Correspondent banking and wire chains

Every cross-border payment that is not settled through a shared central bank ledger must travel through at least one correspondent relationship. A bank in Lusaka that wants to pay a supplier in Guangzhou in US dollars almost certainly holds no direct account relationship with a Chinese bank; instead it holds a nostro account — "our account, with you" — at a larger dollar-clearing bank, typically in New York or London, and that clearing bank in turn holds a vostro account, "your account, with us"; on its own books in the Zambian bank's name. The terminology is simply two names for the same relationship viewed from each side of the ledger. I tell officials to draw the ledger on both sides before they read a single wire instruction, because almost every layering trick in this space exploits the fact that only one side of that ledger is visible to any single investigator.

The correspondent banking system was built for a world of a few hundred money-centre banks settling for thousands of smaller respondents. It was never designed to be transparent to a third party sitting outside both institutions. A standard MT103 message, the SWIFT format that has carried the overwhelming majority of the world's cross-border payment instructions for four decades — carries fields for the ordering customer, the ordering institution, intermediary institutions, the beneficiary institution and the beneficiary customer. In a simple two-bank correspondent chain, all of that data survives the journey. The problem is what happens in a nested chain: Bank A (Zambia) does not hold its own nostro at Bank C (the ultimate dollar clearer) but rather holds its account at Bank B, a regional correspondent, who in turn holds its own nostro at Bank C. When Bank B forwards the payment onward to Bank C, it is common — and until recently, entirely permitted, for Bank B to present itself as the ordering institution on the message that reaches Bank C, effectively stripping the underlying originator (Bank A's customer) from the compliance view of the ultimate dollar clearer. This is "nestingNestingA downstream respondent bank routes payments through an intermediate correspondent that presents itself as the ordering institution, hiding the true originating bank from the ultimate clearer.," and it is one of the most persistent layering vulnerabilities in the correspondent system, because it converts a four-party chain into what looks, from Bank C's perspective, like a two-party one.

Deliberate wire strippingWire strippingThe deliberate deletion or truncation of originator/beneficiary data from a payment message to defeat sanctions or AML screening. is the aggravated cousin of nestingNestingA downstream respondent bank routes payments through an intermediate correspondent that presents itself as the ordering institution, hiding the true originating bank from the ultimate clearer.. Here a compliance officer, or more often an automated sanctions-screening override, physically deletes or truncates originator or beneficiary information from a payment message before forwarding it, specifically to defeat an OFAC or EU sanctions filter or to avoid a "high-risk jurisdiction" flag at the next hop. US enforcement actions throughout the 2010s against major European banks (BNP Paribas's 2014 settlement remains the largest, at roughly USD 8.9 billion, arising from systematic stripping of Sudanese, Iranian and Cuban payment references) established that wire strippingWire strippingThe deliberate deletion or truncation of originator/beneficiary data from a payment message to defeat sanctions or AML screening. is treated by US regulators as wilful sanctions evasion, not a mere data-quality lapse, precisely because the deletion requires an affirmative act.

The global standard-setter's response has been the FATF's Recommendation 16 on payment transparency, most recently revised in February 2025. The 2025 revision tightens the required originator and beneficiary data set for wire transfers, extends explicit coverage to virtual-asset transfers alongside traditional wires (aligning R.16 more closely with the Recommendation 15 travel rule you will study in the next module), and clarifies the obligations of intermediary institutions in a payment chain; precisely targeting the nestingNestingA downstream respondent bank routes payments through an intermediate correspondent that presents itself as the ordering institution, hiding the true originating bank from the ultimate clearer. problem described above by requiring intermediaries to pass on the full required data set rather than substituting their own institutional details. The European Union's parallel instrument, the recast Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets (the "Transfer of Funds Regulation," or TFR), came into force in December 2024 and extended the EU's pre-existing wire-transparency rules to crypto-asset transfers of any value, with no minimum threshold, a materially stricter approach than several other G20 jurisdictions have adopted for virtual assets.

