A correspondent account gives a bank or a fintech access to another country's currency and payment system. The correspondent answers to its own regulator for that access, and so it examines the respondent as closely as the respondent examines its own customers. For a payment institution, EMI or VASP that itself serves other providers, the outcome of that examination decides whether the product has a dollar or euro route at all.
The concept
An international payment looks like a transaction between a sender and a recipient. The banking infrastructure behind it is almost always more complicated: the sender's bank may have no account in the required currency, no direct access to the local payment system and no presence in the recipient's country. It therefore places liquidity with another bank and instructs that bank to settle.
That is correspondent banking: in the CPMI definition, one bank holds deposits owned by other banks and provides payment and other services to them. One bank keeps the customer relationship; the other supplies presence in the currency and the payment system. The customer rarely chooses the correspondent and usually learns of it only when a payment is delayed, arrives short of a fee or triggers a request for documents.
Before opening the account, the correspondent examines the respondent itself: its owners, its customer base, its controls and the institutions it serves in turn. The standard for that examination is set by FATF Recommendation 13, the Wolfsberg questionnaires and national law. Data on the payer and the payee travel down the chain with the money, and their completeness decides whether the payment goes through.
The legal status of a customer balance is a separate question. The payment route governs how a transfer is executed; deposit guarantees, safeguarding and trusts govern what the customer recovers if an operator or a bank stops working. Those regimes are compared jurisdiction by jurisdiction in the client asset protection map.
| Parameter | Value |
|---|---|
| Correspondent banking | a bank holds deposits of other banks and provides payment services to them |
| Roles | the respondent serves the customer; the correspondent supplies presence in the currency and payment system |
| SWIFT | transmits messages; not a payment or settlement system |
| Final settlement | across bank accounts: Fedwire or CHIPS in dollars, T2 in euro, CHAPS in sterling |
| Respondent due diligence | FATF R.13; in the EU from 10 July 2027, Articles 36–39 AMLR |
| Payment data | FATF R.16; in the EU, Regulation (EU) 2023/1113 |
How a bank obtains access to another institution's infrastructure
A banking licence does not make a bank a participant in every settlement system. Dollars require dollar liquidity and access to US infrastructure; sterling requires access to UK settlement; euro requires participation in T2 or the SEPA schemes; renminbi runs through a separate network of banks and clearing institutions. International banking is therefore a network of bilateral relationships.
The bank serving the end customer is the respondent; the bank that holds its money and settles for it is the correspondent. The ECB defines a nostro as a foreign-currency account held by a domestic bank with a foreign bank, and a vostro as a domestic-currency account held by foreign banks with a domestic bank. It is one obligation seen from two sides.
| Function | What the correspondent provides | How it shows in the product |
|---|---|---|
| Liquidity | An operating balance in the required currency | A bank or fintech supports USD, EUR or GBP without a presence in the currency's country |
| Settlement access | Connection to a local or international payment system | ACH, wires, SEPA and CHAPS in one interface |
| Banking perimeter | Compliance, sanctions control, payment operations | Cross-border business without a bank of its own in every jurisdiction |
Much of fintech is built on this arrangement. One interface combines local account details, international transfers, foreign exchange and cards, while different banks, issuers and payment institutions deliver the individual functions. A "global account" is usually assembled from several regulated perimeters and several legal entities.
How one international payment moves
A dollar payment from an account held with a fintech looks like a single operation in the app. Up to five roles take part in executing it.
| Step | Participant | What it does | What obligation arises |
|---|---|---|---|
| 1 | The customer's fintech, EMI or bank | Accepts the instruction, checks the customer, reduces the available balance | Liable to the customer under the account, e-money or payment-services contract |
| 2 | Respondent bank | Builds the payment instruction and chooses the route | Disposes of its own balance on the nostro account |
| 3 | Correspondent bank | Debits the nostro, runs compliance checks, passes settlement on | Executes the respondent's instruction within the correspondent account agreement |
| 4 | Settlement system | Moves money between banks with finality | Finality under the rules of Fedwire, CHIPS, T2 or CHAPS |
| 5 | Beneficiary's bank | Receives the funds and credits the payee | Owes the amount to its customer once credited |
SWIFT carries the messages in this chain and is not a payment or settlement system. The money moves across bank accounts: every direct Fedwire participant holds a master account at a Reserve Bank; in CHIPS a payment, once released and settled, is final and irrevocable; in T2 payments settle one by one, continuously, in central bank money with immediate finality. When the end customer's account is credited is a separate question.
