FRM Exam Part II · Sound Management of Risks Related to Money Laundering and Financing of Terrorism

Third Parties, Correspondent Banking and Wire Transfers in ML/FT Risk

Updated 11 October 2026 · Fact-checked

A bank may rely on a third party or introducer for customer due diligence, but it stays responsible for the outcome. Correspondent banking needs enhanced due diligence on the respondent bank, and shell banks are prohibited. Wire transfers must carry accurate originator and required beneficiary information through the payment chain.

Understand Use of Third Parties, Correspondent Banking and Wire Transfers

Banks do not always meet customers directly or run every check themselves. They may use an introducer, another group entity, or an outsourced provider. The core Basel principle is that ultimate responsibility for customer due diligence (CDD) stays with the bank. You can use someone else's work. You cannot hand over the accountability.

There is a difference between reliance and outsourcing. In reliance, the bank depends on a third party that is itself regulated and supervised, and that has applied CDD to the customer under its own relationship. In outsourcing or agency, the provider acts as the bank's agent, follows the bank's own policies and procedures, and the bank treats the work as its own. The bank must still be able to get the CDD data and copies of documents without delay, and must check that the third party is supervised and has sound controls. The country risk of the third party also matters.

Correspondent banking means one bank (the correspondent) provides services such as settlement, clearing or cash management to another bank (the respondent). The correspondent has no direct relationship with the respondent's underlying customers, yet it processes their transactions. That limited visibility creates ML/FT risk. So the correspondent applies enhanced due diligence to the respondent: its ownership and management, business, location, AML/CFT controls, supervision quality, and the purpose of the account. Senior management approval is needed to open the relationship, and responsibilities of each bank should be clearly documented.

Two features are especially risky. A shell bank has no physical presence in the country where it is incorporated and is not part of a regulated financial group subject to effective consolidated supervision. Banks must not enter or continue relationships with shell banks, and must make sure respondents do not allow shell banks to use their accounts. Payable-through accounts let the respondent's customers transact directly on the correspondent account. The correspondent must be satisfied that the respondent has done CDD on those customers with direct access and can provide the data on request.

For wire transfers, the FATF standards require the originator and beneficiary details to travel with the payment. This helps authorities trace funds and lets institutions screen for sanctions. Ordering, intermediary and beneficiary institutions each have duties, and missing information triggers risk-based action.

Key formulas to remember

Responsibility rule for third parties: Ultimate CDD responsibility = relying bank (always); Reliance or outsourcing never transfers accountability to the introducer or provider.
Conditions for reliance: Third party regulated and supervised + CDD and record-keeping in place + data available without delay + country risk assessed; If any condition fails, the bank should do its own CDD.
Correspondent banking approach: Enhanced due diligence on respondent + senior management approval + documented responsibilities; Applies to cross-border relationships in particular; assess respondent's AML/CFT controls and supervision.
Shell bank rule: Shell bank = no physical presence + no regulated group affiliation → relationship prohibited; Also ensure the respondent does not serve shell banks.
Payable-through accounts: Respondent's customers have direct access → respondent must have done CDD and provide data on request; Treat as higher risk.
Wire transfer information: Originator: name, account number, address/ID. Beneficiary: name, account number. Information must accompany the transfer.; Ordering institution must verify originator information. Intermediary institutions pass the information along. Beneficiary institution checks for missing data.

How to solve Use of Third Parties, Correspondent Banking and Wire Transfers questions

Use the same sequence for any scenario question on third parties, correspondent banking or wires.

1Identify the relationship type: introducer reliance, outsourcing/agency, correspondent banking, payable-through account or wire transfer.
2Identify the role of the bank in the question: relying bank, correspondent, respondent, ordering, intermediary or beneficiary institution.
3Recall the core principle: accountability stays with the bank, or the information must travel with the payment.
4Check the conditions: is the third party regulated and supervised, can data be obtained promptly, and is the country risk acceptable?
5Look for red flags: shell bank, weak supervision, nested use of the account, missing originator data, no senior approval.
6Pick the response: enhanced due diligence, own CDD, reject or suspend the payment, terminate the relationship, or consider a suspicious transaction report.
7Eliminate options that transfer responsibility to the third party or ignore the risk-based approach.

Quickest way: Two-question filter

When to use it: When you have about a minute per question and the options look similar.

Ask: who is accountable? If an option says the third party takes over responsibility, reject it.
Ask: what is missing? Supervision, physical presence, senior approval or payment information. The right option fixes that gap.
Reject any option that allows a shell bank relationship.
Prefer enhanced due diligence over simple CDD for correspondent banking.