The technical migration underway across this period compounds the compliance picture. The global SWIFT community's shift from the older MT message standard to the ISO 20022 structured "pacs.008" message format (for customer credit transfers) reached its coexistence-period cutover in November 2025, after several delays from the originally planned 2023 timetable. ISO 20022 messages carry structured, tagged data fields — separate elements for street, town, country, and a distinct "ultimate debtor/creditor" concept that MT format handled only informally through free-text lines. For an investigator this is consequential: pacs.008 data is materially easier to parse programmatically for beneficial-ownership and geographic red flags than legacy MT freetext, but the migration has also produced a multi-year period in which African correspondent banks — many still running MT-only core systems, must interoperate via translation gateways with European and US counterparts now issuing native ISO 20022 messages, creating truncation and mapping errors that create their own false-negative risk in screening.

The most consequential development for developing-country practitioners, however, is not a rule at all; it is a market structure change: de-riskingDe-riskingWholesale withdrawal of correspondent banking relationships from a region or client category to avoid compliance cost, rather than managing individual client risk.. Following the post-2008 tightening of US and EU AML enforcement and sanctions exposure, global money-centre banks progressively withdrew correspondent relationships from entire regions and business lines judged to carry a poor risk-adjusted return, rather than manage the compliance cost of individual high-risk clients. The IMF and World Bank have both documented, in successive surveys since 2015, a measurable decline in the number of active correspondent relationships serving Sub-Saharan Africa, the Pacific and parts of the Caribbean, concentrated disproportionately in relationships supporting money-service businesses and smaller domestic banks. The perverse effect, which I have seen directly in casework across ESAAMLG member states, is that de-riskingDe-riskingWholesale withdrawal of correspondent banking relationships from a region or client category to avoid compliance cost, rather than managing individual client risk. pushes exactly the flows regulators most want visible, remittances, small-bank trade finance, humanitarian payments — into informal or under-regulated channels precisely because the formal, transparent channel became commercially unviable for the remaining correspondent to service. A single remaining correspondent for an entire national banking sector also creates a systemic chokepoint: the loss of Zambia's or Somalia's last dollar-clearing relationship is not merely inconvenient, it can sever a country's access to the global financial system in a matter of weeks. FATF and the Basel Committee have both issued guidance urging correspondents to conduct proportionate, risk-based due diligence rather than wholesale regional exit, but the incentive structure — heavy penalties for compliance failure, negligible penalty for lost revenue from an unprofitable region, has proven resistant to guidance alone.

For the working investigator, the practical takeaway is to always ask, on any cross-border wire under review, three sequencing questions: how many correspondent hops actually separate the originator's bank from the beneficiary's bank; whether the message format in use (MT free-text versus ISO 20022 structured) is likely to have preserved or truncated originator data at each hop, and whether any hop in the chain is a known nestingNestingA downstream respondent bank routes payments through an intermediate correspondent that presents itself as the ordering institution, hiding the true originating bank from the ultimate clearer. relationship, discoverable through SWIFT BIC-to-BIC correspondent mapping data or through the bank's own nostro/vostro accountNostro/vostro accountThe same correspondent account viewed from each bank's own books; 'our account with you' versus 'your account with us'. register, which every licensed bank is required to maintain and which is discoverable by subpoena or, in several jurisdictions, by direct FIU access.

Once you understand the correspondent architecture, the next skill is reading the payment messages themselves as evidence. A SWIFT message is not just an instruction; it is a contemporaneous business record generated by the sending institution's own systems, timestamped, authenticated, and — crucially for evidentiary purposes — logged both by the sender and by SWIFT's own network operator. That dual logging is what makes payment message forensics so powerful in layering investigations: even where a domestic bank's own records have been altered or destroyed, SWIFT's network-level logs, obtainable through mutual legal assistance requests to Belgium (where SWIFT is domiciled) or through the correspondent bank's own retained copy, frequently survive.

Field 50 (ordering customer) and field 59 (beneficiary customer) are the fields investigators reach for first, but the field that most often breaks a layering chain is field 56 or 57 (intermediary institution) combined with field 72 (sender-to-receiver information), a free-text field that compliance officers use to record additional context that does not fit the structured fields, and which launderers' bankers sometimes use, carelessly, to reference the true underlying transaction ("re: consultancy invoice 4471, per instructions of Mr X") in a way that structured fields alone would have concealed. I have had cases turn entirely on a field 72 note that a compliance analyst forgot existed, because they were trained to read only the structured originator and beneficiary blocks.