Where the sender's bank has no direct relationship with the beneficiary's bank, an intermediary correspondent joins the chain, sometimes more than one. Each bank sees only part of the transaction, applies its own sanctions and AML filters and may deduct a fee. A transfer between the same two parties can therefore take different routes depending on currency, timing, the available intermediary and current risk appetite. The customer's own institution remains liable to the customer under the contract and the applicable payments law; an extra intermediary does not shift the customer's claim onto another bank in the chain.
Why payments are delayed or arrive short
Delays usually come from incomplete or unstructured payment details, a mismatch between the message and the supporting documents, a sanctions nexus, a shortfall of liquidity on the nostro, a local cut-off time or a manual query from a bank. Charges are allocated by field 71A of an MT message; ISO 20022 uses ChargeBearer codes for the same purpose.
| MT 71A / ISO 20022 | What the code means |
|---|---|
| OUR / DEBT | The payer is responsible for all fees associated with the payment |
| SHA / SHAR | Charges are shared: the payer pays its own bank, the payee pays its own |
| BEN / CRED | The payee bears all fees; every bank in the chain may deduct its own from the amount |
The meanings follow the Federal Reserve's guidance; ISO 20022 also has SLEV, charges under a service-level agreement. Charges taken by preceding banks are deducted from the amount and reported in field 71F. The DEBT code allocates responsibility for charges and does not by itself guarantee that the full amount arrives.
Where the chain bypasses the correspondent
Correspondent links fall away where non-banks obtain direct access to settlement. In the EU, since 6 October 2025 payment institutions and EMIs may request access to TARGET, and a central bank may refuse only where the applicable requirements are not met. Such an account is for settlement: the Eurosystem is prohibited from providing safeguarding accounts to non-bank PSPs. CHAPS has more than 35 direct participants, while thousands of institutions reach it indirectly through them — a model the Bank of England itself calls agency or correspondent banking. In the United States the line runs along the master account, covered in the article on Federal Reserve payment accounts. Wholesale DLT settlement and stablecoins remove individual steps, yet each such infrastructure again has a settlement asset, admission rules, compliance and an insolvency procedure.
What "account" means in a fintech product
A platform can issue dollar, euro or sterling account details without participating in Fedwire, SEPA or CHAPS: partner banks provide the access. The details may be issued in the customer's name, lead to a separate sub-account or merely route the payment into a pooled omnibus account. The EBA found in 2024 that there is no common definition of a virtual IBAN and that structures and uses differ. The same number in an app can represent claims of different kinds.
| What the customer sees | What may sit underneath | Main consequence |
|---|---|---|
| Bank account | The customer's deposit on a licensed bank's balance sheet | The customer is the bank's creditor; the bank itself is a participant in, or a customer of, the correspondent chain |
| EMI or payment institution account | E-money or a payment claim against the operator | The customer does not become a depositor of the bank where the operator holds funds; protection follows the map |
| Virtual IBAN or named account | A router to a separate or shared underlying account | The name on the details does not answer who holds the underlying account |
| Omnibus / FBO | A provider's pooled account for many customers | The bank sees the provider as account holder; end customers are a nested layer to it |
The quality of such infrastructure turns on a few things: whether it is clear which legal entity is liable to the customer for each function; whether the underlying account, bank and jurisdiction can be identified; how many working routes exist in each currency; and whether local details give real access to the local system. A direct correspondent usually brings predictable timing and fees, but one bank per currency creates concentration.
