The Banking System: Correspondent Banking

What a correspondent account is

A correspondent bank holds an account for another bank, called the respondent, and makes and receives payments for it. The respondent's customers usually never know the correspondent exists. The Committee on Payments and Market Infrastructures describes these arrangements as the backbone of cross-border payments and of banks' access to currencies they cannot clear at home [1]. The Financial Action Task Force defines correspondent banking by its "on-going, repetitive nature": a one-off transaction is not a relationship, and neither is the mere exchange of messaging keys between two banks [2].

U.S. rules define a correspondent account as an account set up for a foreign bank or other foreign financial institution to receive deposits from, make payments or other disbursements for, or handle other financial transactions for it [3]. The definition is wider than a deposit account. It reaches the services a bank provides through the relationship, which is why the same rules apply to wire clearing, trade services, and cash letters.

Two words describe the same balance from opposite sides. Suppose a bank in Lagos holds a dollar account at a bank in New York. Lagos calls it its nostro, "our account with you." New York calls it a vostro, "your account with us." A positive balance is an asset of the respondent and a deposit liability of the correspondent. When New York pays out of that account, it reduces what it owes Lagos. No money travels between the banks. They exchange instructions and settle by book entry and through payment systems.

The relationship need not run both ways. Bank A can hold an account at Bank B without B holding one at A. A group can use several correspondents for the same currency and a different set for others, and a mid-sized bank can be a correspondent to smaller institutions while acting as respondent to a global provider. Record the direction of every relationship by currency, account, and booking entity before drawing any conclusion from it.

Why banks need it

• Currency access. Dollars settle on the books of the Federal Reserve. A foreign bank without a U.S. branch or a Reserve Bank master account needs a U.S. bank to hold dollars for it and send them on Fedwire or CHIPS. CHIPS has 43 direct participant banks; everyone else reaches it through one of them [4].
• Reach. No bank can hold accounts in every market. The dollar carried 50.9 percent of the value of correspondent payments sent over SWIFT in December 2022, and the euro 27.3 percent [5].
• Scale. Smaller banks buy payments, liquidity, and foreign exchange from larger ones rather than build them. That is true across borders and at home.

Correspondent banking is infrastructure, not a category of suspicious activity. A small bank's thin network explains a long route. So do currency availability, operating hours, credit limits, and commercial terms. Test a route against the service the respondent is buying and the institutions' real capabilities before reading complexity as concealment.

Correspondents and intermediaries

The two words are used interchangeably on payment screens, but they answer different questions. "Correspondent" describes a standing relationship: an account one bank holds for another under an agreement. "Intermediary" describes a role in one payment. Under Article 4A of the Uniform Commercial Code, an intermediary bank is any receiving bank other than the originator's bank or the beneficiary's bank [6]. A bank acts as an intermediary in a payment because it is a correspondent of the banks on either side of it.

A correspondent can also be the beneficiary's bank when the final recipient banks there. A bank can process a payment as an intermediary without being the main correspondent of either end customer's bank. SWIFT and other message carriers are neither: they move instructions, not money, and should not appear in a case chart as a bank that held funds.

Following the chain

Figure 2 shows a payment that needs several links. A U.S. originator's bank sends the wire to a large dollar correspondent. The correspondent debits or credits a foreign respondent's dollar account. That respondent holds an account for a smaller bank, which serves the beneficiary. The last link is a correspondent relationship the U.S. bank never opened.

For each link, record the sending and receiving legal entities, the account debited, the account credited, the instruction, the system used, and the status. Then record the commercial relationship separately. A customer instruction can take one route while its funding takes another. A currency conversion creates another leg, a return creates a new transaction, and a rejected instruction may never produce the posting shown on the original request. Build a graph of these events, not a single line copied from a payment screen.

Domestic correspondents and Federal Reserve access

Correspondent banking also works inside the United States. Community banks and credit unions buy wires, settlement, investment services, loan participations, and federal funds lines from larger banks and bankers' banks, which are banks owned by other banks and serving only them. The Federal Reserve uses a narrower sense of the word. In its accounting services, a correspondent is an institution that has authorized a Reserve Bank to settle another institution's transactions in the correspondent's master account. In that pass-through arrangement the respondent's activity settles in the correspondent's account, and the Reserve Bank looks to the correspondent [9].

