Correspondent banking AML: how to monitor wire transfers

Until late 2024, Bank of America allowed "simplified" due diligence on the correspondent accounts of its own foreign branches and affiliates, and their files described the business in phrases such as "treasury services". The branches FinCEN examined held accounts for more than 250 non bank financial institutions, money services businesses among them, whose payments did not match the bank to bank flows on file. A third party review followed in 2025. It found some monitoring models for those accounts "too narrow". It is all in FinCEN's consent order (pp. 50 to 52), announced on 13 October 2026, whose statement of facts the bank admitted.

Correspondent banking is one bank making and receiving payments for another, the respondent, whose customers it never onboards. To the correspondent, each of those customers is a name in a message. So AML transaction monitoring on a correspondent account starts from the respondent's file: what the account is for and what its normal traffic looks like.

What are the money laundering risks in correspondent banking wires?

Money laundering through correspondent accounts works because the respondent holds the customer file and the correspondent holds only the message. Criminals exploit that split in four ways. Layering passes funds through several respondents and intermediaries until nobody down the chain sees where they started. Shell companies appear as debtor and creditor, with invoices that explain nothing. Weak controls at the respondent let the money in at the first bank, and gaps between jurisdictions put that bank where supervision is thin.

With only the message to test, the correspondent carries the respondent's risk. That makes the account a risky surface and is the short answer to why correspondent banking is high risk; the correspondent banking entry sets out the wider factors.

Picture a respondent sending 300,000 dollars for a trading company through its New York correspondent to a supplier abroad. The correspondent sees two banks, two company names and a purpose line. It does not see that the trading company opened its account last month. The review of the biggest money laundering scandal cases puts correspondent flows among five stages where controls broke.

Does a correspondent have to know its respondent's customers (KYCC)?

No. FATF's guidance on correspondent banking services (October 2016) says the term Know Your Customer's Customer "has created a lot of confusion", and that there is "no expectation, intention or requirement" for the correspondent to conduct customer due diligence (KYC) on the respondent's customers (p. 4). FATF expects the correspondent to watch the respondent's own transactions for a change in its risk profile, unusual activity or a departure from the agreed terms. A payment that looks unusual gets a request to the respondent about that payment, and the request may reach the customer behind it.

Which monitoring rules turn correspondent banking AML red flags into alerts?

Table 1. Correspondent banking AML red flags as monitoring rules (no thresholds; each is set against the respondent's file)

Five rows read the respondent as a whole, four of them month by month, because a change in its business shows only in totals: volume, corridors, the mix of names, the share of payments with missing data. The other four fire on one payment, since one agent field or an empty cover block is reason enough to ask. No row has a threshold, because a corridor that is new for one respondent is the core business of another.

These are the specific detection patterns you can walk an examiner through, and all nine read data the correspondent already holds, so correspondent banking automation can cover them.

complead, formerly Sanction Scanner, runs rules like these in its transaction monitoring software. Its rules engine builds each rule from conditions, thresholds and score effects without code, and can limit a rule to one segment, such as respondents that serve payment firms. Before a rule goes live, a team replays it over the last 30, 60 or 90 days and reads off the alert volume, clearance rate and true positives for that window. The alert names the rule that fired. An analyst makes the call, and the record shows who.

How do you test a respondent's volume against its stated business?

Picture a respondent whose file expects about 400 payments worth 10 million dollars a month through three corridors (figures illustrative). In March it sends 1,240 payments worth 27.9 million dollars, and two corridors appear that the file never named. Count runs at 3.1 times the file and value at 2.8 times. The rule compares the month with the file, not with last month. Slow growth still shows.

31 CFR 1010.610(a)(3) asks for a periodic review of account activity against the account's "type, purpose, and anticipated activity" and sets no frequency, so you set the interval by the respondent's risk. In Wolfsberg's 2026 guidance, account activity findings feed the periodic enhanced due diligence review.

How do nested relationships and payable through accounts show in wire data?