Who checks what in a correspondent relationship
The Basel Committee states the starting principle: the respondent remains responsible for due diligence on its own customers, while the correspondent conducts due diligence on the respondent as its direct customer. FATF Recommendation 13 adds five duties to normal customer due diligence in cross-border correspondent banking:
- gather enough information about the respondent to understand fully the nature of its business and to determine from public information its reputation and the quality of its supervision;
- assess its AML/CFT controls;
- obtain senior management approval before establishing the relationship;
- clearly understand each institution's responsibilities;
- for payable-through accounts, be satisfied that the respondent has conducted CDD on the customers with direct access to the correspondent's accounts and can provide the data on request.
The same Recommendation prohibits entering into or continuing a relationship with a shell bank and requires the correspondent to satisfy itself that the respondent does not permit its accounts to be used by shell banks. The 2016 FATF guidance adds that simplified measures are never appropriate in cross-border correspondent banking.
What the correspondent is not required to do: KYCC
The same FATF guidance states that the Recommendations do not require institutions to conduct CDD on the customers of their customer. The EBA starts from the same point: a correspondent does not normally have a business relationship with the respondent's customers and will not normally know their identity or the purpose of the underlying transaction unless that information is in the payment instruction. The practice the market calls KYCC (know your customer's customer) is therefore not a legal requirement.
The boundary runs through the request for information, the RFI. When a payment or a flow raises questions, the correspondent asks the respondent about the specific transaction: how long the customer has been served and what the account is for, who the beneficial owner is and where the funds come from, whether the transaction fits the profile, who the counterparties are. FATF stresses that such a request does not amount to a requirement to conduct CDD. A source-of-funds question that reaches a customer "at the request of a partner bank" usually originates in a correspondent's RFI, and the answer is documentary evidence of the source of funds.
Nested relationships and payable-through accounts
A nested relationship (also called a downstream relationship) arises when the respondent itself provides correspondent services to other financial institutions and they route payments through its account with the correspondent. The correspondent sees its respondent in the payment and, at best, the details of the nested institution, but not that institution's customers.
A payable-through account is a more direct form of the same problem: a correspondent account used directly by third parties to transact business on their own behalf. That is why R.13 and Article 36 AMLR require the correspondent to be satisfied that the respondent has checked the customers with direct access, and why the US rule 1010.610 under enhanced due diligence also requires identifying the persons with authority to direct transactions through such an account.
FATF accepts nested relationships where the correspondent is duly informed of them, the relationships are transparent and the correspondent has measures to detect undisclosed nesting. The EBA lists nesting and payable-through accounts among the risk-increasing factors; in its 2022 principles Wolfsberg expects reasonable steps to understand the types of institutions to which the respondent offers downstream services.
Why this is the central question for EMIs, PSPs and VASPs
An EMI that issues virtual IBANs to other payment companies, marketplaces or crypto platforms builds a nested relationship on top of its account with its bank, whatever the contract calls it. The Wolfsberg principles may be extended on a risk-based approach to MSBs, MVTS providers, fintechs and VASPs, and FATF recalls that MVTS providers are financial institutions subject to the full range of preventive measures.
In July 2026 Wolfsberg published its guidance on banking services to non-bank PSPs. For nested arrangements it expects the bank to understand how AML and sanctions functions are divided between the PSP and its partners and how the PSP oversees those partners; where risks cannot be sufficiently mitigated, including because of reduced end-to-end visibility of the chain, the bank should adopt an appropriate risk-control strategy.
For crypto-assets, comparable relationships are already written into law. The EU directive extended the concept of a correspondent relationship to transactions in and transfers of crypto-assets, and Article 19b requires a CASP dealing with a non-EU provider first to determine whether it is licensed or registered; Article 37 AMLR carries that requirement into the regulation. The UK's regulation 34A for cryptoasset exchange providers and custodian wallet providers applies from 1 February 2027.
An acceptable nested model has three features that follow directly from the FATF conditions: the correspondent knows about the nested institutions and has agreed to serve them; those institutions are known by name, licensed and supervised; and the payment message names the end payer even when an aggregator sends it.
