Correspondent account due diligence: what a bank must establish about a foreign counterparty

Every cross-border payment ends in somebody else's hands. For a bank or a credit union, that somebody has usually been a foreign bank holding an account on its books. Correspondent account due diligence is the work that makes the relationship defensible. It is not a questionnaire sent once at onboarding. In the United States it is a rule, with named triggers, named records and a termination duty attached.

This article sets out what the rule requires, which firms it binds, when enhanced scrutiny applies, what belongs in the file, and what changes when the settlement leg runs on a public blockchain. It is general information, not legal advice.

What is correspondent account due diligence, and which firms does it bind?

Start with the account. A correspondent account is an account established for a foreign financial institution to receive deposits, make payments on its behalf, or handle other financial transactions for it. The definition sits in 31 CFR 1010.605. The label on the product does not decide the question. The function does.

The duty comes from section 312 of the USA PATRIOT Act, which added 31 U.S.C. 5318(i), and it is implemented at 31 CFR 1010.610. A covered financial institution must keep a risk-based due diligence programme for every correspondent account it holds for a foreign financial institution. The programme has to assess the risk the account presents, apply procedures to spot and report suspicious activity through it, and be revisited as the relationship changes.

Covered financial institution is a defined term. It reaches banks, savings associations, credit unions, broker-dealers, futures commission merchants and mutual funds. It does not reach money services businesses, so an MSB sits outside 31 CFR 1010.610. The expectation does not disappear. It arrives through other doors.

Those doors are the general programme rule, the counterparty's own demands, and the international standard. FATF Recommendation 13 requires a financial institution in a cross-border correspondent relationship to gather enough information on the respondent, assess its controls, obtain senior management approval and set out each side's responsibilities in writing. Canada codifies it. Section 9.4 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act requires a written agreement and senior officer approval before the relationship begins.

When does an account need enhanced due diligence rather than general diligence?

The rule names three triggers. 31 CFR 1010.610 requires enhanced due diligence where the correspondent account is held for a foreign bank operating under an offshore banking licence, under a licence from a jurisdiction named as non-cooperative by an intergovernmental body with United States concurrence, or from a jurisdiction subject to a special measure under section 311 of the USA PATRIOT Act.

Where a trigger applies, three things are added. The account gets enhanced scrutiny to detect and report suspected money laundering. The institution must ascertain whether the foreign bank itself offers correspondent accounts to other foreign banks, and what diligence it runs on them. And where the foreign bank's shares are not publicly traded, 31 CFR 1010.610 requires the institution to identify each owner holding 10 percent or more of any class of securities, with the nature and extent of that ownership.

Two points follow. That owner test is tighter than the 25 percent beneficial ownership threshold 31 CFR 1010.230 requires for a legal entity customer, so one counterparty can produce two different ownership answers. And the trigger list is a floor. A relationship that triggers none of the three can still be the riskiest account on the book.

What must be on file before the first payment moves?

Three records carry most of the weight, and two clocks sit behind them.

The first record answers the shell bank question. 31 CFR 1010.630 prohibits a covered financial institution from holding a correspondent account for a foreign shell bank, and from allowing a correspondent to be used indirectly by one. The institution must obtain a certification, or make an equivalent enquiry of its own, and keep records identifying the foreign bank's owners and its agent in the United States for service of process.

The other two records are the ones law enforcement reaches for. Under 31 U.S.C. 5318(k), added by section 319(b) of the USA PATRIOT Act, a covered institution must produce that ownership and process agent information within seven days of a request from a federal law enforcement officer.

The termination duty is the clock most firms have never rehearsed. Where the Treasury or the Department of Justice gives written notice that a foreign bank failed to comply with a subpoena for records, the covered institution must end the correspondent relationship within ten business days. That is an operational task as much as a legal one. Open payments, standing instructions, balances in the account and the customers whose payouts route through it all have to be handled inside that window.

How do nested relationships and payable-through accounts change the question?

A nested relationship is a foreign bank using your correspondent to serve its own institutional customers. You onboarded one counterparty. You are clearing for several you have never met. The diligence cannot reach each underlying client, and it is not meant to. It has to establish that the arrangement exists, what it carries, and what the respondent does to control it.

A payable-through account is the sharper version, because the respondent's own customers can use the account directly. FATF Recommendation 13 requires the institution to satisfy itself that the respondent has performed customer due diligence on those customers and can provide that information on request. Without it, the account is an open door with your name on it.

This is where diligence meets the de-risking problem. Closing a category of counterparty is cheaper than diligencing it, and that has been the default for a decade. Supervisors have pushed back. The Joint Fact Sheet on Foreign Correspondent Banking, published by the United States Treasury and the federal banking agencies in August 2016, states that there is no general expectation to terminate entire categories of relationship. FinCEN made the parallel point for money services businesses in its 2014 guidance FIN-2014-G001, which says banks are not expected to act as the de facto regulator of that industry.

Does a stablecoin settlement leg remove the correspondent account, or move the risk?

It can remove the account. It does not remove the counterparty.

When a payment settles as a stablecoin transfer to a payout partner that converts and pays locally, that partner may hold no account on your books at all. On its own terms 31 CFR 1010.610 may then not apply, because there is no correspondent account for a foreign financial institution to diligence. That is a question for counsel on the specific structure, not an assumption to build a programme on.

Taking the account off the balance sheet does not take the counterparty out of the payment. The diligence does not disappear with the nostro. It changes name, and it has to be written down somewhere a reviewer can find it.

In practice the work reappears in the third-party and agent frameworks. Who the partner is, who owns it, what licence it holds, what controls it runs, and how the relationship ends. Two parties join the file that a nostro relationship never had: the issuer of the settlement asset, and whoever holds the keys.

What the rail adds is evidence. A nostro statement told you a balance moved by the end of the day. A settled transfer gives you both addresses, the amount, the asset and a transaction hash, visible to each side at the same time. What it does not tell you is who the money reached after the partner converted it, which is the question diligence on the partner has to answer.

What does the diligence file look like, step by step?

A reviewer does not read the policy first. A reviewer picks one counterparty and follows it. The sequence below produces that file as the work is done.

• Classify the relationship first. Decide whether what you hold is a correspondent account, an agency arrangement or a vendor contract, and record the reasoning, because the classification picks the rule set.
• Identify the institution and its owners: licence, regulator, jurisdiction, group structure, and the ownership test that applies to the classification you just made.
• Screen the counterparty, its owners and its controllers, and keep the screening run itself, not only the clear result.
• Assess the controls rather than the brochure. Ask for the AML programme, the last independent audit, and the name of the compliance officer.
• Obtain senior approval before the first payment, with a dated record of who approved what.
• Write down the split of responsibilities: who screens, who files, who verifies the beneficiary account, and what an exit looks like.
• Set the review cadence by risk, and name the events that force an early review: a sanctions designation, a licence change, an ownership change, or a jurisdiction moving onto a list.

Where StableNet fits

StableNet, built by SpendTheBits, is a cross-border B2B payment and settlement platform for banks, credit unions, licensed money service businesses, exchange houses and remittance fintechs. Settlement runs in regulated stablecoins on public blockchains and completes in minutes with on-chain auditability, so a payout partner relationship is evidenced payment by payment. KYB and KYC onboarding, sanctions and PEP screening, KYT, FATF Travel Rule data and a tamper-evident audit trail sit inside the platform, and every transfer is ISO 20022 native, carrying pacs.008 customer credit transfers and pacs.009 interbank legs tracked by UETR. Diligence on a counterparty stays the institution's own work. The record of what moved, where and when no longer has to be reconstructed.