A local payment firm in country A bundles its customers' remittances for country B into one payment. It sends the bundle to a global payment firm, which banks with Bank 2 and pays out. The Wolfsberg Group's guidance on banking non bank payment service providers calls this flow nested for Bank 2, because Bank 2's customer is paying for its own customer's customers (15 July 2026, p. 15). In this nested correspondent banking example, the nested correspondent risk shows in three places.

1. Another bank in the agent fields. A downstream bank named by its SWIFT code as previous instructing agent or debtor agent means the respondent serves a bank through your account. FATF wants correspondents able to catch nesting the respondent never disclosed (2016, p. 12), and US enhanced due diligence asks whether a foreign bank lets other foreign banks use the account (1010.610(b)(2)).
2. Bundled payments with no supporting detail. One payment for many remittances hides who pays whom. Wolfsberg's 2024 roles guidance lists bundled payments "with no supporting detail", perhaps aggregated third party payments, among the models a respondent may use (p. 5).
3. The respondent's customers as debtor. That is a payable through account (PTA), a correspondent account that third parties use directly for their own business (INR.13). Under R.13(e), CDD on those customers stays with the respondent, and the correspondent must be satisfied that it was done and is available on request. US rules go further. They want the names of anyone who can move money through the account and the source and owner of its funds (1010.610(b)(1)(iii)).

Wolfsberg's 2026 account activity reviews look for "new payment corridors" and "unexpected nesting" (p. 12). These Wolfsberg Group guidelines are not law.

What does an ISO 20022 payment message tell a monitoring rule?

A payment message names every bank that touched it, as long as each bank keeps the fields. SWIFT stopped carrying cross border MT payment instructions such as the MT103 between banks when coexistence ended on 22 November 2025. That anatomy now sits in the successor ISO 20022 messages: pacs.008, the customer credit transfer, and pacs.009, the credit transfer between financial institutions, which also carries cover payments.

The CPMI's ISO 20022 data requirements for cross border payments (17 October 2023) list a rule's inputs. Intermediary Agent 1 to 3 name the banks in between. Previous Instructing Agent 1 to 3 and Ultimate Debtor depend on the payment case, but once added they must travel the whole chain "unchanged" (Table A3.1, notes 6 and 7). A cover pacs.009 carries the underlying customer transfer with it (Table A3.2, notes 8 and 9). The requirements apply from the end of 2027. The CPMI says they are not regulation. Free text travels as unstructured remittance information, and Wolfsberg's sanctions screening guidance counts the stated purpose in Field 70 of a SWIFT message among the attributes banks most often screen (2019, p. 9).

Say Bank K sends a pacs.008 with Bank M in Previous Instructing Agent 1 (illustrative). If Bank K's file never named Bank M, the undisclosed bank rule fires.

SWIFT deferred its structured address requirement on 27 August 2026 and promised an update "by December, at the latest". Its 21 September update gave no new address date.

What does each bank in the chain check under the revised Recommendation 16?

Table 2. Who checks what under revised Recommendation 16 (INR.16, June 2026 text)

FATF agreed the revised Recommendation 16 on 18 June 2025. The changes take effect "by the end of 2030". FATF's draft guidance on the new text took comments until 21 August 2026. Footnote 60 equates the ordering and beneficiary institution with ISO 20022's debtor agent and creditor agent, so Table 2 maps onto the message.

In the Wolfsberg Group's payment transparency roles guidance, the bank that gives a respondent its account is the intermediary, and one of its duties is to confirm that the respondent's payment model "is operating as expected" (2024, p. 5).

What happens after an alert on a respondent's payments?

The FATF guidelines of 2016 set out the loop in paragraphs 32 and 33:

1. Send a request for information (RFI) on the alerted payment. FATF wants it "targeted on the specific transaction" that raised the alert, so the respondent knows what to explain.
2. Ask what FATF lists. The questions include how long the customer has banked with the respondent and whether it is rated high risk, the account's purpose, the parent company and beneficial owners, the source of funds, the reason for the payment and the link to the counterparty.
3. Log the answer against the alert. Asking about one customer "does not amount to a requirement to conduct CDD" on that customer, and the log shows an examiner where that line was kept.
4. Recheck the respondent's file. The answer may contradict the due diligence record or the respondent's Wolfsberg CBDDQ (amended 10 February 2023).
5. Retest similar payments. FATF asks the correspondent to review its controls so payments like the alerted one are caught.
6. Escalate a late or thin answer. The respondent should answer "in a timely fashion" and to the detail asked. If it does not, a suspicious transaction report may follow, and any RFI can lead to a reassessment of the respondent's business and risk profile.