The Wolfsberg principles and questionnaires
The industry standardised due diligence through the Wolfsberg Group, an association of large international banks. Its 2022 correspondent banking principles call for a risk appetite approved by the board. The main instrument is the CBDDQ (Correspondent Banking Due Diligence Questionnaire): according to the Wolfsberg resources page, the current version is 1.4 of 2023, alongside the FCCQ at version 1.2. The questionnaires are examined in the article on Wolfsberg questionnaires. A questionnaire does not replace the correspondent's own assessment: the FCA treats exclusive reliance on it as poor practice.
The check repeats. Rule 1010.610 requires periodic review of activity on each correspondent account, and 31 CFR 1010.630 works as a safe harbour: an institution is deemed compliant if it obtains a certification or recertification from the foreign bank at least once every three years.
Correspondent accounts under US, EU, UK and UAE law
All these regimes are built on the R.13 framework; they differ in deadlines, addressees and enforcement tools.
| Jurisdiction | Main rules | Status | What it adds to R.13 |
|---|---|---|---|
| United States | USA PATRIOT Act sections 312, 313, 319(b); 31 CFR 1010.610 and 1010.630 | In force | Records within 120 hours, subpoenas to foreign banks, account closure within 10 business days |
| EU | Directive 2015/849 Articles 19, 19b and 24; AMLR Articles 36–39 | Directive until 10 July 2027, then AMLR | AMLA recommendations on individual third-country respondents |
| United Kingdom | MLR 2017 regulations 34 and 34A | Regulation 34A from 1 February 2027 | A separate regime for cryptoasset businesses; pooled accounts from 30 June 2026 |
| UAE | CBUAE AML/CFT Guidelines, section 6.4.4 | In force | Assessment of downstream services and a written allocation of responsibilities |
The United States: sections 312, 313 and 319(b) of the USA PATRIOT Act
Section 312 (31 USC 5318(i)) requires a due diligence programme for correspondent accounts of foreign financial institutions. Rule 1010.610 fills it in and makes enhanced due diligence mandatory for a foreign bank operating under an offshore licence, a licence from a jurisdiction designated as non-cooperative, or one from a jurisdiction subject to special measures under section 311. Enhanced due diligence covers information on the bank's AML programme, whether it maintains correspondent accounts for other foreign banks, and the owners of 10% or more of a bank whose shares are not publicly traded. Where due diligence cannot be performed, the procedures provide for refusing to open the account, suspending activity, filing a suspicious activity report or closing the account.
Section 313 (31 USC 5318(j)) prohibits a correspondent account for a foreign bank without a physical presence in any country — a place of business at a fixed address, at least one full-time employee and operating records — with an exception for an affiliate of a supervised bank that has such a presence. Section 319(b) (31 USC 5318(k)) gives US authorities direct reach into the chain: records on the account go to the federal banking regulator within 120 hours of a request; the Treasury or the Attorney General may subpoena a foreign bank for records, including records held outside the United States; and after written notice that a foreign bank has failed to comply with a subpoena the correspondent relationship must end within 10 business days.
The EU: from the directive to the AMLR
Until 10 July 2027 Directive 2015/849 applies. Its Article 19 requires the R.13 measures for cross-border relationships with a third-country respondent, and Article 24 prohibits relationships with a shell bank and with an institution known to permit its accounts to be used by shell banks. From 10 July 2027 the same requirements become directly applicable rules of the AMLR: Article 36 addresses credit and financial institutions and requires a decision to terminate a relationship for AML/CFT reasons to be documented, Article 37 addresses CASPs, and Article 39 prohibits relationships with shell institutions. Article 38 creates a new mechanism: AMLA may recommend measures against an individual third-country respondent that is in serious, repeated or systematic breach of AML/CFT requirements. The place of these rules in the package is set out in the article on the EU AML package.
The United Kingdom: regulations 34 and 34A
Regulation 34 of the Money Laundering Regulations 2017 sets out, for relationships with third-country respondents, a set of duties comparable to R.13 and a shell bank prohibition. SI 2026/621, made on 9 June 2026, added regulation 34A — the same requirements for UK cryptoasset exchange providers and custodian wallet providers from 1 February 2027 — and from 30 June 2026 requires a firm opening a new pooled account for a customer to take reasonable measures to understand the account's purpose and how the customer proposes to use it, and to assess the risk. Payment firms' customer and safeguarding accounts are structured exactly this way; the UK segregation regime is covered in the UK regime overview.