That distinction matters when reading a wire record. An institution with its own master account settles there. An institution that sends through a correspondent appears in Fedwire data behind the correspondent, and the commercial entries that tie the payment to the respondent sit on the correspondent's books.

A domestic example makes the record split clear. A customer at Local Bank A pays a supplier at Local Bank B. A instructs its correspondent, X, which sends the payment on Fedwire to Correspondent Y. Y credits the account it holds for B, and B credits the supplier. If both local banks use X, X can settle internally and no Fedwire record exists for that payment. A holds the customer's authorization, X holds A's posting and the outgoing order, Y holds the receipt for B, and B holds the supplier's account and what happened next. A subpoena to X for the supplier's account opening file will come back empty because X never opened that account.

Concentration is a domestic risk too. Regulation F requires banks to manage their exposure to correspondents and limits overnight credit exposure to 25 percent of total capital unless the correspondent is at least adequately capitalized [10]. The banking agencies' 2010 guidance on correspondent concentration risk asks banks to identify, monitor, and plan for large exposures to a single correspondent [11]. A respondent that depends on one provider can lose payment capacity overnight if that provider fails, restricts it, or exits. A backup account helps only if it is approved, funded, connected, and able to carry the products the respondent needs.

Serial, cover, and book transfers

Cross-border payments combine local accounts, international messages, and domestic settlement. A foreign bank's instruction can produce a dollar transfer between two U.S. correspondents even though both end customers are abroad. The Wires article covers the rails themselves; here the question is which bank's account moves at each step.

In a serial payment the instruction passes bank by bank. An importer at Bank A pays an exporter at Bank B. A uses dollar Correspondent X in New York, and B uses Correspondent Y. A instructs X, X pays Y over Fedwire or CHIPS, and Y credits B, which pays its customer. Every bank in the chain sees the customer data, and each must pass it on.

In a cover payment the customer message goes straight from the ordering bank to the beneficiary's bank, while a separate bank-to-bank instruction moves the money through the correspondents. Before 2009 the cover message carried no customer information, so the correspondents moving the dollars could not screen the people behind them. The Basel Committee's 2009 guidance and the MT202 COV format that followed required the cover to carry the underlying originator and beneficiary [12]. Today the customer transfer is usually a pacs.008 and the cover a pacs.009 COV; older records carry the MT103 and MT202 COV.

Match the two tracks. A customer message and its cover are two records of one economic payment, not two losses. Collect the customer instruction, the cover, the references, values, dates, postings, and exceptions. A cover that arrives after the beneficiary has been credited is a reconciliation and credit question that may have an innocent explanation.

A book transfer happens when both respondents hold accounts at the same correspondent. The correspondent debits one vostro and credits the other on its own ledger. No Fedwire or CHIPS record exists, and the absence of one proves nothing about whether a payment happened. The correspondent's internal ledger is the only record of the dollar leg. Where a currency conversion occurs, identify the FX provider, both currencies, the rate, the time, the fees, and the local payout, and keep the amount ordered, the interbank amount, and the amount credited as three separate numbers.

U.S. funds transfer rules require banks to keep records of transmittals of $3,000 or more and require each bank in the chain to pass on the originator and beneficiary information it receives [13][8]. The Travel Rule obliges an intermediary to forward what it got, not to go back and retrieve what the sender left out. A correspondent that sees thin data has to ask.

What the relationship includes

A correspondent relationship is a bundle of services, and each carries its own risk. The Wolfsberg Group's Correspondent Banking Due Diligence Questionnaire, which the industry treats as its standard form, asks respondents about each product separately for that reason [14].

Labels hide different legal roles. Advising a letter of credit, confirming it, and reimbursing under it are three different functions, and confirmation adds the bank's own payment undertaking. Pull the instrument and the rules that govern it rather than inferring liability from correspondent status. A custody account is not the respondent's payment account, and a fintech's omnibus account at a sponsor bank can look like a correspondent relationship without making the fintech a respondent bank under every legal definition.

Pricing explains some differences between what was sent and what arrived. Account fees, transaction charges, FX margins, value dating, and repair charges all reduce the amount credited. Reconcile them before calling the gap theft by a mule.

