Compliance, sanctions and de-risking

Correspondent banking is one of the most heavily controlled areas in finance, because a correspondent account can be used to move money for money laundering, for terrorist financing, or for evading sanctions, and the correspondent bank is responsible for checking the payments that pass through its account. Every payment that goes through a correspondent account is screened against sanctions lists, including the lists maintained by the United Nations, the United States Office of Foreign Assets Control, the European Union and the United Kingdom. If a payment mentions a sanctioned person, a sanctioned country or a sanctioned entity, it is stopped, and the correspondent bank must decide whether to reject it, to block it, or to report it. The difference between a reject and a block matters, and the analyst must get it right. A reject means the payment is returned to the sender and the funds are not moved, usually because of a sanctions hit that turns out to be a false positive or a policy decision by the bank. A block means the funds are frozen in place, the payment is not returned, and the bank must report the block to its regulator, in the United States to OFAC, and must hold the funds until it receives permission to release them. A blocked payment can sit for months or years. The system must therefore distinguish a reject from a block, must record which authority was notified, and must prevent any user from releasing a blocked payment without the required approval. The correspondent bank also has to know its respondent bank, a process known as know your customer for banks, and it must understand the respondent's customers, its business, its controls and its risk profile. The correspondent will ask for the Wolfsberg Correspondent Banking Due Diligence Questionnaire, audited financials, licences, ownership structure, anti money laundering policies, transaction volumes and customer base, and it will review this information every year. If the correspondent is not satisfied, it can restrict the account, raise the fees, or close the relationship. The cost of knowing the customer and screening the payments has made some relationships unprofitable, and the correspondent has chosen to exit rather than to take the risk. Nested correspondent banking is the highest risk variant, and it deserves its own attention. When a respondent bank processes payments for its own respondent banks, the correspondent at the top of the chain is exposed to customers it has never seen and cannot identify. The Wolfsberg Group's guidance requires the intermediary bank to understand the nested bank's business, to apply risk based controls, and to be able to identify the underlying originator when asked. A correspondent that discovers its respondent is offering nested services without disclosure may close the account immediately. The analyst must therefore ask, for every respondent relationship, whether nested activity is permitted, whether it is disclosed, and what controls apply. For the payment itself, compliance means that the payment message must carry enough information for the correspondent and the intermediary banks to screen it. The message must identify the originator with a name, an account number and an address, and it must identify the beneficiary with a name and an account number. This is the travel rule, FATF Recommendation 16, and it applies to every cross border payment. A payment with missing or vague information will be stopped for a query, and the query will delay the payment by days. In ISO 20022 the originator information is carried in the Dbtr and DbtrAcct elements of the pacs.008, and the beneficiary in the Cdtr and CdtrAcct elements, and the system must validate that they are populated before the payment is released. Screening itself is a system with its own design. Every payment is checked against sanctions lists, against the bank's internal watchlists, and against transaction monitoring rules that look for unusual patterns, such as round amounts, rapid movement of funds, or payments to high risk countries. A hit produces an alert, and the alert goes to a compliance queue where an analyst reviews it and decides to release, reject or escalate. The payment is held while the alert is open, which means the screening system is on the critical path for every payment, and a slow screening system is a slow payment product. The analyst must specify the screening rules, the queueing, the service level for clearing alerts, and the audit trail, because a payment released without screening is a regulatory breach. When a large correspondent closes accounts in a small country, the banks in that country lose access to dollars or euros, their customers cannot pay for imports, and remittances become slower and more expensive. Regulators and the Financial Stability Board have pressed correspondent banks to take a risk based approach rather than a wholesale exit, and to use the information in the Wolfsberg questionnaire to differentiate between high risk and low risk respondents. The analyst who works on a corridor that has lost a correspondent should document the impact, escalate it, and explore alternatives, including regional clearing, payment system linkages, and fintech networks, because losing a correspondent is a business continuity event, not just an operations problem. A practical compliance checklist for the analyst: does the payment capture screen collect the full originator name, account and address, and the full beneficiary name and account. Does the system validate the BIC against the SWIFT directory and the IBAN with the MOD 97 check before release. Does every payment carry a UETR so it can be traced. Does the screening engine check the payment before it leaves the bank, and does it log the result. Does the exception queue distinguish a reject from a block, and does it prevent a blocked payment from being released without approval. If the answer to any of these is no, the product has a compliance gap, and the analyst should raise it before the product goes live, because fixing it after a regulator finds it is far more expensive.