When does monitoring end a relationship, and is that de risking?

US rules expect procedures for when due diligence cannot be done: when to refuse to open the account, suspend activity, file a SAR or close it (1010.610(d)). An exit after a failed RFI loop is a decision about one respondent.

The problem of de risking is a different decision: a bank exits a whole country or class of customer so it can avoid the risk instead of managing it (FATF 2016, p. 4). In the CPMI's correspondent banking chartpack, active correspondents fell 52.1 percent in the Caribbean and 50.5 percent in South America from 2011 to 2022 (Table 6, p. 9). Keep the RFI log with the exit decision, so it shows which of the two you made.

Which banks must a correspondent payment filter stop?

According to FATF's 2016 guidance, monitoring of a correspondent account has to cover targeted financial sanctions (para 30). Where the relationship mainly carries wire transfers for the respondent's customers, it points monitoring at how well the respondent screens for sanctions (para 31). A US correspondent's filter reads every agent field against more than the SDN list:

1. Banks on the OFAC SDN list. A listed bank in any agent field stops the payment for review.
2. The CAPTA list. OFAC's list of foreign financial institutions under correspondent account or payable through account sanctions sits with its OFAC non SDN lists on the other sanctions lists page.
3. Section 311 final rules. Since 17 November 2025, 31 CFR 1010.664 bars correspondent accounts for Huione Group and asks for reasonable steps to find its use of foreign correspondent accounts, as far as "transactional records" show it.
4. Section 2313a orders. Since the orders took effect on 20 October 2025, no transmittal of funds "from or to" CIBanco, Intercam or Vector is allowed, and the Intercam and Vector orders run "with no cessation date". Since 16 April 2026, payments the Mexican government's liquidator needs to wind up CIBanco are allowed.
5. Proposals, watched but not applied. FinCEN's proposed 311 rules on MBaer Merchant Bank, on H-Pay Service PLC and other Huione Group successors, and on Banque Misr UAE were still proposals on 3 November 2026.

Which 2026 rules and notices changed correspondent banking monitoring?

• 2 March. FinCEN proposed cutting MBaer Merchant Bank off from US correspondent accounts (91 FR 10034).
• 16 April. The CIBanco order was amended to allow liquidation payments.
• 24 June. FATF opened its consultation on draft Recommendation 16 guidance.
• 25 June. FinCEN proposed adding H-Pay Service PLC and other successors to the Huione Group rule (91 FR 38340).
• 15 July. The Wolfsberg Group published its guidance on banking non bank payment service providers.
• 27 August. SWIFT deferred all payments changes of Standards Release 2026, structured addresses included.
• 1 September. FinCEN proposed revoking Banque Misr UAE's correspondent access (91 FR 56085).
• 21 September. SWIFT set 12 June 2027 for its deferred 2026 release.
• 5 October. FinCEN proposed prohibiting covered financial institutions from certain transmittals of funds involving companies outside the United States that the A7 Network controls, under section 9714 (91 FR 63208).
• 13 October. FinCEN's consent order with Bank of America set out the correspondent account findings above.

When the respondent's answer does not clear the alert, the correspondent decides whether to file and how the RFI history goes into the narrative of its SAR or STR.

Sources and review. Barbaros Sercan built this monitoring guide on the FATF Recommendations (June 2026 text), FATF's 2016 correspondent banking guidance and its Recommendation 16 pages of 2025 and 2026, 31 CFR 1010.610 and 1010.664, the 2313a orders and their 2026 amendment, FinCEN's Bank of America consent order, the CPMI's ISO 20022 requirements and chartpack, four Wolfsberg Group documents, SWIFT's conversion FAQ and address notice, and OFAC's list page, each opened on 2 or 3 November 2026. Fact check: Laura Otterpohl, Compliance Manager at Candex, signed on 6 November 2026.