often cannot see. The bank effectively relies on its customer's customers. If the respondent bank has weak controls, or quietly lets other banks route payments through it, criminal money can travel down the chain. Because of this, correspondent relationships are managed through due diligence rather than trust. The correspondent gathers evidence about the respondent's ownership, licensing, supervision, and financial-crime programme, commonly using the Wolfsberg Correspondent Banking Due Diligence Questionnaire (CBDDQ). It also asks whether other banks nest behind the respondent, and whether any account can be used directly by the respondent's own customers.
Complete lesson / 02
Understand the full idea, step by step
Every account a bank opens for another bank is a promise it has to keep watching. The money in it belongs to someone the bank chose; the payments through it come from customers the bank never met. Correspondent banking runs on exactly that asymmetry — and managing it is one of the clearest examples in finance of controls doing quiet, constant work.
The balance itself is an exposure
Start with Maya's view. A nostro balance — Bank Alfa's money held on Meridian's books — is, in substance, an unsecured claim on Meridian. If Meridian failed, that balance would stand in the queue with other creditors: credit risk. The balance is also liquidity that Bank Alfa cannot use elsewhere; funding payments across many currencies means parking money in many nostros, and a correspondent that delays crediting or executing can leave the respondent short at the wrong moment: liquidity risk. Where a correspondent grants intraday credit so payments can flow before cover arrives, the exposure briefly runs the other way. This is why treasury teams set limits on nostro balances per correspondent and sweep excess funds — long before anyone mentions financial crime.
The risk view of one relationship
- Credit risk
- A nostro balance is an unsecured claim on the correspondent; its failure puts the balance at risk
- Liquidity risk
- Funds parked in nostros are unavailable elsewhere; delayed execution can cause shortfalls
- Financial-crime risk
- The correspondent moves money for the respondent's customers, whom it never onboarded
- Visibility risk
- Nesting and stripped payment details can hide parties the correspondent needs to see
Relying on a customer's customers
Now Kabir's view. Meridian screened and onboarded Cassia Bank — but not Cassia's customers, who are the people actually sending the payments through the vostro. The correspondent depends on the quality of the respondent's controls and on the respondent's honesty about who it serves. If Cassia onboarded high-risk customers carelessly, or operates under weak supervision, illicit funds can reach Meridian's books without Meridian ever meeting their owner. Regulators therefore expect a correspondent to understand not just the respondent but the nature of the respondent's customer base and markets — and to test that understanding against what the account actually does.
Nested correspondent relationship
A nested — or downstream — relationship exists when the respondent provides its own accounts to further banks, so those banks reach the correspondent indirectly through the respondent's vostro. Meridian may believe it serves one bank while in fact clearing payments for several undisclosed institutions another step removed from its view. Nesting is not automatically improper — disclosed and assessed, it is a normal way smaller banks reach major currencies — but undisclosed nesting defeats the due diligence the relationship was built on. Controls respond by asking directly whether nesting occurs, requiring downstream banks to be named, and monitoring for volumes or counterparties one respondent could not plausibly generate.
Wire-stripping
The removal or alteration of party information — an originator, a beneficiary, an address, a bank — from a payment message so that screening does not see a name it would stop. It is the specific abuse that payment-transparency standards exist to defeat: industry principles require complete originator and beneficiary information to travel with a payment through every leg of the chain. Kabir's controls are built around that expectation — screening compares the parties in each message against sanctions lists, and looks for the tell-tale gaps: fields blank where practice says they should be full, vague placeholders in place of names, or details that changed between one leg of a payment and the next.
Read the steps as text
- 01MessageThe customer orders a USD transfer abroadOrdering customer → Bank Alfa (ordering bank)
The ordering customer instructs Bank Alfa to pay a supplier banked at Cassia Bank in another country. Bank Alfa has no direct account relationship with Cassia — that is why correspondents exist.