A second forensic technique is chain reconstruction through value-date and amount matching. Where a payment has been broken into tranches to defeat a single large-value alert, or has passed through several intermediary banks each of which nets or aggregates flows before onward transmission, the individual messages will rarely match penny-for-penny because of correspondent fees deducted at each hop (the "OUR/SHA/BEN" charge-allocation codes in field 71A determine whether the sender, the receiver or both absorb intermediary fees). An investigator reconstructing a chain must therefore work with a tolerance band, typically matching value dates within one to three business days and amounts within the plausible fee range for the corridor, rather than expecting exact figures. This is one of the more technical and underappreciated skills in the discipline, and it is exactly the kind of work that a well-resourced FIU's financial-forensics unit should be doing routinely rather than leaving to ad hoc effort on individual cases.

Straight-through processing (STP); the automated routing of payment messages without manual review, is both the industry's efficiency triumph and its greatest vulnerability. An STP-eligible payment passes through sanctions and AML screening filters keyed to specific structured fields; if those fields are populated correctly but the substance is false (a shell company correctly identified as originator, but whose beneficial owner is undisclosed), the filter will not catch it, because filters screen names and jurisdictions against watchlists, not beneficial ownership. This is why R.16 compliance and beneficial-ownership transparency (FATF R.24/R.25, discussed in your Foundations module) are complementary rather than substitute controls: R.16 ensures the right names travel with the payment; R.24/25 ensures those names are not themselves fronts.

Correspondent banks additionally maintain "Know Your Customer's Customer" (KYCCKYCCKnow Your Customer's Customer, a correspondent's due diligence on a respondent bank's own downstream customer base.) expectations for certain categories of respondent — particularly for respondents that themselves offer downstream correspondent services to third-tier banks (the classic multi-tier nesting scenario). Basel Committee guidance and FATF's 2016 correspondent banking guidance both recommend that correspondents obtain sufficient information to understand a respondent's own customer base and AML controls, though in practice enforcement of KYCCKYCCKnow Your Customer's Customer, a correspondent's due diligence on a respondent bank's own downstream customer base. obligations has been uneven and is a recurring finding in FATF mutual evaluations of African and Caribbean jurisdictions, where correspondents frequently accept boilerplate AML-policy attestations without independent verification.

When you sit down with a suspicious wire file in casework, I recommend a disciplined five-step read: first, map every BIC code in the message to an institution and jurisdiction; second, identify the charge-allocation code and use it to anticipate fee-driven amount variance in the next hop; third, read field 72 in full, not as an afterthought; fourth, cross-reference the beneficiary account number against any available beneficial-ownership registry or leaked-document database for the beneficiary entity, and fifth, request the SWIFT network log (via MLA or via the reporting bank's compliance function) rather than relying solely on the domestic bank's forwarded copy, because domestic copies can be selectively incomplete even without malicious intent, simply through poor archival practice.

The reforms of 2023–2025 — the TFR's crypto extension, the R.16 revision, and the ISO 20022 migration, collectively push the system toward a future in which structured, machine-readable data makes this forensic work faster and more automatable. But structured data is only as good as the obligation to populate it truthfully, and every structural reform to date has been met, within a matter of months, by a corresponding adaptation in layering technique. The realistic expectation for a working official is therefore not that these reforms solve the nesting and stripping problem, but that they raise the cost and narrow the window in which such techniques go undetected — which is itself the correct standard against which to judge AML reform.

The final lesson in this module turns from mechanics to consequence. Correspondent de-risking is not an abstract policy debate for African tax and financial-intelligence officials; it is a lived operational constraint that shapes what evidence exists, what channels are formal versus informal, and what enforcement options remain available. Understanding it is essential to calibrating realistic expectations of what layering investigations can achieve in a thin-correspondent environment.

