Correspondent banking due diligence that tests every CBDDQ answer against the respondent's own payments
Every respondent's file rebuilt each cycle, with nesting checked against real payments.
See one case, screen by screen ↓Correspondent banking due diligence is the review a bank runs on every foreign bank that holds an account with it: what the respondent does, who owns it, its regulator and AML record, and how the account is used. Correspondent Banking Due Diligence is a solution in which seven agents rebuild each respondent's file every cycle from its Wolfsberg CBDDQ, independent evidence and 90 days of its payment messages, and draft the memo and the request for information. The analyst prepares, the BSA Officer rates, and restrictions and exits take two committee signatures.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
Correspondent banking due diligence is the program a US bank runs for every foreign correspondent account it holds, under Section 312 of the USA PATRIOT Act: the respondent's business and markets, the account's purpose and expected activity, its regulator and AML record, owners of 10% or more for a bank whose shares are not publicly traded, the shell-bank certification, and enhanced due diligence for the riskiest. A correspondent KYC analyst assembles that file by hand once a cycle, from the respondent's Wolfsberg CBDDQ and its attachments, a license check, ownership, screening and news, and then writes the memo.
The weakest link is nesting. Question 19 of the CBDDQ asks whether the respondent lets other banks, money service businesses or payment service providers use its account. The respondent answers, and the answer is rarely tested, because the institution that really sent a payment sits in field 52 or 56 of an MT103, or in the debtor and intermediary agents of an ISO 20022 message, across thousands of messages a quarter. Analysts compare totals, not who is actually sending the payments. Where a bank cannot get comfortable, it closes the corridor; where it does not notice, an examiner does.
Estimated split for one respondent's periodic review, by hand and with the solution. The respondent's own time to answer a request is not counted.
Seven agents rebuild each file from the CBDDQ, the evidence and 90 days of payments; the BSA Officer rates and a committee of two decides exits.
Banco Merivale S.A., a privately held bank in Panama City, has held a US dollar clearing account at Corvane National Bank since 2009. It was rated Medium at its October 2025 review, and its 12-month periodic review is due October 31, 2026. Here is that review, screen by screen, in the working solution.
Seven agents rebuilt Banco Merivale's file on October 19 at 6:12 AM. The home screen draws its nesting tree from 4,693 payment messages worth USD 179.5 million, July 21 to October 18, 2026: five branches, each with its payments and value. Merivale's own customers and its two affiliates say Declared; Kestrel Exchange House and Andes Pay say Not declared. The review file sits beside the tree: 8 of 12 elements confirmed, nested relationships a gap, and the EDD determination and risk rating waiting on a decision.
“2 of 5 branches not declared · 252 payments · USD 7.4 M.”
Kestrel, a money exchange house in the Colón Free Zone, is the ordering institution in field 52D on 214 payments, USD 6.8 million, since August 3. They average USD 31,776, 61% are round thousands, and they grow from 6 a week to 30. They go to 37 beneficiaries, 29 of them electronics and phone wholesalers in Miami-Dade. A June 2025 news report names Kestrel in a customs inquiry.
The agents do not conclude; the analyst decides.
The CBDDQ Reader read 112 answers and 6 attachments; 73 answers are word for word last year's, question 19 among them. The 16 answers the file relies on are tested against registers, attachments and payments: 9 match, 3 are contradicted, 2 are declared elsewhere and 2 are self-declared only. Question 19 a1h says No to downstream MSBs and PSPs; Kestrel and Andes Pay say otherwise. The Cayman bank and the broker-dealer are listed in the ownership section, so they count as declared.
Expected activity holds: USD 59.8 million and 1,564 payments a month against USD 55–65 million declared. Owners of 10% or more are Grupo Merivale Holdings at 82.0% and Inversiones Calderón Ruiz at 12.5%; the shell-bank certification is valid to March 14, 2027; 14 owners and directors were screened, with one PEP director declared. Enhanced due diligence is not required by 1010.610(c), but Corvane policy requires it if the rating goes to High. The memo cites every sentence.
RFI-2026-1184 goes to Valeria Ostos, Banco Merivale's Chief Compliance Officer: Kestrel, question 19 a1h, Andes Pay, how Merivale monitors third-party payments, and originator details for 12 payments. Each question says why we ask and cites its evidence. Imani edits question 2 and sends the request for approval; she cannot send it to the respondent herself.
“Guardrail check passed: no mention of a referral, a report or an investigation.”
