With the Panama Papers scandal and government promises of continued aggressive AML enforcement, financial institutions face a variety of risks that require increased vigilance and mitigation strategies.

One of the most challenging risks facing all financial institutions is foreign correspondent banking. In essence, a foreign correspondent banking relationship is built on the effectiveness of a foreign bank’s AML compliance program and ongoing monitoring capabilities. Such banking relationships can be very lucrative because they provide access to the U.S. banking system. But the risks can be significant and usually require dedication of substantial compliance resources to mitigate risks.

Foreign correspondent banking relationships involve a domestic financial institution providing banking services to a foreign financial institution and its customers in a foreign country. Foreign banks desire access to U.S. banks to provide a variety of services, including cash management, international payments or transfers, check clearing, payable through accounts, and other services.

Correspondent banking relationships create significant money laundering and terrorist financing risks because the domestic bank carrying out the transaction has to rely on the foreign bank to identify the customer, determine the real owners, and monitor such transactions for risks. The complexity of this requirement is significant because the foreign bank has AML compliance systems built for its local country of operation and is not necessarily capturing all of the information and potential risks imposed by the US regulatory system. In reality, the US bank is required to impose regulatory requirements from the US on the foreign bank for the foreign bank’s customers. That can be extremely difficult depending on the country and the foreign bank’s AML compliance program. It is easy to see how things can go awry in this scenario.

As the Federal Financial Institutions Examination Council Manual states:

Some foreign financial institutions are not subject to the same or similar regulatory guidelines as U.S. banks; therefore, these foreign institutions may pose a higher money laundering risk to their respective U.S. bank correspondents. Investigations have disclosed that, in the past, foreign correspondent accounts have been used by drug traffickers and other criminal elements to launder funds. Shell companies are sometimes used in the layering process to hide the true ownership of accounts at foreign correspondent financial institutions. Because of the large amount of funds, multiple transactions, and the U.S. bank’s potential lack of familiarity with the foreign correspondent financial institution’s customer, criminals and terrorists can more easily conceal the source and use of illicit funds. Consequently, each U.S. bank, including all overseas branches, offices, and subsidiaries, should closely monitor transactions related to foreign correspondent accounts.

The trick is to identify and focus attention on risks, based on a risk assessment and risk ranking process.

A basic list of risk factors include:

Geographic risk: transactions that originate, pass through, or terminate in high-risk jurisdictions where there are inadequate regulatory standards and/or high risk for crime, corruption, drug trafficking or terrorist activity. As an example, a foreign jurisdiction may not require banks to verify the identities or obtain KYC information on customers, sufficient to ensure compliance with US AML standards.

Correspondent Bank Risk Profile: The US financial institution ahs to devote resources to conduct a complete risk assessment of the foreign bank’s profile, its customer, the regulatory environment, and the presence of other risk factors.

Shell Banks: Transactions with shell banks (financial institution with no physical presence in a jurisdiction) are prohibited under the Bank Secrecy Act.

Customers of Customers: The basic challenge is to gain as much information and data surrounding the customers of the customer foreign correspondent bank. This requires data on the types of customers, amount of activity, identification of customers and beneficial owners of companies, and other data.

Payable Through Accounts: Foreign institutions provide their customers with payable through accounts that allow customers to write checks, make deposits and bank at a foreign bank as if they area US customer. They may not be subject to US standards for opening an account at the foreign financial institution.

Nested Accounts: A foreign financial institution can secure access to the US financial system by operating through another foreign correspondent bank. Customers of the second foreign financial bank can thereby gain access to the foreign correspondent bank with the direct relationship with the US bank.

OFAC and Sanctions and Corruption Risks: Aside from basic AML risks of drug trafficking and terrorist activity, US banks that engage in foreign correspondent banking have to develop strategies and policies to ensure OFAC and sanctions compliance, and FCPA compliance with foreign correspondent banks (as third-party intermediaries.

Limited Data: US banks have to ensure that they secure adequate documentation on specific customers and transactions. If a foreign financial institution does not collect data needed for the US bank’s compliance staff, the relationship cannot go forward.

Screening Criteria: US banks have to develop and implement at the foreign and domestic level, screening criteria for flagging potential risky transactions. The screening process should occur in accordance with clear policies and procedures to ensure risk mitigation for account opening, monitoring of transactions and the customer base, and the activity in the correspondent banking account.