The Banking System: Wires

What a wire is

A wire is a credit transfer the sender pushes to the receiver. The remitter instructs its bank to pay a named beneficiary at a named bank, and the payment moves forward through one or more banks until the beneficiary's bank credits the account. Article 4A of the Uniform Commercial Code, which governs most wholesale funds transfers in the United States, calls each instruction in that chain a payment order and treats the whole sequence as one funds transfer [1][2]. Fedwire transfers are also governed by the Federal Reserve's Regulation J, which incorporates Article 4A for transfers over the Fedwire Funds Service [3].

Three things separate a wire from an ACH debit, a card payment, or a check. The remitter starts it. Each payment settles individually rather than in a batch. And once the receiving bank is paid, the payment is final. Fedwire treats a payment as final and irrevocable when the receiver's master account is credited or when the advice of credit is sent, whichever comes first [4]. There is no chargeback. A sender who wants money back has to ask the beneficiary's bank to return it, and that bank can refuse, this is referred to typically as a wire recall.

Finality is what makes wires the rail of choice for real estate closings, corporate treasury, securities settlement, and interbank funding. It is also what makes them the rail of choice for fraud. The investigator's job usually begins after the money has already left.

It helps to separate four layers that people often blur together:

A payment can move across all four layers in seconds. The records for each layer sit in different systems, often at different institutions, and an investigation that collects only one of these layers tends to miss the parties that matter.

Fedwire and ISO 20022

The Fedwire Funds Service is the Federal Reserve Banks' real-time gross settlement (RTGS) system. Each payment settles one at a time, in central bank money, by debiting the sending bank's master account at a Reserve Bank and crediting the receiving bank's [5]. The Fed describes the service as having more than 5,000 customers [6]. A single Fedwire funds transfer can be as large as $10 billion minus one cent [4].

The volumes are large. In 2025 Fedwire settled 217,296,700 transfers worth about $1.148 quadrillion, an average of $5.28 million per transfer. On an average business day that meant 869,187 transfers worth about $4.59 trillion [7]. Value has grown each year since 2023, while the average size of a transfer has fallen from $5.62 million in 2023 to $5.40 million in 2024 and $5.28 million in 2025 [7].

The operating day opens at 9:00 p.m. Eastern time on the preceding calendar day and closes at 7:00 p.m. Eastern, with a 6:45 p.m. cutoff for third-party (customer) transfers [5]. In October 2025 the Federal Reserve Board approved adding Sundays and weekday holidays, moving Fedwire and the National Settlement Service to 22 hours a day, six days a week. Participation in the extra days is voluntary, and implementation is planned for no earlier than 2028 [8][9]. For investigators, a longer operating week means more transfers will land while fraud teams and beneficiary banks are off shift.

FedNow, the Fed's instant payment service, is a separate rail. Its network transaction limit rose to $10 million in November 2025 [10]. FedNow overlaps with small wires, but it is not Fedwire, and its records live in a different system.

ISO 20022 on Fedwire

On 14 July 2025 Fedwire replaced its legacy proprietary format with ISO 20022 messages in a single-day cutover [11]. The format change matters to investigators because it changes what data a wire can carry and where to find it.

Every Fedwire value message carries an Input Message Accountability Data (IMAD) reference assigned when the sender submits it and an Output Message Accountability Data (OMAD) reference assigned when the Fed delivers it. Under ISO 20022 both sit in the business application header and group header, and the Fed checks for duplicates by IMAD [12]. Ask for the IMAD and OMAD in every subpoena or request to a bank; they are the keys that let the Fed, the sending bank, and the receiving bank point at the same transfer.

Value messages must also carry a Unique End-to-end Transaction Reference (UETR). The Fed checks that the UETR is in the right format but does not check that it is unique [12]. A UETR copied across two transfers is a data quality problem at best and a sign of manual tampering at worst.

The Fed's service pages give a practical detail that matters during a recall. A bank asks for its money back with a non-value camt.056 return request, and asks whether funds were received and credited with a camt.110 investigation request [13]. Neither message moves money. A return requires a new pacs.004 from the receiving bank.

