Correspondent banking is the bedrock of international financial flows. It's the mechanism by which banks facilitate cross-border payments, trade, and FX by maintaining accounts with foreign banks. It's a complex area with several risks. Nested accounts (also known as downstream or payable-through accounts) add further complexity to compliance, sanctions screening, and anti-money-laundering.
A respondent bank can be set up in a nested structure whereby another bank uses its correspondent account to get access to the international network. That often means the respondent bank itself will not know who the end clients are or what they're doing. This lack of visibility (particularly in the current regulatory environment) can lead to sanctions violations, illicit flows, and reputational risk. Managing the nested relationships is now a key part of financial crime compliance.
Understanding Correspondent Banking and Nested Accounts
Correspondent banking is when one bank (the correspondent) provides services to another bank (the respondent) to facilitate a cross-border transaction. It lets a smaller or regional bank access the global payment system without having to be a bank in every country it needs to transact in.
Nested accounts involve a third party (a further bank or a series of downstream entities) using the account that the respondent has with the correspondent bank to clear and/or settle. In such nested structures, the correspondent may not even be aware of all the entities which are using its services. This, in turn, creates obscurity about the originator and ultimate beneficiary of the funds and makes compliance monitoring considerably more difficult.
This risk is exacerbated when nested relationships route funds through high-risk jurisdictions or when downstream institutions have weak AML and sanctions controls. The correspondent bank may be unaware of the end users and may therefore be carrying out transactions for sanctioned or otherwise illicit entities.
Global Regulatory Criteria and Expectations
Today, virtually every country has its own set of rules in place from its regulators for how correspondent banking relationships should be conducted. The FATF established the international standard in Recommendation 13, which requires due diligence on the correspondent bank, avoidance of shell banks, and additional checks where higher risk is identified. In its 2016 Guidance on Correspondent Banking Services, the FATF made it clear that regulators generally would not want to see all correspondent relationships terminated at the same time. They prefer a risk-based approach to managing exposure.
The Basel Committee on Banking Supervision reasserted the same principles in its 2017 Revised Annex on Correspondent Banking. It emphasises transparency, ownership verification, and regular reviews of ongoing correspondent relationships.
In the U.S., Section 312 of the USA PATRIOT Act requires banks with correspondent accounts for foreign entities to carry out due diligence (particularly in high-risk jurisdictions). Other jurisdictions have similar rules. AUSTRAC in Australia, for instance, requires banks to conduct initial and ongoing due diligence, maintain strong documentation, and assess any nested exposure in a correspondent relationship.
The message is the same across major jurisdictions: transparency, traceability, and active monitoring are key to correspondent banking compliance.
Sanctions and Illicit Finance Risks
Nested correspondent banking structures have repeatedly surfaced in high-profile sanctions violations and money laundering cases. The most recent example is Al-Huda Bank Federal Register (2024), which showed that a nested structure can provide a sanctioned or high-risk entity with indirect access to the U.S. financial system. The investigation revealed that the bank was using nested accounts to obscure both the originator and the beneficiary in an attempt to get around the correspondent level controls.
Investigations such as the FinCEN Files (ACAMS Today 2020) have demonstrated how criminals use correspondent banking to get their money into the global system. They do this by obscuring the actual owners and the origin of the funds through a series of layered transactions across several jurisdictions and by exploiting weak controls and the deficiency of consistent information sharing further down the chain.
These cases underline the criticality of robust monitoring, independent verification and the need for co-operation between the correspondent and the respondent to ensure the integrity of the compliance process.
Operational and Compliance Challenges
This form of nested relationship creates a number of operational and compliance issues for the manager. The main issue is access to customer information. Correspondent banks normally rely on information provided by respondent institutions as part of their KYC process, and in many cases this information is unavailable for legal, privacy, or jurisdictional reasons.
Another big issue is transaction monitoring. Older screening systems are designed to look at direct counterparties, not more complex, nested structures. That in itself creates blind spots where you can have hidden or indirect participants that go completely unmonitored. Legacy systems also lack the data architecture to track the full payment chain or circular fund flows between institutions.
From a governance perspective, nested relationships often sit in some very murky area of responsibility. Often, no specific function in an organisation deals with nested risk, and compliance reviews are unlikely to detect those exposures. The situation is further complicated by different national sanctions regimes, different data privacy regimes (GDPR in Europe being the prime example), and inconsistent disclosure regimes.
