Correspondent banking is one of the few relationships where the contract and the compliance program are genuinely the same artefact. The agreement is not a commercial wrapper around a service with compliance policy sitting separately alongside it. The conditions in the agreement are the control, and whether they are satisfied is what an examiner tests.
Most correspondent banks handle onboarding well. Due diligence is thorough, the questionnaire is reviewed, the risk rating is assigned, the agreement is negotiated with the right conditions in it. What is handled less well is the twelve to thirty-six months that follow, during which those conditions have to keep being true and the evidence that they are true has to keep being produced.
The gap has a structural cause. Relationship review is periodic and calendar-driven. The obligations are continuous, event-driven or on refresh cycles that do not align with the review calendar. Between reviews, a certification expires, a respondent restructures, a nested relationship appears, and nothing in the process notices until the next scheduled look.
The obligations that run continuously
A correspondent agreement typically creates five categories of continuing duty. Each has its own cadence, and only one of them aligns naturally with an annual relationship review.
- Periodic due diligence refresh, risk-tiered review of the respondent ownership, licensing, program and customer base, with the respondent obliged to supply information within a defined window.
- Certification and questionnaire currency, financial crime questionnaires and compliance attestations that expire on a fixed cycle and must be refreshed rather than merely held on file.
- Nested and downstream restrictions, prohibition on or approval requirement for the respondent granting access to its own institutional customers, which needs monitoring rather than a one-time confirmation.
- Information request response, an obligation on the respondent to answer transaction enquiries and enhanced due diligence requests within a short defined period, frequently tested in examination.
- Notification on material change, a duty to notify the correspondent of ownership change, licence action, enforcement action or sanctions exposure, usually promptly and without waiting for a scheduled review.
Read together, these describe a relationship that has to be continuously in a defensible state, not one that is assessed annually and assumed compliant in between. The distinction matters because the remediation for a lapsed condition is rarely just obtaining the missing document. It is a retrospective assessment of every transaction processed while the condition was unsatisfied, which is the same pattern seen across regulated vendor relationships in third-party risk contract automation.
When a required attestation expires and payment processing continues, the exposure is not the missing form. It is every payment cleared during the lapse, processed under a compliance basis that was no longer current. Examiners consistently treat the duration of the lapse, not the fact of it, as the measure of the finding.
Where the monitoring breaks down
The failure points are consistent across institutions and almost always trace back to obligations being held in a document rather than in a system that watches dates.
- Refresh cycles tracked in the review calendar only. A respondent on an eighteen-month refresh and an annual relationship review will drift, because the two calendars never coincide and the shorter one loses.
- Questionnaire held, not dated. The document is on file and satisfies a checklist, but nothing records when it expires, so currency is assumed rather than verified.
- Nesting discovered through transaction patterns. The restriction is contractual but monitoring for breach sits in transaction surveillance, so the contract condition and the detection capability are never connected.
- Response windows unowned. An information request goes out, the contractual response window starts running, and no one holds the clock until the respondent is late and the relationship manager is asked why.
- Change notifications received and not routed. The respondent does notify a licensing change, the notice lands in a relationship mailbox, and it never reaches the compliance owner who would have reassessed the risk rating.
Building a correspondent obligation register
Step 1, Extract conditions per relationship, not per template
Correspondent agreements are frequently amended and side-lettered, so template-level extraction misses the negotiated variations that matter most. Extract from the executed document set for each respondent, including amendments, so the register reflects what that specific relationship actually requires.
Step 2, Tier the cadence with the risk rating
Refresh intervals, response windows and monitoring intensity should all key off the assigned risk tier, and the register should recalculate due dates automatically when a tier changes. A respondent re-rated upward should immediately show a shortened next refresh date rather than keeping the old schedule.
Step 3, Track currency, not possession
Every certification, questionnaire and attestation gets an expiry date in the register, with escalation well before it. The question the system answers should be whether the document is current, not whether a copy exists somewhere in the file.
Step 4, Connect contract conditions to detection
Where a contractual restriction such as a nesting prohibition can be tested by transaction surveillance, record that linkage explicitly so a surveillance alert routes to the obligation owner as a potential contract breach, not only as a monitoring case.
Step 5, Make termination triggers live conditions
List each termination trigger as a monitored condition with a defined check, rather than as contract text read at onboarding. When a trigger condition is met the register should escalate immediately, because the decision window on a correspondent exit is short and the operational unwind is long.
Keep every respondent relationship examination-ready
See risk-tiered refresh cycles, certification currency and termination triggers monitored in one register.
What examiners actually test
Examination of a correspondent portfolio tends to follow a predictable shape. A sample of respondents is selected, weighted toward higher risk, and for each one the examiner asks to see the current due diligence file, evidence that the refresh happened on the required cycle, the current certification set, the record of any information requests and how quickly they were answered, and documentation of how change notifications were handled. What distinguishes a smooth examination from a difficult one is rarely the substance of the controls. It is whether the institution can produce dated evidence quickly, per relationship, without assembling it from four systems. That reporting posture is the same one that makes third-party risk examinations straightforward, and it comes from the same underlying discipline of holding obligations with owners, dates and evidence links.
Obligation cadence by risk tier
The structure below shows how the same obligation types carry different cadences by respondent risk tier. Actual intervals are set by institutional policy and the executed agreement, so the table is a framework for building a register rather than a statement of a standard.
| Obligation | Cadence driver | Higher risk tier | Standard tier | Evidence held |
|---|---|---|---|---|
| Due diligence refresh | Risk tier | Shortest policy interval | Standard policy interval | Completed review with approval |
| Financial crime questionnaire | Fixed expiry | Refresh plus targeted follow-up | Refresh on expiry | Dated questionnaire and review note |
| Nesting confirmation | Continuous | Confirmed plus surveillance linkage | Confirmed at refresh | Attestation and monitoring record |
| Information request response | Event-triggered | Shortened contractual window | Standard contractual window | Request, response and timestamps |
| Material change notification | Event-triggered | Immediate reassessment | Assessment at next review | Notice and routing record |
The correspondent relationship is unusual in that almost every obligation in the agreement is also a control the regulator will test. That alignment is an advantage if the obligations are tracked and a liability if they are not, because a gap in the register is simultaneously a contract breach and a compliance finding. Institutions that move these conditions out of the contract file and into a monitored register generally find the relationships were sound and only the evidence was thin, which is a much easier problem to fix before an examination than during one.
For related guidance, see OCC and FFIEC expectations for vendor contract files, Bank fintech partnership agreements, the control questions and The bank’s guide to DORA ICT third-party contract terms.