ISO 20022 releases keep changing the format. The Fed rescheduled its planned November 2026 Fedwire release to November 2027 [14]. Field mapping in monitoring and case tools has to follow those releases, or structured fields will arrive in the warehouse and never be scored.

CHIPS

The Clearing House Interbank Payments System (CHIPS) is the private-sector counterpart to Fedwire, owned and operated by The Clearing House. It clears more than $2 trillion on an average day across more than 630,000 transactions, for 43 direct participant banks [15]. In 2025 average daily value rose about 9 percent to $2.014 trillion, and volume rose about 12 percent [16].

CHIPS does not settle each payment gross. Each participant prefunds a balance held in an account at the Federal Reserve Bank of New York, and CHIPS's algorithm releases payments throughout the day by netting them against offsetting payments and the participant's balance [17]. The Clearing House reports that about 95 percent of CHIPS payments settle with finality within seconds and that in 2025 each dollar of liquidity settled roughly 26 dollars of payments [15]. At the 6:00 p.m. Eastern close, unreleased payments are netted again and settled, and any that still cannot be released are removed. The CHIPS day opens at 9:00 p.m. Eastern the evening before [17].

A simplified example shows why netting saves liquidity. Bank A owes Bank B $100 million, Bank B owes Bank C $90 million, and Bank C owes Bank A $80 million. Settled gross, the three banks need $270 million of liquidity. Netted, A pays out a net $20 million, B receives a net $10 million, and C receives a net $10 million. Twenty million dollars of funding clears $270 million of payments.

CHIPS is overwhelmingly an international rail. When CHIPS moved to ISO 20022 on the 8 April 2024 banking day, The Clearing House said that about 95 percent of CHIPS payments were the dollar leg of a transfer that began or ended outside the United States. The first ISO day processed 555,345 payments worth $1.81 trillion [18].

For records, The Clearing House keeps CHIPS payment data on a rolling five-year basis and tells requesters it does not hold account files, correspondence, or memoranda [19]. CHIPS can show that a payment moved between two participants and what the message said. It cannot show who the customer was. That evidence sits at the participants.

SWIFT: messaging, not settlement

SWIFT does not move money. It is a cooperative messaging network, incorporated in Belgium, that carries payment instructions and other financial messages between institutions. Money moves when the banks named in those messages debit and credit accounts, often on Fedwire or CHIPS for the dollar leg [20]. Investigators who write "the funds were sent via SWIFT" are describing the instruction, not the settlement.

The National Bank of Belgium, which leads Swift's cooperative oversight by G10 central banks, reports about 11,800 registered live users in more than 200 countries and territories and about 2,400 shareholders. In 2024 the network carried 13.4 billion messages, or 53.3 million a day. Payments made up 44.8 percent of traffic and securities 50.3 percent [20]. Swift's own count of institutions on the switch to ISO 20022 was more than 11,500 [21]. The two figures measure different things, and both support the shorthand of "more than 11,000 institutions."

The move off MT

Swift ended the coexistence period for MT and ISO 20022 payment instructions on 22 November 2025. Swift said that 97 percent of payment instructions on the next business day were native ISO 20022, with a contingency conversion service for the rest [21]. By August 2026 the share was more than 98 percent [22]. The planned November 2026 move from unstructured to structured postal addresses was deferred after banks and market infrastructures asked for more time [22]. Expect to see unstructured, free-text addresses in wires for a while longer, which limits how far address data can be screened or matched.

The UETR

Every Swift payment message carries a 36-character UETR. Swift requires the originating bank to generate it, intermediaries to pass it on unchanged, and banks issuing cover payments to copy the original UETR into the cover message [23]. The UETR lets an investigator ask every bank in a chain about the same payment without matching amounts and dates by hand. If a bank cannot produce the UETR, ask why.

Security and sanctions

The 2016 Bangladesh Bank theft showed that a valid SWIFT message is not the same as a legitimate payment. The New York Fed said the instructions it received were fully authenticated by SWIFT under standard protocols [24]. Swift's Customer Security Programme followed. The National Bank of Belgium reports that since the start of 2021 there has been no customer incident involving a fraudulent message sent over the Swift network [20].