- 02ProcessingBank Alfa validates and screensBank Alfa (ordering bank)
Format and balance checks plus sanctions screening. Cross-border payments face stricter screening because more jurisdictions are involved.
Screening checkpoint: Outbound cross-border screening — Ordering and beneficiary parties, banks, and remittance text are screened before the payment leaves.
- 03PostingThe customer's account is debitedBank Alfa (ordering bank)
Bank Alfa books the debit and, per the charge option, any fees.
- DR Ordering customer's account at Bank Alfa — USD 250,000.00
- 04MessageThe MT103 goes to Bank Alfa's USD correspondentBank Alfa (ordering bank) → Meridian Bank (correspondent) · MT103
In the serial method the payment instruction itself travels through the account chain. Meridian holds Bank Alfa's USD account (Bank Alfa's nostro), so Meridian can debit it.
- 05ProcessingMeridian validates and screens in the middleMeridian Bank (correspondent)
Every bank in the chain screens independently. Meridian also checks that Bank Alfa's account has cover for the debit.
- 06SettlementMoney moves across the books of MeridianMeridian Bank (correspondent)
Both Bank Alfa and Cassia hold USD accounts at Meridian. Settlement here is a book transfer in commercial bank money: Meridian debits one account it holds and credits the other.
No clearing house is involved — the correspondent's ledger is the settlement venue. This is settlement in commercial bank money, not central bank money.
- DR Bank Alfa's USD account at Meridian (vostro) — USD 250,000.00
- CR Cassia's USD account at Meridian (vostro) — USD 250,000.00
- 07MessageCassia is advised its nostro was creditedMeridian Bank (correspondent) → Cassia Bank (beneficiary bank) · MT910
The MT910 credit confirmation lets Cassia's reconciliation match expected funds against its nostro account movement.
- 08MessageThe MT103 continues serially to CassiaMeridian Bank (correspondent) → Cassia Bank (beneficiary bank) · MT103
Meridian forwards the payment instruction to the beneficiary bank with the full ordering and beneficiary details intact.
- 09ProcessingCassia validates the incoming paymentCassia Bank (beneficiary bank)
Account checks and inbound screening. Only when funds are confirmed on the nostro and checks pass is the beneficiary credited.
- 10PostingThe beneficiary is creditedCassia Bank (beneficiary bank)
Cassia credits its customer, net of any beneficiary-side charges the charge option allows.
- CR Beneficiary's account at Cassia — USD 250,000.00
How can Meridian meaningfully monitor customers it has never met and cannot name?
It monitors the relationship, not the individuals. Onboarding produced an expected activity profile — corridors, volumes, currencies, counterparty types that Cassia's declared business should generate — and the CBDDQ produced attested answers about nesting and direct customer access. Monitoring compares reality against both. A respondent that declared regional trade finance but produces high volumes toward unrelated corridors, or traffic patterns implying several banks behind one account, has departed from its own story — and that departure, not any one customer's name, is what raises the alert.
WHAT IF — Monitoring flags that the Cassia vostro's activity no longer matches its expected profile — new corridors, a jump in volume, counterparties inconsistent with Cassia's declared business
What happens: An alert is raised and the mismatch is treated as a question to be answered, not an accusation. Payments that hit screening rules are held for review while the account keeps operating.
How it is handled: Kabir's team reviews the flagged traffic; Meridian's relationship managers put a structured request for information to Cassia. A satisfactory answer — a new client, a seasonal pattern — updates the expected profile. An unsatisfactory one escalates: enhanced monitoring, restrictions on the account's use, and ultimately exit. Reporting obligations to authorities apply along the way where suspicion is met — the system is designed so that noticing leads somewhere.
REMEMBER IT
A correspondent's riskiest customers are the ones it never onboarded. Everything in this lesson — profiles, questionnaires, screening, monitoring — is one idea in different clothes: make the invisible parties visible, then check the story against the traffic.