Nested, payable-through, and RMA access

Nesting happens when a respondent lets other financial institutions use its correspondent account. It can be legitimate: it is how small banks in small markets reach the dollar. The risk is that the U.S. correspondent processes payments for banks it has never reviewed. U.S. enhanced due diligence rules require a correspondent to find out whether a high-risk respondent provides correspondent services to other foreign banks and, as appropriate, to identify those banks [7]. FATF guidance uses the same definition and recommends that the terms of any nested use be agreed in writing [2].

A payable-through account lets the respondent's own customers draw on the correspondent account directly. For these, U.S. rules require the correspondent to identify each person outside the respondent who has authority to direct transactions and to obtain basic due diligence on them [7]. In a case, ask for user entitlements, mandates, sub-account mappings, and access logs. An omnibus posting with a customer name in it does not prove that customer had direct access.

The SWIFT Relationship Management Application (RMA) controls which banks may exchange which messages with each other. An RMA permission is not an account, a funded balance, a credit line, or a sanctions clearance. Removing it is a quiet way to end message traffic, and FATF does not count an RMA exchange alone as a correspondent relationship [2].

The retreat

The number of correspondent relationships has been falling for more than a decade. BIS data show active correspondents fell about 25 percent between 2011 and 2020, including 4 percent in 2020 alone, while the value of cross-border payments kept rising [15]. Fewer, larger links now carry more value.

A BIS study of the 2011 to 2018 period found active correspondents fell by 20 percent and cross-border corridors by about 10 percent, from roughly 10,800 to 9,800. Banks withdrew more from countries with weak governance and poor controls on illicit finance, and less where trade and growth were strong. Complete loss of access was rare. In 2018 the sending country held interbank deposits in the receiving country for only about 14 percent of country pairs; another 74 percent could be reached through one third country [18]. Most payments still get through, by a longer and more expensive route.

The motives are mixed. In the survey work the BIS cites, about 40 percent of banks gave business strategy as a reason for exits, ahead of compliance cost [18]. FATF defines de-risking as ending or restricting relationships with whole countries or classes of customer "in order to avoid, rather than manage, risks" and warns that it pushes payments into less transparent channels [2]. The IMF's 2016 staff note found withdrawals had reached critical levels in some small states [19]. Research using SWIFT data found that a country added to the FATF grey list received up to 10 percent fewer payments [20]. Concentration is not new: a 2006 New York Fed study of Fedwire found that on a sample day a core of 66 banks and 181 links carried 75 percent of the value [21]. It does mean that the largest correspondents are now the most effective places to see, and stop, illicit flows.

The U.S. rules

Enhanced due diligence under Section 312 covers four things for a high-risk foreign bank: enhanced scrutiny of the account to detect and report suspicious activity, a check on whether the respondent nests other foreign banks, the identity of the owners of a respondent whose shares are not publicly traded, and, for payable-through accounts, the identity of the people who can direct transactions [7]. The program must also say what the bank will do when it cannot perform adequate diligence, including refusing to open, suspending, or closing the account.

The shell bank rule reaches indirect access too. A U.S. bank must take reasonable steps to make sure its foreign correspondent accounts are not used to provide banking services to a shell bank, with an exception for a regulated affiliate of a bank with a physical presence [22]. The owner, agent, and certification records under this rule are separate from beneficial ownership rules for customers, and the thresholds differ. Do not apply one ownership percentage to all of them.

The sanctions layer applies regardless of where the customers are. A U.S. correspondent that receives an offshore-to-offshore dollar payment involving a blocked person must block it, and must reject a prohibited transaction where there is no blockable interest. OFAC distinguishes the two outcomes, and a blocked payment cannot be returned on an ordinary fraud recall [26]. Since Executive Order 14114 in December 2023, Treasury can also cut off a foreign bank's U.S. correspondent or payable-through accounts, or impose strict conditions on them, if it conducts or facilitates significant transactions for Russia's military-industrial base [27].

How much the correspondent must know

The question practitioners argue about most is whether a correspondent has to know its customer's customer. The international answer is no, with conditions. FATF guidance states that there is no expectation, intention, or requirement for the correspondent to conduct customer due diligence on its respondent's customers [2]. The correspondent must understand the respondent's business, ownership, supervision, and controls, get senior management approval for new relationships, and monitor the flows. When a transaction looks wrong, it sends a request for information (RFI) to the respondent about the specific customer. FATF also says simplified due diligence is never appropriate for cross-border correspondent banking.