Access to SWIFT is also a sanctions tool. In March 2012 Swift disconnected EU-sanctioned Iranian banks after an EU Council decision, effective 17 March [25]. In March 2022 the EU barred Swift services to seven Russian banks, effective 12 March 2022 [26]. Russia's own messaging system, SPFS, became the workaround, and OFAC warned in November 2024 that foreign banks joining SPFS risk sanctions exposure [27]. For the networks that route around both, see Shadow Banking.

Beyond the dollar

Most large economies run their own RTGS system, and Swift messages connect them. The euro area's T2 settled an average of 431,067 euro payments a day worth €1,932.8 billion in 2025 [28]. The Bank of England's RTGS system, which settles CHAPS, settles more than £800 billion on an average working day [29]. Canada's Lynx is an RTGS system built on ISO 20022, with real-time settlement finality [30]. China's Cross-border Interbank Payment System (CIPS) had 193 direct and 1,573 indirect participants across 124 countries and regions by the end of 2025 and handled 180.2 trillion yuan of payments that year [31]. A sanctions or fraud trace that leaves the dollar often continues on one of these systems, and each has its own reference numbers and records.

Correspondent banking and cover payments

A bank that cannot settle dollars directly on Fedwire or CHIPS holds an account at one that can. That account relationship is correspondent banking, and it is how most cross-border dollar payments reach the U.S. rails [32]. The respondent bank's customers never meet the correspondent, which sees only what arrives in the message. (Our correspondent banking article covers the relationship itself.)

The number of these relationships has been falling. BIS data show correspondent relationships declined by about 25 percent between 2011 and 2020 [33]. Fewer relationships concentrate flows on fewer large banks and push smaller respondents toward nested arrangements, where a foreign bank reaches the U.S. through another foreign bank's account.

U.S. law treats these accounts as high risk. Section 312 rules require due diligence on foreign correspondent accounts and enhanced due diligence for certain foreign banks, including a look at whether the respondent offers access to other foreign banks [34]. Section 313 rules bar correspondent accounts for foreign shell banks and require records of the respondent's owners and a U.S. agent for service of legal process [35]. Industry due diligence usually runs on the Wolfsberg Group's Correspondent Banking Due Diligence Questionnaire (CBDDQ) [36].

Serial and cover

A cross-border customer payment can move two ways.

In the serial method, one customer message (MT103 or pacs.008) moves from bank to bank along the chain. Every bank sees the originator and the beneficiary.

In the cover method, the originator's bank sends the customer message directly to the beneficiary's bank and sends a separate bank-to-bank message through the correspondents to move the money. Before 2009 that bank-to-bank message (MT202) carried no customer data, so intermediary banks paid for transfers without seeing who was paying whom. The Basel Committee called for cover messages to carry originator and beneficiary information, and Swift introduced the MT202COV [37]. Under ISO 20022 the cover message is the pacs.009 COV, which carries the underlying customer credit transfer details; high-value systems such as EURO1 list it as a separate message type alongside pacs.008 and pacs.009 [38].

Cover payments create three practical problems.

• Double counting. The customer message and the cover message describe the same payment. A monitoring system that counts both will inflate volume, and one that drops the cover will miss the correspondents in the chain.
• Data drift. The beneficiary in the cover's underlying-customer fields should match the beneficiary in the customer message. A mismatch can be a routing error or a deliberate attempt to show the correspondent something different.
• Plain MT202s and pacs.009s. A bank-to-bank message that is really funding a customer payment but carries no customer data is the stripping problem the 2009 reforms targeted. It still appears in nested chains.

The Travel Rule and BSA recordkeeping

The Bank Secrecy Act's funds transfer rules sit in 31 CFR 1010.410. For transfers of $3,000 or more, the originator's bank must collect and retain the originator's name, address, amount, date, payment instructions, beneficiary bank, and whatever beneficiary details it receives. Intermediary and beneficiary banks have their own retention duties. The Travel Rule requires each bank in the chain to pass the required information to the next [39]. BSA records are generally kept for five years.

