Reality Checks in Correspondent Banking: A Decade of Lessons Learned

“U.S. banks, through the correspondent accounts they provide to foreign banks, have become conduits for dirty money flowing into the American financial system and have, as a result, facilitated illicit enterprises, including drug trafficking and financial fraud.” Think this quote is from a recent headline or Congressional hearing? It’s not – rather, it is the introductory sentence from a February 5, 2001, report on the role of correspondent banking in money laundering.1

Correspondent banking plays a vital role in international trade and finance. Through correspondent banking relationships, correspondent financial institutions provide a wide range of services to respondent financial institutions, including clearing, cash and treasury management, investment, custody, foreign exchange, and lending services.

Notwithstanding recent examples of poor controls over correspondent bank activities and sanction violations conducted through correspondent accounts, much has been done over the last decade by governments, regulators and the financial services industry itself to address the risks of correspondent banking. The aforementioned 2001 report stated that correspondent banking is vulnerable to money laundering for a host of reasons, including:

• A culture of lax due diligence • The role of correspondent bankers or relationship managers • Nested correspondent relationships2

• Foreign jurisdictions with weak banking or accounting standards

• U.S. legal barriers to seizing illicit funds in correspondent accounts3

While the focus of the 2001 report was on correspondent banking in the United States, there likely would have been little disagreement at the time that many of these same risks applied to correspondent banking activities in any major financial market.

Since the 2001 report was issued, a multitude of guidance has been issued on managing the money laundering and sanctions risks of correspondent banking. Some, such as “The Wolfsberg Anti-Money Laundering Principles for Correspondent Banking”4 and the Clearing

Protiviti | 2

House “Guidelines for Counter Money Laundering Policies and Procedures in Correspondent Banking,”5 were developed by the industry itself. Others, including the Financial Action Task Force’s updated “Recommendations,”6 the Basel Committee on Banking Supervision’s “Customer due diligence for banks,”7 and the International Finance Corporation’s “Correspondent Account KYC Toolkit,”8 are the products of multinational bodies. Still more guidance has been issued directly by regulators in, for example, the Federal Financial Institutions Examination Council’s “BSA/AML Examination Manual”9 and the Financial Services Authority’s “Banks’ management of high money-laundering risk situations.”10

As a result of all of these initiatives, many banks have made changes in their onboarding procedures for correspondent bank relationships and their ongoing due diligence and monitoring of these accounts, and have exited relationships deemed to pose undue risk. The reality remains, however, that certain correspondent banking activities are, by their very nature, of high risk for money laundering and terrorist financing. Recent events should serve as a reminder for financial institutions providing correspondent activities to review their own practices to ensure their risks are being managed appropriately.

Finally, some of the risks noted above have been explicitly addressed in legislation, including the USA PATRIOT Act, which established expectations for enhanced due diligence for foreign correspondent banking relationships and authorized the forfeiture of funds in U.S. correspondent bank accounts in instances where criminal proceeds have been deposited into an account at a foreign bank with a U.S. correspondent account.

Much of the attention on correspondent banking today and in the past focuses on correspondent clearing activities, i.e., the use of an institution’s correspondent services to clear transactions on behalf of a customer’s own client base. Clearing institutions may include banks, broker-dealers, mutual funds, unit trusts, investment services firms, hedge funds, introducing brokers, money services businesses, pension funds, credit card providers, commercial credit companies, consumer finance companies, mortgage banks, building societies and leasing companies.11 However, the USA PATRIOT Act defines correspondent banking much more expansively as “any account established for a foreign financial institution to receive deposits from, or to make payments or other disbursements on behalf of, the foreign financial institution, or to handle other financial transactions related to such foreign financial institution.”12 That includes everything from foreign exchange transactions to loan participations to clearing activities and more. The risks posed to a financial institution from these different types of activities can vary significantly. On one end of the spectrum, two world-class financial institutions from countries with strong anti-money laundering (AML) regimes may enter into a bilateral agreement to conduct a foreign exchange transaction, which generally would be deemed to be of low risk to money laundering and terrorist financing. On the other end of the spectrum, one of these same banks may provide correspondent clearing activities to a bank domiciled in a jurisdiction with a weaker AML regime or even to another world-class bank domiciled in a strong AML regime but with a global footprint that encompasses jurisdictions with weak or developing AML frameworks; these arrangements suggest a much higher inherent risk to money laundering and terrorist financing. Needless to say, risk mitigation procedures should be tailored to the risks.