How to Manage Nested Risks
Even with these difficulties, financial institutions can go a long way toward minimising the risk of nested accounts by being systematic and forward-thinking. The first thing to do is to build a complete relationship map which will show all the direct and indirect correspondent links, all the downstream institutions and their beneficial owners. That data needs to be kept up to date. Beyond mapping and monitoring relationships, you need real day-to-day controls in place. These include regular reviews of nested correspondent transactions to identify trends or irregularities, real-time alerts for suspicious activity or unusual flows of funds, and escalation procedures so the compliance group is alerted and can report and investigate possible breaches. You also need to reconcile transaction data regularly, do spot checks on documentation from respondent banks, and maintain a strong audit trail.
One practical approach is to use a risk-based segmentation model. You segment correspondents by risk (taking into account things like geography, product, and volume) and then apply Improved Due Diligence as appropriate based on the risk you've identified.
In addition, technology increasingly plays a role in managing nested risk. Advanced analytics and machine learning can help identify relationships that aren't immediately apparent and track the flow of funds through complex systems. The compliance unit will also look at external data sources (LEIs, beneficial ownership registers, etc.) to help verify and understand the structures in question.
Finally, it's about using standardised due diligence templates to ensure you gather the same information consistently. The Wolfsberg Correspondent Banking Due Diligence Questionnaire is a prime example and is used by many institutions to structure their due diligence process.
Governance is another key element. Senior management needs to oversee it, independent audits are needed, and clear processes must be in place to handle anomalies. Ongoing personnel training is also essential, particularly to spot nested risk scenarios so the compliance group stays up to speed on the types of risk out there.
Emerging Trends and Future Outlook
The future of correspondent banking compliance is going to be defined by new technology and the drive for common regulatory standards. AI-powered graph analytics now enable compliance teams to see the full transaction network and identify nested patterns that were previously invisible. Shared KYC utilities and cross-border data-sharing frameworks are also being used more to improve transparency between institutions.
Blockchain and tokenised settlement are opening up a whole new set of possibilities and risks. The distributed ledger can be a very effective tool for traceability, and tokenised settlement can, in theory, reduce the need for correspondent banking. The risks are around pseudonymity and the difficulty of applying jurisdictional controls. For the compliance function, this means we'll need to adjust our controls to account for these new transaction types. Monitoring tools will need to analyse on-chain activity, identify wallet ownership, and spot suspicious flows or patterns specific to blockchain transactions. The compliance unit may need to work more closely with the technology team, update risk assessments to include blockchain entities, and adapt due diligence to reflect that they are dealing with clients engaging in digital asset transactions. The right controls can be put in place to capture the benefits of transparency while managing the specific risks of blockchain payments.
Regulators are actively working to align AML and sanctions rules to close oversight gaps and improve global supervision. The institutions best positioned to manage this are those already investing in data quality, automation, and joint compliance.
Conclusion
Nested correspondent relationships sit at the nexus of financial innovation and financial crime risk. They are absolutely fundamental to international trade but present a very substantial oversight challenge. Institutions that understand these vulnerabilities and can apply risk-based monitoring, governance, and due diligence actively are the ones that can protect themselves from enforcement and, in turn, help build a more transparent and durable financial system.
In today's world, where visibility is as important as security, the ability to trace every transaction from the correspondent all the way down to the ultimate beneficiary is the key test of a strong financial crime control framework.
To underpin this key objective, the compliance group should be focused on the following best practices in respect of nested account and correspondent banking risk:
Key Compliance Actions Checklist:
- Map all correspondent and nested relationships, including downstream institutions and beneficial owners
- Apply a risk-based segmentation model to classify relationships by risk level
- Perform regular due diligence and periodic reviews of both direct and indirect relationships
- Track transactions in real time for unusual patterns, circular flows, and hidden participants
- Use advanced technology and external data sources to identify and verify complex account structures
- Maintain complete audit trails and reconcile transaction data regularly
- Implement clear escalation protocols for potential violations or questionable activities
- Ensure strong governance, including senior management oversight and independent audits
- Provide ongoing training for staff to stay alert to developing risks and typologies
These steps will help compliance professionals manage exposure and protect the integrity of the global flow of finance.