FOR NOW, REMEMBER
- A nostro balance is credit and liquidity exposure before it is anything else — an unsecured claim on the correspondent, and money unavailable elsewhere.
- The defining financial-crime risk is reliance on a customer's customers: the correspondent moves money for people it never screened at onboarding.
- Undisclosed nesting adds hidden banks behind one vostro; controls demand disclosure and watch for traffic one respondent could not plausibly generate.
- Payment-transparency standards require complete party information through every leg; screening looks for the gaps and alterations that would defeat it.
- Monitoring tests actual activity against the expected profile and attested questionnaire answers — mismatches trigger review, questions, restrictions, or exit.
TRY IT YOURSELF
Reviewing the Cassia Bank vostro, Kabir notices weeks of payments whose ordering customers cluster around a bank Cassia never named in its CBDDQ, in a country outside Cassia's declared markets. What is the most likely reading, and the right response?
You have seen the risk view. The topic behind it consolidates the mechanics — nostro and vostro accounting, serial and cover flows across correspondent accounts, and how the exposure and the controls fit together.
KEEP GOINGKey takeaways / 03
Three things to remember
- 01
Correspondent banking means relying on a customer's customers, which extends financial-crime risk down the payment chain.
- 02
Due diligence, often via the Wolfsberg CBDDQ, gathers evidence on ownership, licensing, supervision, and controls before and during the relationship.
- 03
Nested relationships, downstream correspondents, and payable-through accounts add hidden parties and need explicit review.
Practical use cases / 04
Where you would use this
A correspondent bank's onboarding team reviews a completed CBDDQ to decide whether to open a relationship and at what risk rating.
A financial-crime analyst investigates payments that suggest an undisclosed nested bank is routing traffic through a respondent's account.
A relationship manager runs periodic reviews, refreshing due diligence and transaction expectations as the respondent's business changes.
Worked example / 05
Put the idea into a real situation
Illustrative example: a fictional correspondent, Meridian Trust, holds a US dollar account for a fictional respondent, Anders Regional Bank. The relationship was approved on the expectation of 500 payments a month averaging USD 40,000.00. In one month the account shows 4,200 payments, many for round amounts near USD 9,900.00 tied to eight small institutions never named on the CBDDQ. Meridian Trust treats the gap between the expected 500 and the observed 4,200 as a control signal, requests updated due diligence, and reviews whether undisclosed nested banks are present.
Evidence & review / 07
Evidence & review
Cross-border correspondent banking; FATF baseline with jurisdiction-specific implementation. Screening and monitoring described defensively — detection and reporting only.
What this brief simplifies: Credit/liquidity treatment is qualitative — no limit methodologies or capital treatment. Wire-stripping is described only as what controls look for, never as technique. The two-desk scenario compresses treasury, screening, and relationship-management functions into two named roles.
Sources for this brief4
- Official requirement
The FATF Recommendations: International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation ↗ — Financial Action Task Force · Recommendation 13 — correspondent banking due diligence
Adopted in 2012 and updated regularly since; the June 2025 FATF plenary agreed revisions to Recommendation 16 on payment transparency. Consult the live consolidated text for the current wording.
- Market practice
Wolfsberg Group Payment Transparency Standards ↗ — The Wolfsberg Group · Payment transparency principles — complete originator and beneficiary information through the chain
The 2023 standards replace the 2017 version and are supplemented by separate Wolfsberg guidance on roles and responsibilities in payment chains.
- Market practice
Correspondent banking (final report) ↗ — CPMI, Bank for International Settlements · Correspondent banking risk structure
Published in July 2016; its statistics cover 2011-2015 and are dated, but the definitions and arrangement types remain widely used.
- Simplified educational illustration
Payments Signal editorial teaching models — Payments Signal
Used wherever diagrams, scenarios, figures, or example values are didactic constructions rather than sourced facts; every such use carries a simplifications disclosure. All people, companies, banks, and list entries in examples are fictional.