The mechanism is straightforward from the correspondent bank's perspective. A global systemically important bank weighs the revenue from servicing a smaller regional bank's correspondent needs against the compliance cost of maintaining adequate AML oversight of that relationship, including the litigation and regulatory-penalty tail risk if the relationship is later found to have carried illicit flows. Where the revenue is thin — as it typically is for smaller markets with modest trade volumes — and the compliance cost is largely fixed regardless of client size, the arithmetic favours exit. The World Bank's periodic correspondent banking surveys since 2015, and successive IMF staff notes, have documented sustained net declines in active correspondent relationships across Sub-Saharan Africa, the Pacific Islands and several Caribbean states, with money-service businesses and smaller domestic banks disproportionately affected relative to larger regional banks that can absorb compliance cost at scale.

The consequence I have seen most starkly in ESAAMLG-region casework is displacement rather than elimination of flow. When a formal remittance corridor loses its last correspondent, the underlying demand for cross-border value transfer does not disappear; it migrates to informal value-transfer systems, hawala-style networks, informal money-service operators, or physical cash-courier networks — that leave dramatically less audit trail than even an imperfect formal corridor did. This is the central irony of de-risking as a regulatory outcome: a policy environment designed to reduce money-laundering risk in the formal sector has, in measurable instances, pushed volume into channels that are far harder for any FIU, anywhere, to monitor. South Africa's own experience during its 2023–2025 FATF greylisting period is instructive here, though for a related but distinct reason, greylisting itself, independent of any specific correspondent decision, increases the compliance cost that foreign correspondents attach to South African counterparties, creating a feedback loop in which the very designation intended to improve AML performance temporarily raises the cost of formal-channel compliance. South Africa's subsequent delisting in 2025, following its action-plan completion, offers a rare data point on how quickly correspondent sentiment can normalise once FATF removes the designation — a useful case for any jurisdiction currently under increased monitoring to study closely.

Beneficial-ownership and payment-transparency reforms interact with de-risking in a way that is not always appreciated by regulators drafting them. Every additional transparency obligation imposed on correspondents — R.16's expanded data fields, the EU TFR's uncapped crypto coverage, enhanced KYCC expectations, raises, at the margin, the compliance cost of maintaining a given relationship, and therefore raises, at the margin, the probability of exit for the least profitable relationships. This does not mean transparency reform is wrong; the alternative of opaque, high-risk corridors is worse. But it does mean that transparency reform without complementary capacity-building support for smaller respondent banks in developing markets can produce a net reduction in financial inclusion even as it improves the traceability of the flows that remain formal. FATF, the World Bank and regional bodies including the Alliance for Financial Inclusion have all published guidance urging correspondents toward proportionate due diligence rather than wholesale exit, and urging home-country regulators not to penalise correspondents for maintaining relationships with well-supervised respondents in higher-risk jurisdictions, but guidance of this kind carries no binding force and has had limited measurable effect on exit rates to date.

For a national FIU or tax administration operating in a thinly-correspondented environment, the practical response has three legs. First, invest in bilateral and regional information-sharing arrangements, ESAAMLG's own typology and information-exchange mechanisms, and Egmont GroupEgmont GroupThe global network of financial intelligence units enabling secure information exchange between member FIUs. membership for the FIU — so that where formal correspondent data is unavailable, peer-FIU requests can substitute. Second, build capacity to monitor informal value-transfer systems directly rather than assuming their invisibility is total; hawala networks, contrary to popular belief, do generate records — ledgers, code books, settlement instructions, that are recoverable through search and seizure and through cooperating-broker testimony, and several successful ESAAMLG-region prosecutions have relied on exactly this evidence. Third, engage proactively with remaining correspondents to demonstrate supervisory capacity and reduce perceived compliance risk, since correspondent retention decisions are ultimately judgments about the quality of the respondent's own AML supervision, and a national regulator that can evidence robust supervision materially improves the odds of relationship retention.

The broader lesson for this module is that layering is not simply a technique deployed by individual bad actors; it is also, in part, an emergent property of how the global financial architecture allocates transparency and cost. A regulator who understands both the payment-message mechanics of Lessons 1 and 2 and the market-structure dynamics of this lesson is equipped to do something more valuable than simply detecting individual layering schemes; they are equipped to argue, credibly and with evidence, for the calibration of global standards in a way that preserves formal-channel visibility for developing economies rather than inadvertently degrading it.