In 2020 FinCEN and the Federal Reserve proposed lowering the threshold for transfers that begin or end outside the United States from $3,000 to $250 [40]. That rule was not finalized, and the $3,000 threshold still applies.

The international standard has moved further. In June 2025 FATF revised Recommendation 16 on payment transparency. For cross-border payments above USD or EUR 1,000, the revised standard expects the originator's name, address, and either date of birth or another identifier to travel with the payment, and it adds expectations for checking that the beneficiary name matches the account. FATF set the end of 2030 for implementation [41].

The records an investigator can ask for:

For cross-institution work, Section 314(b) lets registered financial institutions share information about possible money laundering or terrorist financing with each other under a safe harbor [42]. In a fraud case it is often the fastest way to learn what the beneficiary bank already knows about the account.

Building the chain of proof

A wire trace is a sequence of linked records, and each link should be proved with a document from the institution that holds it.

1. Start with the originator's bank: the customer's instruction, the authentication record, and the outgoing message with its UETR and, for Fedwire, the IMAD.
2. Get the settlement record. For Fedwire, the sending and receiving banks can produce the IMAD and OMAD; for CHIPS, the participants' records and, if needed, The Clearing House's payment data.
3. Follow each intermediary. A correspondent statement shows the debit and credit, and the cover message shows what the correspondent was told.
4. At the beneficiary bank, get the account opening file, the credit posting, and every outgoing transaction from the account for the following days.
5. Repeat for the next hop. Mule and laundering accounts rarely hold funds long, so the second and third banks are often where the controlling party appears.

Each step answers a different question: who instructed the payment, which banks moved it, who received it, and where it went. Missing links should be written down as gaps, not filled with assumptions.

OFAC screening

Every wire that touches a U.S. bank is screened against OFAC's sanctions lists, and the screening covers every party and every bank in the message, including the underlying customer fields of a cover payment. Two outcomes are possible when there is a true hit. If the payment involves blocked property or an interest of a blocked person, the bank blocks it and holds the funds in a blocked, interest-bearing account. If the payment is prohibited but involves no blocked interest, the bank rejects it and returns it [43]. Both outcomes trigger a report to OFAC, due within 10 business days [43][44].

Screening quality depends on the data in the message. Unstructured addresses, abbreviated names, and missing country codes cut match rates. ISO 20022's structured fields help only if banks fill them.

The biggest sanctions cases in wire history were cases about changing message data so screening could not see it. Banks deleted references to sanctioned parties, replaced them with the bank's own name, or moved payments into cover messages without customer data. The practice is called stripping. The case table below shows how expensive it became.

Wire fraud and business email compromise

Wire fraud is a federal crime when a scheme uses interstate or foreign wire communications [45]. In payments work the term usually means a fraudulent wire transfer, most often from business email compromise (BEC).

The FBI's Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025 reporting $20.877 billion in losses, up 26 percent from the year before. Investment fraud was the largest loss category at $8,648,617,756, followed by BEC at $3,046,598,558 [46]. Over the decade from October 2013 to December 2023, IC3 counted more than $55 billion in exposed BEC losses worldwide, reported from all 50 states and 186 countries [47].

BEC works because a wire is final and because the beneficiary bank pays by account number. The usual pattern:

1. The criminal compromises or spoofs an email account at a vendor, a law firm, a title company, or the victim's own finance team.
2. A message arrives with new payment instructions, often at an invoice due date or a closing.
3. The victim sends a legitimate, authorized wire to the new account.
4. The receiving account, usually a money mule or a shell company, moves the funds out within hours, often abroad or into crypto.

FinCEN's BEC advisory sets out how these schemes target vulnerable business processes and asks banks to file suspicious activity reports with the "BEC FRAUD" key term [48].

A worked example

This example is fictional. A manufacturer pays a parts supplier about $1.2 million a quarter by wire. An email that appears to come from the supplier's controller says the supplier has changed banks and attaches a letter on copied letterhead. The accounts payable clerk updates the vendor record and releases a $1.2 million Fedwire on the due date.