Common mistakes in Use of Third Parties, Correspondent Banking and Wire Transfers

Believing responsibility moves to the introducer once it performs CDD.
The word reliance sounds like handing over the task.
Fix: Remember that the relying bank remains ultimately responsible for CDD.
Treating reliance and outsourcing as the same thing.
Both involve someone else doing CDD work.
Fix: Reliance uses a supervised third party with its own customer relationship. Outsourcing uses an agent working under the bank's own policies.
Confusing the correspondent and the respondent.
Both are banks and the names sound alike.
Fix: The correspondent provides the service and holds the account. The respondent is the bank using the service.
Thinking a shell bank is any small or offshore bank.
Shell sounds like a size or location label.
Fix: A shell bank lacks physical presence and is not part of a regulated, consolidated group. A small bank with real operations and supervision is not a shell bank.
Assuming standard CDD is enough for a correspondent relationship.
The respondent is a regulated bank, so it looks low risk.
Fix: Cross-border correspondent banking calls for enhanced due diligence, because the correspondent cannot see the respondent's underlying customers.
Forgetting that wire information must travel through the whole chain.
Students focus only on the ordering bank.
Fix: Remember the three roles: ordering collects and verifies, intermediary passes on, beneficiary institution detects missing data.

Worked examples

Example 1

A bank in Mumbai opens accounts for new corporate clients through an introducer in another country. The introducer is a regulated financial institution and has supplied CDD documents. The bank's compliance head says the bank no longer needs to worry about CDD quality because the introducer is now responsible. Which statement is correct? A) The compliance head is right because the introducer is regulated. B) The bank remains ultimately responsible and should check that the introducer is supervised and that data can be obtained without delay. C) The bank is responsible only for the first year of the relationship. D) The bank is responsible only if the introducer is unregulated.

Show the solution

Identify the relationship: reliance on an introducer for CDD.
Recall the principle: ultimate responsibility for CDD stays with the relying bank.
Check A: wrong, because regulation of the introducer does not transfer accountability.
Check C and D: both invent time or regulation conditions for responsibility. Neither is a Basel principle.
Check B: matches the principle and the conditions for reliance.

Answer: B

Example 2

A US bank (correspondent) is asked by a foreign bank (respondent) to open a USD account. Due diligence shows the respondent is licensed in a small jurisdiction but has no physical office there, no staff, and no affiliation with a supervised banking group. What should the US bank do? A) Open the account with enhanced due diligence. B) Open it as a payable-through account to limit exposure. C) Decline the relationship, because the respondent appears to be a shell bank. D) Open it and rely on the respondent's own customer checks.

Show the solution

Identify roles: the US bank is the correspondent and the foreign bank is the respondent.
Test the facts against the shell bank definition: no physical presence and no regulated group affiliation. Both are met.
Recall the rule: banks should not establish or continue relationships with shell banks.
Check A: enhanced due diligence does not cure a prohibited counterparty.
Check B: payable-through access would increase risk, not reduce it.
Check D: relying on the respondent's checks is unacceptable for a shell bank.

Answer: C

Exam tips

Look for the phrase ultimate responsibility. The correct option almost always keeps it with the bank.
Know the role names cold: correspondent, respondent, ordering, intermediary, beneficiary institution.
Shell bank questions usually have a clear answer: do not deal. Do not pick enhanced due diligence as a fix.
In wire transfer questions, look for the missing piece: originator or beneficiary data, or a failure to pass it along.
Payable-through and nested accounts are flagged as higher risk because the correspondent cannot see the end users.

Practice questions from Sound Management of Risks Related to Money Laundering and Financing of Terrorism

Use of Third Parties, Correspondent Banking and Wire Transfers: frequently asked questions

What is the difference between a respondent bank and a correspondent bank?

The correspondent bank provides services such as settlement, clearing or cash management and holds the account. The respondent bank is the one that uses those services, usually to reach a market or currency it cannot access directly.

Why is correspondent banking considered high risk for ML/FT?

The correspondent processes transactions for the respondent's customers without knowing who they are. Visibility is limited, so it must rely on the respondent's controls and apply enhanced due diligence to the respondent itself.

Can a bank rely on a third party for customer due diligence?

Yes, if the third party is regulated and supervised, has CDD and record-keeping measures, and can provide data without delay. The bank still carries ultimate responsibility for the CDD outcome.

What is a payable-through account?

It is a correspondent account that the respondent's own customers can use directly to transact. The correspondent must be satisfied that the respondent has done CDD on those customers and can supply the information on request.