Protiviti | 3

The following summarize some of the lessons learned and leading practices developed over the last decade for managing correspondent risk:

• Customer acceptance: Beyond basic organizational information and creditworthiness, the extent of due diligence required should be based on consideration of the risk of the product being offered, the jurisdictions in which the correspondent banking customer is domiciled and does business, and the strength of the AML and overall regulatory regimes in these jurisdictions; the correspondent bank’s ownership and management structure; the correspondent bank’s own AML compliance program and its history of regulatory compliance; and, in the case of clearing services, the potential correspondent customer’s own business and client base. In certain jurisdictions, such as the United States, initial due diligence also requires certification by the potential correspondent that it does not provide services to shell banks.

During the initial due diligence process, the correspondent financial institution should also set expectations for ongoing information needs, such as timeliness and completeness of responses related to transaction activity of the respondent and, as applicable, the respondent’s underlying customers. The correspondent should also understand potential obstacles to the free flow of information, such as local privacy laws, and the options that may be available to overcome these obstacles.

Potential red flags might include presence in jurisdictions that are deemed to be of high risk to money laundering, or are subject to sanctions or to secrecy laws that may impede the flow of information; privately held institutions or government-owned institutions with significant involvement of Politically Exposed Persons (PEPs); institutions chartered from a country with a weak system of banking supervision and oversight; or the existence of a downstream correspondent banking business or offering of payable through accounts by the potential customer.

Evaluation of the information collected during customer onboarding should result in the assignment of a risk rating. Due diligence procedures and risk ratings should be applied to affiliated and non-affiliated correspondent banks equally. Affiliated correspondent banks should not receive a pass on the assumption that they are subject to the same AML program as the office offering the service, particularly in the instance of clearing activities where the nature of business, client base, and AML and regulatory environment can differ significantly from market to market. On the contrary, regulators will likely expect even more rigorous due diligence for an affiliated account, if for no other reason than access to information should be easier.

• Account monitoring: Monitoring activities should be aligned with the risks. Bilateral transactions, similar to transactions for other corporate customers, might be subject to routine transaction monitoring and surveillance by a financial intelligence unit or department responsible for scanning for negative news. Clearing activities, however, require additional monitoring, including, for example, trend analysis of the volume of activity flowing through the account, evaluation of the underlying customers (e.g., who are the largest underlying customers and what is the nature of their activities?), and identification of nesting.

Protiviti | 4

For clearing activities, red flags might include unexplained changes in activity levels or the significance of underlying customers, high levels of PEP activity of unclear purpose, or detection of nesting activities for high-risk institutions and/or for an institution with which the offering financial institution has previously terminated its relationship.

Some correspondent banking activities require additional manual monitoring. These would include, but would not be limited to, pouch or remote deposit capture (RDC) activities, bulk shipments of currency, international funds transfers, and trade transactions. For example, manual reviews of pouch activities should be able to detect unusual or suspicious activity in monetary instruments, such as money orders, travelers’ checks and bank checks. Such activity might include round denomination instruments, sequentially numbered instruments, missing information on the payee or purchaser, or altered documents. Bulk currency shipments should be evaluated for reasonableness (is the volume of currency received in line with the business of the shipping financial institution?) or other indicia of currency smuggling, such as an increase in the sale of large denominated bills to a foreign financial institution or the exchange of small notes for large denominations. Funds transfer and trade-related documentation should be examined not just for potential risks to money laundering and terrorist financing, but also for potential sanctions risk that may not be evident through routine screening. Red flags for funds transfers may include omission of relevant information (inadvertent or willful) and resubmission of previously rejected transfers. For trade transactions, potential risk indicators could include information that may not be subject to routine screening (e.g., a vessel name identified only in hard copy documentation) or changes to trade documentation after the initial screening.

The offering financial institution’s procedures should address how detection of multiple or ongoing circumstances of unusual or suspicious activity and filing of suspicious activity reports will affect whether it continues to provide services to the correspondent bank. This can be a particularly thorny issue in the case of affiliated offices. Procedures should also address how the offering bank will address instances where a correspondent bank is unwilling or unable to provide satisfactory information to respond to its inquiries and/or asserts that privacy laws preclude it from providing information. Additionally, with respect to correspondent accounts maintained in the United States, respondent banks must satisfy themselves that correspondents are prepared to deal with the 120-hour document provision rule in the USA PATRIOT Act in the event of law enforcement inquiry.

• Ongoing due diligence: Periodic updating of customer files should occur on a risk-based schedule. Updating may take the form of a questionnaire inquiring about any changes in the respondent’s business that might impact its profile or might include requests for current copies of the respondent’s AML policy and program and, in some instances, copies of independent reviews of the respondent’s AML compliance program. For affiliated respondents, the correspondent may request confirmation by the internal audit department that the affiliate has been subject to an AML audit and no significant issues were disclosed.