The receiving account was opened five weeks earlier in a business name one letter off from the supplier's. Within three hours of the credit, it sends $400,000 to a second domestic account, $500,000 by wire to a trading company in Hong Kong, and $250,000 to a cryptocurrency exchange. When the real supplier asks about its missing payment ten days later, about $50,000 is left.

The records that matter are the vendor change request and its email headers, the call-back log (or the absence of one), the IMAD and OMAD, the beneficiary bank's account opening file, and the three outgoing transfers. A recall filed on day one, with a 314(b) request to the beneficiary bank, would have had a chance at most of the money. But, on day ten it is simply a forensic trace.

The recall window

Speed decides whether money comes back. IC3 tells victims to contact the originating bank at once to request a recall or reversal and a hold harmless letter or letter of indemnity [49]. FinCEN's Rapid Response Program, run with the FBI, has helped recover more than $1.1 billion since 2015, and FinCEN says it works best when the complaint is filed within 72 hours [50]. The IC3 Recovery Asset Team's Financial Fraud Kill Chain froze $679,013,183 in 2025 across domestic and international incidents [46].

What happens after a recall request:

Liability

Article 4A puts the loss on the customer when a bank followed a commercially reasonable security procedure the customer agreed to, and the payment order was verified under it [2]. When the name and account number in a payment order refer to different people, the beneficiary's bank may rely on the number unless it knows they do not match [51]. In Studco Building Systems v. 1st Advantage Federal Credit Union (2025), a business email compromise paid by ACH credit, the Fourth Circuit applied the same Article 4A rule and held that "knowledge" means actual knowledge, and that automated name-mismatch reports nobody reviewed did not create liability [52]. Banks that do review those alerts may change their exposure, and victims' lawyers will ask whether they did.

For remittance transfers to consumers, Regulation E gives senders 30 minutes after payment to cancel [53]. Wholesale wires have no such window. In the United Kingdom, CHAPS participants now reimburse authorised push payment fraud on the same terms as Faster Payments, with a maximum of £85,000 per claim [29].

Typologies

Large-value rails show up in almost every serious laundering case. These are the patterns that recur.

Business email compromise and mule cash-out

The victim's wire lands in a domestic account opened days or weeks earlier, often in a business name close to the real vendor's. Funds move out the same day by wire, cashier's check, card withdrawals, or crypto purchases. FinCEN reports that Chinese money laundering networks appear in suspicious activity reports totaling about $312 billion from 2020 through 2024, often using money mules and front companies [54]. See Money Mules.

Non-resident and nested flows

A respondent bank with many offshore customers routes their dollar wires through its correspondents. The correspondent sees the respondent's name and the message, not the customers behind it. Danske Bank's Estonian branch moved about $160 billion through U.S. banks for its non-resident portfolio from 2008 to 2016 while misleading those banks about its controls [55]. The full flow through the branch was roughly €200 billion; read the case in €200 Billion Through a Branch Nobody Watched.

Mirror trades

A client buys a security in rubles in Moscow while a linked offshore entity sells the same security in dollars in London. The trades net each other out, and dollars leave Russia through the sale proceeds without a visible cross-border wire from the client. New York regulators found that Deutsche Bank's mirror trades moved about $10 billion out of Russia [56].

Sanctions stripping and cover abuse

Messages are edited so screening cannot see a sanctioned party, or payments are routed as bank-to-bank transfers with no customer data. BNP Paribas moved more than $8.8 billion for sanctioned Sudanese, Iranian, and Cuban parties this way [57].

Sanctions evasion through intermediaries

Russian and Iranian networks route payments through third-country front companies and banks so that the message names an ordinary trading company in a permitted jurisdiction. FinCEN's alert on the A7 Network describes sub-agents named as the paying party on invoices and payment instructions so that payments run from non-Russian accounts through correspondent banking and SWIFT channels [58]. Treasury's 2026 actions against Iran's shadow banking system targeted front companies, exchange houses, and financiers that perform the same function [59]. FinCEN and BIS publish red flags for export control evasion that show up in the same wire data, including transshipment points and freight forwarders as listed beneficiaries [60].