Imani refers the Kestrel activity to Samuel Ortiz in AML Investigations: referral REF-2026-0418, with the 214 payments, 12 messages, the CBDDQ page and the news report attached, and a case opened in case management. It is restricted from the moment it exists. Tomás Vidal, the relationship manager, and the committee members cannot see it and are not told; it never appears in an RFI.
AML Investigations sets the detection date; any SAR is due within 30 days of it.
The Risk Rater proposes 41 to 63, High, with confidence 0.91 on rating model v3.2. Each factor's change is cited: nesting and third-party payments 2 to 16, answers contradicted 0 to 6, enforcement and adverse media 5 to 7. Margaret approves the rating, the RFI with a 30-day deadline of November 21, and interim monitoring of Kestrel-originated payments. She could change the rating or return it with a reason code; Imani, who prepared it, cannot approve it.
Approving writes the rating to the customer due diligence system and sends the RFI by secure mail.
The committee's agenda shows Banque Marigot de l'Ouest's exit, with a 90-day wind-down after two RFIs went unanswered for 74 days, decided with 2 of 2 signatures. A restriction on First Saltmarsh Bank of Belize waits for both. Banco Merivale is on for notice: if the RFI is not answered satisfactorily by November 21, no third-party MSB payments, decided at the December 3 meeting.
October holds 26 periodic reviews and 3 new relationships: 9 filed, 11 in progress, 4 waiting on the respondent and 2 overdue. Each row carries the agents' note: Kumara Commercial Bank's CBDDQ not returned after 2 reminders, a 9-day gap in Orinoco Delta Bank's payment data. The team lead is alerted 5 business days before a due date, and an overdue review goes to the BSA Officer the same day.
Every action by people and agents is on the trail with its evidence, from the Review Scheduler opening the review on September 8 to Margaret's approval. An OCC request for three respondents is tracked against its 120 hours, with 76 left. The examiner pack is built as merivale-review-2026-10-exam.zip, 41 items with a SHA-256 hash, kept five years, with the restricted referral struck out.
The same review, seen by the people who carry it: what their cycle looked like, and what it looks like now.
Seven agents rebuild each file from the CBDDQ, the evidence and 90 days of payments; the BSA Officer rates and a committee of two decides exits.
Reads the Wolfsberg CBDDQ and its attachments, extracts every answer with its page, and flags missing attachments and answers unchanged since last year.
Checks the license on the regulator's register, owners of 10% or more, the shell-bank certification, sanctions and PEP screening of owners and directors, and enforcement history and news.
Reads 90 days of MT103, MT202 COV, pacs.008 and pacs.009 messages; any ordering or intermediary institution other than the respondent with 5 or more payments or USD 100,000 becomes a branch, compared with what was declared.
Scores the bank's rating model, eight factors, and proposes the rating with its confidence and each factor's change cited.
Drafts the due diligence or EDD memo and states the EDD determination, with every sentence cited.
Turns each gap into a question, tracks the deadline, reads the reply and re-runs the comparison, and pre-drafts the conditional restriction for the committee.
Opens reviews by rating cadence, sends CBDDQ refresh and certification requests in approved batches, and escalates by SLA.
Rate, restrict, exit. The agents propose; a named person decides.
Ask in plain words about a respondent, a branch of its tree or the month's reviews. Every answer points to its source, and the assistant opens the screen it is talking about.
Why is Kestrel Exchange House marked Not declared?
Banco Merivale's CBDDQ answers No to downstream relationships with MSBs (question 19 a1h). Yet Kestrel, a money exchange house, is the ordering institution in field 52D on 214 payments, USD 6.8 million, since Aug 3, 2026. I opened the payments for you.
What changed since last year's review?
Three things. Kestrel and Andes Pay appeared as ordering institutions after the 2025 review; 73 CBDDQ answers are word for word last year's, including question 19; and a 2025 news report names Kestrel. Owners, license and certification are unchanged.
Draft the request for information to Banco Merivale
Drafting five questions, each tied to a gap and cited: Kestrel, question 19, Andes Pay, monitoring, and originator details for 12 payments. It goes to Margaret Lin for approval; you cannot send it yourself.
Which reviews are overdue, and who has them?
Two. Banque Marigot de l'Ouest (Marcus Bell, 13 days late, exit proposed to the committee) and Dniester Commercial Bank (Claire Dubois, 6 days late, escalated to Margaret Lin). I filtered the cycle for you.
12 screens from the working solution, on its sample data. Pick one to see it large.