Protiviti | 5

Updating of due diligence files should be accelerated when questions about transaction activity are not answered satisfactorily or significant organizational, ownership or managerial changes occur at the correspondent bank.

• The role of compliance versus the business: Governance plays a strong role in determining the effectiveness of any AML compliance program. An effective correspondent banking compliance program (indeed, every AML compliance program) should provide for sufficient authority of the compliance function to mandate adherence to prudent AML and sanction standards, including Know Your Customer and monitoring standards, and not allow a business line to shape or modify compliance programs to protect revenue streams and profits. And, while the ultimate decision to retain a correspondent relationship may still rest with the business, the compliance department’s objections to or warnings about a correspondent banking relationship should be escalated to a higher authority that should objectively consider whether assuming the risks is acceptable.

Despite the abundant guidance that has been issued on addressing and managing the many money laundering and sanctions risks in correspondent banking, many of the vulnerabilities noted in the 2001 report remain as relevant as ever. High-profile enforcement actions and large penalties assessed over the 11 years since the report was issued demonstrate the need for AML compliance programs to maintain a proactive focus on correspondent banking and demand adherence to policies and controls.

1 “Correspondent Banking: A Gateway for Money Laundering.” Report prepared by the Minority Staff of the Permanent Subcommittee on Investigations of the Committee on Governmental Affairs of the United States Senate, available at www.gpo.gov/fdsys/pkg/CPRT-107SPRT69919/pdf/CPRT-107SPRT69919.pdf. 2A nested relationship occurs when a foreign financial institution gains access to the U.S. financial system by operating through a U.S. correspondent account belonging to another foreign financial institution. 3 Ibid. 4 The Wolfsberg Group “Wolfsberg Anti-Money Laundering Principles for Correspondent Banking,” available at http://www.wolfsberg-principles.com/corresp-banking.html. 5 The Clearinghouse “Guidelines for Counter Money Laundering Policies and Procedures in Correspondent Banking,” available at http://www.theclearinghouse.org/docs/000592.pdf. 6 Financial Action Task Force “International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation,” available at http://www.fatf-gafi.org/topics/fatfrecommendations/documents/fatfrecommendations2012.html. 7 Basel Committee on Bank Supervision “Customer due diligence for banks,” available at http://www.bis.org/publ/bcbs85.pdf. 8 International Finance Corporation “Correspondent Account KYC Toolkit,” available at http://www.ifc.org/ifcext/gfm.nsf/AttachmentsByTitle/TF+-+BPM3+-+Correspondent+Account+KYC+Toolkit/$FILE/CORRESPONDENT+ACCOUNT+KYC+TOOLKIT.pdf. 9 Federal Financial Institutions Examination Council “BSA/AML Examination Manual,” available at http://www.ffiec.gov/bsa_aml_infobase/documents/BSA_AML_Man_2010.pdf. 10 Financial Services Authority “Banks’ management of high money-laundering risk situations,” available at http://www.fsa.gov.uk/pubs/other/aml_final_report.pdf. 11 The Wolfsberg Group “Wolfsberg Anti-Money Laundering Principles for Correspondent Banking” Section 2. 12 USA PATRIOT Act, Title III, Section 311(e)(1)(B).

© 2012 Protiviti Inc. An Equal Opportunity Employer. Protiviti is not licensed or registered as a public accounting firm and does not issue opinions on financial statements or offer attestation services.

About Protiviti Protiviti (www.protiviti.com) is a global consulting firm that helps companies solve problems in finance, technology, operations, governance, risk and internal audit. Through our network of more than 70 offices in over 20 countries, we have served more than 35 percent of FORTUNE® 1000 and Global 500 companies. We also work with smaller, growing companies, including those looking to go public, as well as with government agencies.

Protiviti is a wholly owned subsidiary of Robert Half International Inc. (NYSE: RHI). Founded in 1948, Robert Half International is a member of the S&P 500 index.

About Our AML Compliance Services Protiviti has a dedicated team of AML and compliance professionals who understand both the AML rules and the mortgage loan origination business. We help financial institutions of all types with AML and mortgage origination risk assessments, AML program design, fraud program design, suspicious activity monitoring process development, independent testing, and enforcement action remediation.

Contacts Carol Beaumier John Atkinson +1.212.603.8337 +1.404.926.4347 carol.beaumier@protiviti.com john.atkinson@protiviti.com