Trade-based laundering

Wires settle invoices that are overpriced, underpriced, duplicated, or fake. The wire is clean on its face; the problem is the trade behind it. GAO has described the information-sharing gaps that make this hard to catch [61].

Message system compromise

Attackers who reach a bank's payment interface can send authenticated instructions. In the Bangladesh Bank case, the U.S. complaint charged a North Korean programmer with the February 2016 theft of $81 million through fraudulent SWIFT messages to the New York Fed, part of attempted thefts of at least $1 billion from banks between 2015 and 2018 [62]. Thirty-five payment instructions seeking $951 million reached the New York Fed. Five were paid and 30 were blocked, according to the New York Fed's general counsel [63]. See the timeline entry.

Fake guarantees and "SWIFT proof"

Advance-fee schemes sell standby letters of credit, bank guarantees, or "MT760 proof of funds" that do not exist. Victims receive screenshots of supposed Swift messages. Swift messages are bank-to-bank, so a customer cannot "receive" one, and a real one can be confirmed only by the bank that supposedly received it.

Network concentration

Fedwire's payment network is dense at the core and sparse at the edges. A New York Fed study of Fedwire found that the giant strongly connected component, the set of banks that can all reach one another through payment flows, averaged about 5,086 banks a day, and that just 66 banks and 181 links accounted for 75 percent of the value paid [64]. Later New York Fed research found that banks' outgoing payments remain highly sensitive to incoming payments even when reserves are plentiful [65]. For investigators, concentration means a few correspondents see a very large share of the flow, and their monitoring choices matter beyond their own customers.

Red flags

These indicators come from FinCEN advisories, enforcement findings, and the patterns above. One flag rarely proves anything. Several together, on the same account or counterparty, justify a closer look.

Enforcement cases

These cases show what regulators found when banks treated the wire message as a formality.

BNP Paribas

BNP admitted that from at least 2004 through 2012 it moved more than $8.8 billion through the U.S. financial system for Sudanese, Iranian, and Cuban sanctioned parties. It routed payments through third-party banks, told other banks not to name sanctioned entities in payments sent through the United States, and removed those references from payment messages itself. The plea agreement set total criminal penalties of $8.9736 billion, made up of an $8.8336 billion forfeiture and a $140 million fine [57]. The Federal Reserve imposed a separate $508 million civil penalty [66].

Danske Bank

Danske pleaded guilty in December 2022 to conspiring to defraud U.S. banks. Its Estonian branch had told its U.S. correspondents that it had controls it did not have, so those banks kept processing dollar payments for high-risk non-resident customers. The Justice Department said about $160 billion moved through U.S. banks for the branch between 2008 and 2016. Danske agreed to forfeit $2.059 billion [55].

TD Bank

TD Bank pleaded guilty in October 2024 to Bank Secrecy Act and money laundering conspiracy charges. The Justice Department found that about 92 percent of the bank's transaction volume, about $18.3 trillion from January 2018 to April 2024, went unmonitored, and that three laundering networks moved more than $670 million through it [68]. FinCEN imposed a record $1.3 billion penalty [69], and the OCC added $450 million and a growth restriction [70]. Across agencies the resolution came to about $3 billion after credits.

Bank of America

In October 2026 Treasury announced penalties against Bank of America: $1.2 billion from FinCEN, $750 million from the OCC, and $11.6 million from OFAC. FinCEN found the bank failed to conduct due diligence on foreign correspondent accounts and failed to timely report more than $5 billion in suspicious transactions, more than $1 billion of it tied to national security and other priority risks. OFAC cited 475 apparent violations involving payments processed through correspondent accounts for blocked banks [72][71].

What the cases share

Each case turned on information the bank had in the wire chain and did not use: customer names removed from messages, respondent banks whose customers no one examined, alerts that were never generated, or a payment message that was authenticated but wrong. U.S. prosecutors have the money laundering statute [73] and Section 311 special measures [74] for the worst actors. For the banks in the middle, the cases come down to reading the messages they already receive.