The UAE
The Central Bank of the UAE, in its AML/CFT Guidelines, prohibits relationships with shell banks and with institutions that allow their accounts to be used by shell banks, and requires institutions to collect information on the counterparty, evaluate its controls, obtain senior management approval, assess downstream services (nested accounts) and set out each party's responsibilities in an agreement.
How a licensed firm is onboarded by a correspondent or sponsor bank
For a payment institution, EMI or VASP, the correspondent bank is at once an infrastructure supplier and the most demanding outside reviewer. A non-bank respondent is usually younger than a bank, serves riskier flows and often provides accounts to others itself. The model in which a bank issues account details and cards under another brand is covered in the article on sponsor banks and BaaS, and the requirements placed on an operator as a bank customer in the article on banking for MSBs. The 2026 Wolfsberg guidance on non-bank PSPs sets the blocks of the review, and each fails in its own way:
| Block | What the bank checks | Where it usually breaks |
|---|---|---|
| Licence and supervision | Licence, regulator, examination results | Activity wider than the licence; an application presented as an authorisation |
| Owners and management | Ownership chain up to UBOs, qualifications of the MLRO and CCO | Opaque ownership; compliance does not grow with the business |
| Business model and flows | Products, currencies, corridors, volumes | Actual flows diverge from the declared profile |
| Customers and nested relationships | Segments, geography, PSP, VASP and agent customers | Undisclosed downstream customers |
| Monitoring and screening | Automation, real-time screening, free-text fields | Backlogs of alerts and KYC renewals |
| Payment transparency | Completeness of payment data under R.16 | The operator itself appears in the payer field |
| Audit and customer accounts | Independent audit, the audit firm's reputation, safeguarding accounts | Customer and own money not separated |
The onboarding review fixes a profile against which actual flows are later compared; a divergence is a typical trigger for RFIs, restrictions or exit. How these checks fit into a licensed firm's control framework is described in the article on the compliance stack. A licensed firm with a single correspondent per currency lives with the risk of an instant product stop: the correspondent's exit switches off every customer at once.
For the customer at the end of the chain — an individual, a family or a company — the same mechanism appears as questions the provider relays from its partner bank: the purpose of the payment, the contract or invoice, the origin of funds, details of the counterparty. Documents on the source of funds and the company structure prepared in advance shorten the delay; a refusal to answer can end in a returned payment or account closure.
When the correspondent exits: de-risking
A relationship usually ends on the correspondent's commercial decision, sometimes by law: besides the deadline under 31 USC 5318(k), FinCEN's special measure against Huione Group prohibits US institutions from opening or maintaining a correspondent account for it. The CPMI noted that some relationships are maintained or terminated according to the perceived risk of the respondent's jurisdiction, so that such respondents risk being cut off from international payment networks.
De-risking, in the terms of the 2016 FATF guidance, is the termination or restriction of relationships with entire countries or classes of customer "in order to avoid, rather than manage, risks". FATF states that wholesale cutting loose of entire countries and classes of customer without a serious and comprehensive assessment of their risk is not in line with the FATF Standards, and names alternatives to exit: refusing individual transactions, filing suspicious transaction reports, restricting services. That position does not prohibit termination as such. In February 2025 FATF amended Recommendation 1 and the interpretive notes to Recommendations 1, 10 and 15: measures must be proportionate to risk, and simplified measures in lower-risk situations are expressly encouraged.
The US Treasury's 2023 de-risking strategy identified profitability as the primary driver of such decisions and named three groups hit hardest: small and medium-sized MSBs, non-profits operating abroad, and foreign financial institutions with low correspondent volumes. In the EU the AMLR will add, from 10 July 2027, a formal duty to document a decision to terminate a relationship for AML/CFT reasons.