In the United Kingdom, regulation 34 of the Money Laundering Regulations sets out enhanced measures for correspondent relationships with institutions outside the UK, including assessing the respondent's controls, senior management approval, documented responsibilities, and assurances about customers with direct access. A 2026 amendment narrowed the regulation to relationships involving the execution of payments [28]. The FCA fined Ghana International Bank £5,829,900 in 2022 because, from 2012 to 2016, it did not adequately perform the additional checks required when it took on overseas respondent banks, could not show it had assessed their AML controls, and skipped annual reviews [29].

The European Union's new rulebook arrives in two steps. The Anti-Money Laundering Regulation applies from 10 July 2027. Its Article 36 sets enhanced measures for cross-border correspondent relationships with respondents outside the EU, including senior management approval, documented responsibilities, checks on payable-through access, and a record of any relationship ended for AML reasons [30]. The new EU Anti-Money Laundering Authority will select up to 40 institutions for direct supervision between July and December 2027 and start supervising them in 2028 [31].

In practice the due diligence runs as a cycle:

1. Onboarding. Ownership, licenses, business lines, customer base, AML program, and the CBDDQ. Senior approval for high-risk banks [14][7].
2. Certification. Shell bank and agent for service certifications for foreign banks [22].
3. Defining the service. Currency, branch, customer types, permitted downstream banks, direct access, expected volumes and destinations.
4. Monitoring. Flows against the expected profile, with every message screened.
5. RFIs. Questions about specific customers when activity does not fit. Slow, vague, or recycled answers are a risk signal in their own right.
6. Restriction or exit. Limit a product, block a corridor, or close the account, and record why.

A questionnaire is a starting point. Keep every version, the entity it covers, the signatory, and the evidence behind any material answer. The Danske case shows why: what a respondent told its correspondents, and when, became the core of a criminal fraud charge [32].

How criminals use the chain

Nesting and downstream access

Wachovia provided correspondent services to Mexican casas de cambio, including wires, bulk cash, and pouch and remote deposit services, without an effective program to monitor them. The Justice Department said that from May 2004 to May 2007 at least $373 billion in wires went from the exchange houses to Wachovia accounts, along with more than $4 billion in bulk cash and about $47 billion in deposited items such as checks and traveler's checks. Other U.S. banks had already stopped dealing with the exchange houses over drug money concerns [33]. The exchange houses were, in effect, nested respondents whose customers no U.S. bank examined.

Affiliates treated as safe

From 2006 to 2009 HSBC Bank USA rated Mexico as "standard" risk, its lowest category, and failed to monitor more than $670 billion in wire transfers and more than $9.4 billion in banknote purchases from HSBC Mexico. At least $881 million in drug proceeds moved through the U.S. bank [34]. Read the full case in The Gateway That Cost $1.9 Billion.

Non-resident and shell company banking

Danske Bank's Estonian branch moved about $160 billion through U.S. banks for its non-resident portfolio from 2008 to 2016 while giving those banks false information about its controls [32]. The full flow through the branch was roughly €200 billion; see €200 Billion Through a Branch Nobody Watched. In 2018 FinCEN found that Latvia's ABLV Bank had "institutionalized money laundering as a pillar of the bank's business practices," solicited shell company business, and served parties linked to North Korea, and it proposed a Section 311 ban on U.S. correspondent accounts [35]. The Russian Laundromat moved about $20.8 billion out of Russia through Moldovan court orders and Latvian banks [36]. Deutsche Bank's mirror trades moved about $10 billion out of Russia through paired trades in Moscow and London [37].

Sanctions stripping

BNP Paribas moved more than $8.8 billion through the U.S. financial system for Sudanese, Iranian, and Cuban sanctioned parties. It routed payments through third-party banks and removed references to sanctioned entities so its U.S. correspondents would process them, and it agreed to pay $8.9736 billion [38]. Standard Chartered admitted that from 2007 to 2011 a Dubai branch processed about 9,500 transactions worth about $240 million through U.S. banks for Iranian interests. In 2019 it agreed to an amended and extended deferred prosecution agreement with $240 million in forfeiture and a $480 million fine, alongside a $639 million OFAC settlement, in resolutions Treasury put at about $1.1 billion combined [39][40]. Agencies used different transaction populations and credited each other's penalties, so their headline figures should not be added together.