The rating model, cadence, nesting rule and privacy settings are the bank's own. A change is saved as a new version and applies when the BSA Officer approves it.
| Setting | Default | Choose from |
|---|---|---|
| Risk rating bands | Low under 35 · Medium 35–59 · High 60 and above | Rating model v3.2, eight factors; Model Risk signs a new version |
| Review cadence | High every 6 months · Medium 12 · Low 24 | Plus event-driven reviews: new nesting, ownership change, enforcement or a sanctions hit |
| Nesting rule | 90-day window; a branch at 5+ payments or USD 100,000+ | Reads MT103, MT202 COV, pacs.008 and pacs.009 |
| RFI deadline | 30 days | Set by the BSA Officer in the decision |
| Escalation | Team lead 5 business days before due; BSA Officer on the due date | Only the BSA Officer extends a due date |
| Shell-bank recertification | Every 3 years | Requested 90 days ahead |
| Retention | Five years after a file is superseded or the account closes | Account numbers of payment parties redacted in internal audit packs |
| Payment parties | Visible to KYC, AML and audit | Masked for relationship managers; referrals never on their view (locked) |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures and rules (BIS, December 2021, correspondent relationships down about 25% from 2011 to 2020; 31 U.S.C. 5318(k)(2), records within 120 hours of a federal banking agency's request; 31 CFR 1010.630, shell-bank certification recertified at least every three years; 31 CFR 1010.610, Section 312 due diligence; FFIEC BSA/AML Examination Manual, 2023). Corvane National Bank, Banco Merivale, Kestrel Exchange House and every other bank, account and payment named on this page are fictional, and the people are characters in the working solution.
Correspondent banking due diligence is the review a bank runs on every foreign bank that holds an account with it: what the respondent does, who owns it, its regulator and AML record, and how the account is used. Correspondent Banking Due Diligence is a solution in which seven agents rebuild each respondent's file every cycle from its Wolfsberg CBDDQ, independent evidence and 90 days of its payment messages, and draft the memo and the request for information. The analyst prepares, the BSA Officer rates, and restrictions and exits take two committee signatures.
Nested, or downstream, correspondent banking is when other banks, money service businesses or payment service providers send payments through a respondent's account. The Nesting Rebuilder reads 90 days of MT103, MT202 COV, pacs.008 and pacs.009 messages and makes every ordering or intermediary institution other than the respondent a branch once it reaches 5 payments or USD 100,000. Each branch is compared with what the respondent declared, and a branch it did not declare is marked Not declared, with its messages one click away.
The CBDDQ Reader extracts every answer with its page, and flags answers unchanged from last year and missing attachments. The Evidence Checker and the Nesting Rebuilder then test the answers the file relies on against registers, attachments and the payments, and mark each one as matching, contradicted, declared elsewhere or self-declared only. An affiliate listed in the ownership section counts as declared, not as undeclared nesting.
Yes. The shell-bank certification is one of the twelve file elements, with its expiry date and a citation to the document. The Review Scheduler requests recertification every 3 years, 90 days ahead, and the correspondent network view shows the certifications expiring within 90 days.
No. A referral is restricted from the moment it is made: it is hidden from the relationship manager's screens, left out of every request for information and of every export pack except the BSA Officer's, and the respondent is never told. The RFI Drafter is barred from mentioning a referral, a report or an investigation, and a guardrail check runs on every draft.
Yes. The agents propose and cite; they never set a rating, send a notice, close a file or extend a due date. The BSA Officer approves or returns each rating and RFI with a reason code, a QC reviewer closes the file, and a restriction or exit needs two Correspondent Risk Committee signatures.
Yes. The rating factors and bands, the cadence by rating, event-driven review triggers, the nesting threshold, the RFI deadline, escalation, recertification, retention and redaction are all settings. A change is saved as a new version; Model Risk signs a new rating model, and the BSA Officer approves it.
The Agentic Solution Engine builds and deploys it from your requirements and documents: your correspondent banking policy, rating model and a sample of past respondent files and payment data. It goes live once every quality gate has passed. We will walk you through it on your own respondents first.
Every nostro break explained from its payment messages and cleared with two signatures.
1-min demoLetter of Credit Document CheckingExamined twice, cited to the rule, decided on banking day two of five.
1-min demoBank Guarantee & Standby LC IssuanceEvery clause tied to a model form and a rule, and no instrument issued without an end date.
1-min demoWe'll run Correspondent Banking Due Diligence on a sample of your own respondents' questionnaires and payments.