Comparable statistics are no longer published: the CPMI and SWIFT ended the annual quantitative review with the 2022 data. The last CPMI commentary with trend figures recorded a fall of about 22% in the number of active correspondent banks worldwide over 2011–2019 and about 12% in the number of corridors. According to FSB data for the first quarter of 2025, 7.6% of countries and territories had fewer than three institutions sending or receiving a cross-border payment via SWIFT. Resilient currency access therefore depends on having a second working route and on how quickly it can be connected.
Payment transparency: what data travels with the money
The correspondent sees a payment only through its message, so data on the payer and payee are its main control tool. FATF Recommendation 16 requires cross-border transfers to carry payer and payee information and every intermediary to keep it with the payment. The industry benchmark is the Wolfsberg Payment Transparency Standards of 2023.
What the EU requires now
In the EU, R.16 is implemented by Regulation (EU) 2023/1113. What travels with the payment depends on the route:
| Route | What travels with the payment |
|---|---|
| General case | Payer's name, account number, address including country, official document number and customer identification number, or date and place of birth; LEI where the field exists |
| All PSPs in the EU | The payer's and payee's account numbers or a unique transaction identifier suffice |
| Outside the EU up to €1,000 | Names and account numbers of payer and payee |
An intermediary PSP must keep all information received with the transfer, and the payee's PSP must detect missing information and, under risk-based procedures, reject or suspend the transfer or request the missing data.
The revised R.16
On 18 June 2025 FATF adopted the revised R.16; the changes are to take effect by the end of 2030, and in June 2026 FATF put out for consultation implementation guidance, with comments due by 21 August 2026. For cross-border payments above USD/EUR 1,000 the explanatory note sets out this data set:
| Element | Revised R.16 |
|---|---|
| Originator | Name; account or unique transaction reference; address, or country and town; for a natural person, national identity number, customer identification number or date and place of birth; for a legal person, BIC, LEI or another identifier where one exists |
| Beneficiary | Name; account or unique transaction reference; country and town; for a legal person, BIC, LEI or another identifier where one exists |
| Beneficiary check | The beneficiary FI checks alignment of name and account; an exact match is not required |
| Start of the chain | The institution that receives the originator's instruction, regardless of the source of funds |
For payment firms the row on the start of the chain matters most. An EMI or PSP sending a customer's payment from its own omnibus account is responsible for having the real payer in the message; this is where transparent nesting parts company with undisclosed nesting. For crypto-assets the same principle applies through R.15 and the travel rule.
ISO 20022 and the 2026–2028 deadlines
ISO 20022 makes payment data structured: sharper sanctions screening, easier automatic reconciliation, and greater dependence on the quality of the customer's details. Coexistence for cross-border payment instructions ended on 22 November 2025; some MT messages are still converted, but contingency processing has been chargeable since 1 January 2026. After 14 November 2026 SWIFT accepts only fully structured or hybrid postal addresses, with no contingency for the rest, so the payer's address must be held in structured form in the customer file. Statements and reports become mandatory to receive in ISO 20022 from November 2027.
Paying through an intermediary: who holds the money and who may instruct
A separate model sits on top of the payment chain: the customer instructs an intermediary to pay — a platform settling with a seller, a service paying the customer's foreign suppliers, an agent funding a purchase abroad. Legally, one more party appears between the customer and the banking chain.
The right to instruct a payment does not make the money the agent's property and does not answer what happens to the balance while the agent holds it. The second question is whose name appears in the payment. If the agent pays in its own name from an omnibus account it controls, the payee and every bank in the chain see the agent as payer; the end initiator is invisible until the agent passes on its details. If the agent pays as the customer's disclosed representative, the customer is the named payer. That choice decides three things: what the beneficiary's bank checks, whether the purpose of the payment and the source of funds can be established, and where a rejected payment returns.