Shadow banking through third-country banks

FinCEN's 2025 analysis of Bank Secrecy Act data identified about $9 billion of potential Iranian shadow banking activity through U.S. correspondent accounts in 2024. Shell and front companies accounted for about $5 billion and oil companies for about $4 billion [41][42]. The money did not come from Iranian banks. It moved through front companies, including oil, shell, shipping, and technology procurement companies, concentrated in the UAE, Hong Kong, and Singapore, whose dollar payments cleared through U.S. correspondents. In August 2026 FinCEN proposed cutting off Banque Misr's five UAE branches, which it called a "critical access node to the U.S. dollar" for Iranian illicit finance; it said 103 front companies moved about $1.8 billion through the branches from January 2024 to June 2026 [43][44]. The proposal does not cover Banque Misr in Egypt, and it is not yet final. The same mechanics run through Russia-linked settlement networks such as A7 [45] and the Chinese money laundering networks covered in our Shadow Banking article [46].

Small banks built for risky clients

In February 2026 FinCEN proposed severing Switzerland's MBaer Merchant Bank from the U.S. financial system, citing Venezuelan corruption, Russian money laundering, and Iranian money laundering and terrorist financing through the bank [47]. FINMA had already withdrawn the bank's licence, and the bank's liquidation took effect at the end of that month [48].

Cartel money

In June 2025 FinCEN used the FEND Off Fentanyl Act for the first time, naming CIBanco, Intercam, and Vector Casa de Bolsa as institutions of primary money laundering concern and prohibiting U.S. institutions from sending or receiving funds transfers with them [49][50]. The effective date was later extended to 20 October 2025 [51].

Exchanges and crypto businesses

High-risk crypto exchanges need fiat banking somewhere. FinCEN's first Section 9714 order, in January 2023, cut Bitzlato off from U.S. institutions over its role in Russian illicit finance [52]. In October 2025 FinCEN issued a final Section 311 rule barring U.S. institutions from opening or keeping correspondent accounts for Cambodia's Huione Group, which it said had laundered at least $4 billion in illicit proceeds from August 2021 to January 2025, including for North Korea and for the networks behind "pig butchering" investment scams [53][54]. Our Crypto Rails article follows that money onto the chain.

Fraud and money mules

In business email compromise the first receiving account is often controlled by a mule or a front company, and the next hop is a cross-border wire through correspondents [55]. A bank's name on the route shows it processed the payment, not that it joined the scheme. The Money Mules article covers who supplies those accounts.

Trade and cash

Correspondents finance and settle trade they cannot see, which leaves room for over- and under-invoicing. Document compliance under a letter of credit is not proof that the goods existed. Banknote and bulk cash services can return drug cash to the banking system, as Wachovia and HSBC showed [33][34].

Jurisdiction follows the dollar account

A foreign bank that keeps a U.S. correspondent account becomes reachable by U.S. authorities and courts. That is the single most useful legal fact in this area for an investigator.

The D.C. Circuit case shows how far the subpoena reaches. A Chinese front company for a North Korean state-owned entity made more than $100 million in dollar payments from 2012 to 2015 and was a party to more than 680 dollar transfers that passed through U.S. correspondent banks. None of the three Chinese banks that held its accounts was suspected of wrongdoing. One had no U.S. branch and received a Section 319(b) subpoena on the strength of its correspondent accounts alone. The court held that records "related to" a U.S. correspondent account can include records of transactions that never touched it, when the customer existed only to reach the dollar, and it upheld the district court's finding that the government need not first try the mutual legal assistance agreement with China, given that process's record in North Korea cases [57].

Two cautions. These are powers of designated officials, not tools a bank investigator can use. And a foreign bank can face penalties at home for producing records, so expect the conflict of laws to slow production even where the U.S. power is clear.

