Correspondent Account, Nested Flows, and a Foreign Supervisor's Request

Gaps

• Stale due diligence. A three-year-old questionnaire does not evidence current understanding of the respondent's business, its customer base, or the quality of its AML program. Foreign correspondent relationships require periodic refresh, and a satisfactory FATF rating for the jurisdiction is a starting point, not a substitute for institution-level review.
• Nested / payable-through activity. Introducing brokers placing funds for underlying clients means the bank is effectively clearing for customers it has never seen. This is the highest-risk feature in the file and it is not addressed anywhere in the current documentation.
• Beneficial ownership. The home regime does not require BO collection, so the bank cannot assume it exists; where its own obligations require BO on higher-risk relationships it must obtain it independently.
• Ongoing monitoring. No evidence of transaction testing against expected activity.

On reliance

Reliance on a respondent's CDD is permitted in many frameworks, but it is never a transfer of responsibility: the correspondent remains accountable for the adequacy of its own risk assessment and for understanding the nature of the respondent's business. Reliance presupposes that the respondent actually performs the CDD - here, the regime does not require the underlying element, so reliance on beneficial-ownership information is not available at all.

Required actions: refresh the questionnaire and conduct a review; obtain a clear statement of which entities' clients are permitted through the account; obtain underlying customer information on request as a contractual condition; conduct transaction testing and, where feasible, an on-site visit; document the risk rating and the approval level for the relationship.

Immediate handling of the payment

• Do not release the payment pending review. Request the commercial invoice, purchase order, bill of lading, certificate of origin and details of the underlying parties. A refusal or inability to produce shipping documents for a goods-related payment is itself the finding.
• Establish who the ordering and beneficiary parties actually are, including beneficial owners, and whether any party is on a sanctions list - this is a screening question before it is a suspicion question.

What the pattern suggests

• Nested flows plus missing trade documentation plus two intermediary banks is a textbook combination for trade-based value transfer or layering through a jurisdiction with weak transparency. The circularity of intermediaries also obscures the originator, which is the point.
• If the payment was released before documentation, that is a control failure to be remediated and disclosed internally, not just an individual transaction issue.

Broader response

1. Escalate to the BSA officer and file a SAR describing the payment and the inability to obtain supporting documentation, with continuing-activity review.
2. Consider 314(b) information sharing if another covered institution is involved.
3. Impose conditions on the relationship: restrictions on nested activity, prohibition on payments for third parties without documentation, a remediation timetable.
4. Document explicitly that the $6 million fee was considered and did not influence the outcome - the file should show that the risk decision was made on risk grounds.
5. If the respondent cannot evidence controls over nested activity, exit is the correct endpoint; partial de-risking that leaves the highest-risk channel open is the worst of both options.

First, identify what is actually being asked for

Separate three categories, because they are governed differently:

1. General customer identification information held by the bank.
2. Transaction records relating to the correspondent account.
3. Information about a suspicious activity report - whether one was filed, or its contents.

Handling

• Category 3 is the bright line. Report confidentiality rules in most regimes prohibit disclosing the existence or content of a report to a foreign authority, and typically to anyone outside a narrow circle. Decline this part, in writing, without confirming whether anything exists.
• Categories 1 and 2 should go through counsel and the framework's permitted channels. Ordinarily the bank should notify the respondent bank and seek its consent, or require the request to be routed through the supervisory channel, a mutual legal assistance treaty, or a subpoena. A foreign supervisor's letter is not by itself a legal compulsion on a domestic institution.
• Check the home-regime rules on responding to foreign requests, including any requirement to notify the domestic regulator before producing records.
• Document the request and the response in the relationship file, and treat the request itself as a risk signal about the respondent's client base - it should feed into the next risk rating.

Common error to avoid: treating the fee dependency, or a desire to appear cooperative internationally, as a reason to answer informally. Informal disclosure of protected information is a violation even where the underlying request is legitimate.