Commercial agent or regulated payment function
A narrow exclusion exists and is easily lost. Under Article 3(b) PSD2, payment transactions through a commercial agent authorised to negotiate or conclude sales on behalf of only the payer or only the payee fall outside the regime; the UK reproduces the exclusion in Schedule 1 to the Payment Services Regulations 2017. The FCA considers that a business is likely to be acting for both sides if payments go into an account it controls before being sent to the payee while the payer's debt is settled only once the payee receives payment. Such an intermediary provides a payment service. The activity has a name: money remittance under Article 4(22) PSD2 — funds received from a payer, without payment accounts being created in the name of the payer or payee, for the sole purpose of transferring a corresponding amount to a payee.
| Regime | What makes "paying on the customer's behalf" regulated | What that does not give the customer by itself |
|---|---|---|
| EU (PSD2) | Money remittance and execution of payment transactions are payment services | Reliance on the commercial agent exclusion brings no segregation of funds |
| UK (PSRs 2017) | The same services; holding funds until the payee receives them means acting for both sides | An excluded commercial agent holds customer money as an unsecured balance |
| Canada (RPAA) | Holding funds on behalf of an end user and initiating a transfer at its request are payment functions | PSP registration does not make the operator a bank or the balance a deposit |
| Hong Kong (MSO) | Sending or receiving money across the border as a business is a remittance service under an MSO licence | An MSO licence carries no duty to segregate customer funds |
| United States | Accepting money for transmission to another person is money transmission, licensed state by state | Federal money transmitter status under the BSA is an AML regime and protects no balance |
US exemptions mirror the UK position. In Arizona, for example, an agent of a payee collecting payment for goods or services is exempt from licensing only if a written agreement appoints it, the payee holds it out to the public as accepting payments on its behalf, and payment to the agent extinguishes the payer's obligation. One question — when the underlying debt is discharged — gets opposite answers: the UK exclusion is lost if the debt is discharged only when the payee receives the money, whereas the US exemption requires it to be discharged already on payment to the agent. Both follow the payee, so an intermediary hired by the payer to pay its own suppliers falls outside each. European agent and distributor structures are covered in the article on payment agents.
Four outcomes for one instruction
While the agent holds the funds, the customer has only a claim against the agent; the underlying debt to the payee is discharged on credit. Returned funds travel back down the chain to the account they were sent from — the agent's — so the customer's refund depends on the agent.
| Outcome | Where the money is | What the customer can claim, and from whom |
|---|---|---|
| Payment completed | With the payee | Confirmation of payment from the agent against the underlying debt |
| Rejected by the beneficiary's bank | Returned to the agent, less fees deducted en route | Re-credit from the agent under the contract; deducted fees may not come back |
| Held on sanctions | Held by the bank that flagged the payment | Release depends on that bank and the sanctions authority; the agent pursues it for the customer |
| Agent insolvent before execution | In the agent's estate | Recovery from a safeguarded pool if the regime creates one; otherwise an unsecured claim |
What exactly a customer recovers from a pool, and in what order, depends on the licence regime; this is set out in the client asset protection map.
When the payment stops: blocked, rejected, recalled
A payment that fails to arrive stops in one of three ways, and the money sits in a different place in each.
| How it stopped | Where the money is | What moves it |
|---|---|---|
| Blocked on sanctions | With the blocking institution, usually in a blocked interest-bearing account | A licence from the sanctions authority |
| Rejected | Returned to the sending account, less fees already deducted | The sending institution returns funds to its account holder — the agent, if an agent paid |
| Credited, then recalled | With the beneficiary | A recall on limited grounds; the beneficiary's consent may be required |
In the United States the difference between blocking and rejecting is formalised: a person holding blocked property reports it to OFAC within 10 business days, and a rejected transaction is reported separately within the same period. Rejected money comes back; blocked money stays put. For euro instant transfers, Regulation (EU) 2024/886 moved sanctions screening from the payment to the customer: the PSP checks its own users against EU targeted restrictive measures immediately after any new measure and at least once a calendar day, and may not additionally screen the payer and payee while executing the transfer.