Enforcement cases

Bank of America is the most recent. In October 2026 FinCEN found the bank willfully failed to conduct due diligence on correspondent accounts for foreign financial institutions and to file timely suspicious activity reports on more than $5 billion in transactions. OFAC's settlement covered 475 apparent violations in which the bank channeled correspondent banking payments through blocked banks because of technical and human errors [61][60].

What the cases share is information the correspondent already had and did not use: an exchange house whose customers no one examined, an affiliate trusted because it was family, assurances no one tested, and payment messages edited so screening could not see the party. None of them turned on a secret the correspondent could not have found.

Red flags

Treat every flag as a reason to ask a specific question, not as a finding. A thin RFI answer from a bank in a small market can reflect staffing, not concealment. The test is whether the answer resolves the risk that prompted the question.

Working a case

Start with the confirmed instruction and the ledger events. Build a chronology with amount, currency, value date, local time and UTC, status, and the source record for each line. Collect the identifiers as a bundle: UETR, message references, end-to-end IDs, BICs, routing numbers, account numbers, and Fedwire IMAD and OMAD or CHIPS references. A UETR is a good correlation key, but repairs and translations can duplicate it. Match it to amounts, times, and postings.

A bank-to-bank RFI can identify the next custodian, but it is not a subpoena. Section 314(b) gives eligible U.S. financial institutions a safe harbor to share information with each other about possible money laundering or terrorist financing, but only after they register with FinCEN [62]. It is not a route to a foreign bank's records. For compulsory production, go through prosecutors, the 319(b) subpoena, or mutual legal assistance, and ask for preservation early.

A worked case

The facts are fictional and illustrate method, not misconduct by any real institution.

A U.S. company pays USD 900,000 after receiving altered supplier instructions. Its account is at Community Bank A, which sends wires through Correspondent X. The recipient is a company at Foreign Bank B, which holds a dollar account at Correspondent Y. X pays Y over Fedwire, Y credits B's vostro, and B credits the recipient. The company reports the fraud the same afternoon.

The relationship map shows A as respondent to X and B as respondent to Y. The payment map shows the company, A, X, Y, B, and the recipient; X and Y are intermediaries for this payment. Fedwire connects X and Y but holds no customer file. Investigators match A's instruction, X's outgoing order, Y's posting, and B's credit by reference, amount, and time, and confirm that USD 900,000 reached the beneficiary's account. Fees were paid separately.

B's records show USD 250,000 still in the account, USD 400,000 sent to a crypto exchange, and USD 250,000 sent to a trading company at Bank C. The exchange identifies the customer account the deposit was credited to and reports conversions and withdrawals. Bank C has not yet answered. A broker's claimed link to the trading company is a lead, not a fact.

If B turns out to clear part of its dollar business through another bank's account, add that nested relationship only once the specific leg is identified, and request the downstream agreement and sub-ledger. An extra bank in the chain does not change the loss, which is still USD 900,000, and does not by itself prove concealment.

At the case conference, USD 200,000 has come back from B and USD 50,000 remains frozen pending a local process. Recovery is USD 200,000. The unrecovered USD 700,000 is the USD 50,000 frozen, the USD 400,000 sent to the exchange, and the USD 250,000 sent to the trading company. The Fedwire settlement and the matching correspondent postings are evidence of the same USD 900,000, not further losses. The next steps are specific: secure the frozen balance, establish who controls the exchange account and where its withdrawals went, get Bank C's records, and test the broker's story.

What to watch through 2027

• More special measures. In 2025 and 2026 Treasury used Section 311, Section 9714, and the FEND Off Act against institutions in Mexico, Cambodia, Switzerland, and the UAE [49][53][47][43]. Expect a final rule on Banque Misr UAE and more actions against banks that clear for Iranian, Russian, and cartel networks.
• EU supervision. The AML Regulation from July 2027 and direct AMLA supervision from 2028 will bring correspondent controls at the largest EU banks under one supervisor [31].
• Richer payment data. ISO 20022 and FATF's 2025 update to Recommendation 16 make missing or altered party data easier to spot along the chain [63].
• Concentration. Fewer, larger correspondents mean a single compliance failure reaches more respondents [5][64].
• New settlement models. BIS work on tokenized correspondent banking proposes shared screening and settlement across banks [65]. A shorter chain can reduce delay while leaving the question of who is behind the payment unanswered.