Introduction

The Wolfsberg Correspondent Banking Due Diligence Questionnaire (CBDDQ) is the global standard for due diligence between financial institutions. More than 100 questions cover a respondent bank's AML/CTF and sanctions programme, KYC and CDD, payment transparency, monitoring and reporting — and the document is certified by both the MLRO and the Global Head of Correspondent Banking as "complete and correct" to their honest belief. A correspondent bank reads it, scores it, and decides whether to open or keep a relationship on the strength of it.

There is one structural weakness in that process, and it has nothing to do with how diligent the reviewer is. The CBDDQ is self-attested, it is long, and it is read the way every long document is read — linearly, top to bottom, one question at a time. That is exactly the reading that cannot catch the most revealing problem a questionnaire can contain: a bank that contradicts itself.

Sometimes a respondent answers one question one way and a related question another way. Private Banking is offered in one section and not in another. Correspondent services are provided, but the customer types that would obviously flow from them are never flagged for enhanced due diligence. Individually, each answer looks fine. Read against each other, they don't add up — and the gap between them is where risk hides.

A questionnaire is only as strong as its internal logic

The instinctive response to a contradiction is to call it a typo. Occasionally it is. More often it is a signal — and treating it as a clerical slip is precisely the box-ticking habit the industry needs to break.

Consider what a human reviewer is actually asked to do. Over 100 questions, grouped into sections that were never designed to be cross-referenced, the reviewer is expected to hold the answer to question 14 in mind while reading question 19, to remember what was declared about products while reading what was declared about customer risk, and to notice when the two quietly disagree. No reviewer working at the pace of a real correspondent portfolio can do that reliably across every relationship, every refresh cycle, every 18 months.

This is not a diligence failure. It is a measurement failure. The investment in the questionnaire is not the problem; the method of reading it is. And it maps directly onto a principle we return to again and again: the industry measures whether a control was described, not whether the description is internally coherent. Effectiveness lives in the coherence.

What an internal inconsistency looks like

The clearest inconsistencies are answer-to-answer: two questions that, by the logic of the CBDDQ itself, must agree — and don't. A few illustrative examples:

• Products that appear and disappear. A bank lists Private Banking among its business areas in one section, then states it does not offer Private Banking products and services in another. One of those answers is wrong — and Private Banking is a higher-risk line that drives EDD obligations, so it matters which.
• Services offered without the controls they imply. A bank confirms it provides correspondent banking services, but elsewhere indicates that respondent banks are neither subject to enhanced due diligence nor restricted nor prohibited. If you offer the service, the customer category exists; if the category exists, the control should too. The silence is the red flag.
• Standards claimed but not operationalised. A bank names PEP screening among its minimum AML/CTF standards, yet the questions that describe how PEPs are actually screened, risk-rated and reviewed come back empty or negative. The policy is asserted at the headline and contradicted in the detail.

None of these is exotic. Each is the kind of thing a respondent fills in across different sittings, by different teams, with no one cross-checking the whole. And each, left unexamined, lets a correspondent open or renew a relationship on a picture of the bank that the bank's own answers do not support.

When the contradiction escapes the document

There is a second, sharper class of inconsistency — and it is the one self-attestation can never police. It is when the questionnaire disagrees not with itself, but with the bank's actual behaviour.

Imagine a respondent that answers "no" to offering domestic correspondent services, while its transaction flows show domestic correspondent activity all the same. Or one that declares it does not serve a customer type whose transactions nonetheless appear in the data. The questionnaire says one thing; the payments say another. A reviewer reading the CBDDQ in isolation has no way to see it — the contradicting evidence isn't in the document.

This is where due diligence stops being about reading a form well and starts being about reconciling a declaration against reality. The two together — answer-versus-answer and answer-versus-data — are what turn a questionnaire from a statement of intent into a piece of measurable evidence.

Why inconsistencies are where risk hides

Correspondent banking is one of the channels financial crime depends on. The Financial Action Task Force has long warned that criminals exploit weak respondent banks to reach the international financial system through their correspondents — and that nested relationships and downstream clearing can move risk one step beyond the correspondent's line of sight. The Basel Committee frames the same exposure in its guidance on correspondent accounts.

An internal inconsistency is a marker for exactly these pockets. A correspondent service declared but not controlled is precisely where nested access can sit undisclosed. A product that appears and vanishes between sections is a line of business whose risk has not been assessed by anyone — including the bank that offers it. The contradiction doesn't create the risk; it reveals that the risk is unmanaged, undisclosed, or unseen.

The alternative is worse than missing them. When a correspondent can't trust a respondent's questionnaire and has no efficient way to test it, the path of least resistance is to walk away — to de-risk an entire relationship rather than investigate a single inconsistency. De-risking doesn't remove the risk; it relocates it into less transparent corners of the system. Catching and resolving inconsistencies is the proportionate, risk-based alternative to abandoning the relationship altogether.

Where Elucidate can help

Reading a CBDDQ for internal consistency at the speed and scale of a real correspondent portfolio is not a job for linear human review. It is a job for a model that checks every answer against every answer it should agree with, and against the bank's transactional reality.

That is what the Elucidate FinCrime Index (EFI) does. Our assessment runs the CBDDQ through a library of logical-consistency checks — systematically flagging where two answers that must agree don't — and, where transactional data is available, reconciles what the bank declared against what its payments actually show. The result isn't a single score with the contradictions averaged away; it is a clear, evidenced list of the specific inconsistencies, grouped by risk theme, so an analyst sees exactly which answers to question and why.

Your score is your score — independent, data-driven, and free of the subjectivity that lets a contradictory questionnaire pass for a clean one.

Conclusion

A self-attested questionnaire, certified as complete and read one question at a time, structurally cannot catch the moment a bank disagrees with itself. Those disagreements are not noise. They are the most honest signal a respondent gives you — a map of where its declared risk and its real risk have come apart.

The investment in due diligence is not the problem. The way the answers are read is. Read them against each other, and against the data, and the risk pockets stop hiding.

We look forward to comments and suggestions, and to continuing the discussion.