A recall is a request without an entitlement. Under the 2025 SEPA Credit Transfer rulebook, the originator bank may recall only for duplicate sending, a technical error or fraud, within 10 banking business days of execution, or 13 months for fraud; the beneficiary bank may require the beneficiary's consent, and a refusal is a valid response. A payment to an incorrect unique identifier is, under Article 88 PSD2, deemed correctly executed: the payer's PSP must only make reasonable efforts to recover the funds. Since 9 October 2025 in the euro area, and from 9 July 2027 elsewhere in the EU, the payer's PSP checks the payee's name against the IBAN before the payer authorises the transfer; a match shows only that the account belongs to the named person.
When an agent stands in the middle, none of these rights belongs to the customer: the agent's bank sends the recall, Article 88 efforts are made for the agent, and the agent sees the name-mismatch warning. The customer's way back runs through the contract with the agent.
Popular but ends badly
Q/A
Correspondents and due diligence
Our partner bank wants KYC on our payment firm's customers. Is it entitled to that?
A correspondent has no general duty to check its customer's customers: FATF states that the Recommendations do not require it, and the EBA proceeds on the basis that a correspondent does not normally have a relationship with them. The correspondent may send an RFI about a specific transaction or flow and ask about the beneficial owner, the source of funds and the counterparties. For payable-through accounts and nested arrangements it must be satisfied that the respondent has checked the customers with direct access and can provide the data on request. An unanswered RFI usually leads to restricted activity or exit.
An EMI issues IBANs to other payment companies. Is that a nested relationship?
Yes, if those companies route their customers' payments through its account. To the bank, the EMI in that arrangement is a respondent that itself provides correspondent services. FATF accepts the structure where the correspondent is informed of it and the relationships are transparent; an undisclosed arrangement often ends with the account closed for the whole chain. The 2026 Wolfsberg guidance on non-bank PSPs expects the bank to understand how AML and sanctions functions are divided in such arrangements.
What is a shell bank, and why is the prohibition absolute?
A bank without a physical presence in any country. In the US definition, presence means a place of business at a fixed address, at least one full-time employee and operating records; an affiliate of a supervised bank is exempt. The prohibition appears in R.13, section 313 of the USA PATRIOT Act, Article 24 of the EU directive and Article 39 AMLR, UK regulation 34 and the CBUAE guidelines; the correspondent must also satisfy itself that the respondent does not let shell banks use its accounts. There is no risk-based exception.
When do the new payer-data requirements under R.16 take effect?
FATF adopted the revised Recommendation 16 on 18 June 2025; the changes are to take effect by the end of 2030, and implementation guidance was under consultation until 21 August 2026. The FATF standard does not apply directly: obligations will arise from national and EU law. In the EU Regulation (EU) 2023/1113 applies for now, and after 14 November 2026 SWIFT accepts only structured or hybrid addresses.
Payments, charges and returns
The beneficiary received less than was sent. Is that an error?
Not necessarily. Under BEN / CRED the payee bears the charges, and every bank in the chain may deduct its own. Even under OUR / DEBT the payer is responsible for charges, but that alone does not guarantee that the full amount arrives. Deductions by preceding banks are reported in field 71F.
A service pays a customer's suppliers on its behalf. Is that legal without a licence?
Usually not. Accepting a customer's money to pay a third party is regulated money remittance in the EU and the UK, retail payment activity in Canada and a remittance service in Hong Kong. The commercial agent exclusion is lost as soon as the intermediary holds the funds in its own account until the payee receives them. The US "agent of the payee" construction (Arizona, for example) requires the opposite — that payment to the agent discharges the payer's debt — and does not fit an intermediary hired by the payer.
A payment an agent was asked to make was rejected. Who returns the money?
Returned funds travel back down the chain to the account they were sent from, the agent's, and the agent reimburses the customer under their contract. The beneficiary's bank has no dealings with the party behind the agent. Fees deducted en route may not come back, and if the agent has meanwhile become insolvent the customer is left with a claim against it.
A payment was stopped on sanctions. Is that the same as being rejected?
No, and the difference decides where the money is. Blocked property stays with the blocking institution, usually in a blocked interest-bearing account; in the United States the block is reported to OFAC within 10 business days, and only a licence from the sanctions authority can release the funds. A rejected transaction sends the funds back down the chain to the account they came from — the agent's, if an agent paid.