Table of Contents
Bank due diligence, decoded
Bank due diligence is not a pop quiz; it’s a translation exercise. You already run controls, monitor transactions, and file reports. What banks need is legibility—clear proof that the risks in your business are identified, mitigated, measured, and repeatably controlled. When your bank due diligence narrative is coherent, approvals accelerate and account closures become rare. When it’s vague, even strong businesses get slow-rolled or declined.
For MSBs, VASPs, and FX brokers, the stakes are higher: regulators expect robust AML/CTF programs, Travel Rule implementation where applicable, and governance that actually works—not just policies on paper. That’s why treating bank due diligence as a product—designed, versioned, and evidenced—beats “attach the policy and hope.”
What banks really look for (and why)
Short version? Risk clarity + control evidence. But let’s make it concrete.
- Global standards shape the questions. FATF sets the baseline for AML/CTF and the Travel Rule (Rec. 16) with updated clarifications in 2021 for virtual assets/VASPs, and further revisions to Rec. 16 in 2025 to improve originator/beneficiary transparency in payments. If you can show alignment, your bank due diligence lands better. FATF+1
- Local supervisors set the bar. In the UK, cryptoasset firms must register with the FCA under the MLRs and demonstrate a risk-based AML/CTF regime; in the U.S., many crypto/payment models are MSBs under FinCEN, triggering full BSA obligations. Banks read your bank due diligence through these lenses. FCA+1FinCEN.gov
- Bank exam manuals and prudential guidance matter. The FFIEC BSA/AML Manual emphasizes risk assessment, CDD/beneficial ownership, and program effectiveness; Basel Committee guidance reinforces sound management of ML/TF risks and supervisory cooperation. When your artifacts mirror these expectations, reviewers relax. FFIEC BSA/AMLBank for International Settlements
- Correspondent banking norms are standardized. The Wolfsberg Group’s CBDDQ is the lingua franca for correspondent banking bank due diligence—even if you’re not a bank, expect its concepts to appear in RFIs. Wolfsberg Group
Bottom line: bank due diligence is easier when you pre-answer the questions these frameworks create.
The 11 battle-tested tips to win the bank due diligence gauntlet
Different format, same truth: below, each tip includes what to say, what to show, and where to prove it. Keep paragraphs tight; let your evidence do the talking.
1) Lead with a one-page risk story (not a policy dump)
Bank due diligence goes faster when reviewers grasp your business in 60 seconds. Open with a one-pager:
- What you do, for whom, in which corridors.
- Your risk appetite—what you avoid, accept, mitigate, and transfer.
- The map from risks → controls → evidence.
This is your narrative spine; everything else ties back. A clear one-pager often halves the first RFI.
2) Align to the right rulebooks—by name
Banks are comforted when you cite the exact scaffolding you follow. For VASPs, reference FATF VA/VASP guidance and Rec. 16/Travel Rule; for MSBs, cite FinCEN’s CVC/MSB guidance and BSA program obligations; for UK activity, cite the FCA’s registration regime. Mapping your controls to these sources makes bank due diligence feel familiar to the reader. FATF+1FinCEN.govFCA
Say: “Our program implements Rec. 16 for transfers and the FATF VA/VASP guidance; as an MSB-model business we implement BSA program elements, and we align to FCA MLRs for UK activity.”
Show: A short matrix with each requirement, your control, and a link to evidence.
3) Build a “bank-ready” evidence pack you can send in hours
Winners in bank due diligence don’t scramble. Pre-compile:
- Ownership & governance: org chart, cap table (redacted if needed), board/SMF-style bios.
- Policy index with effective dates and owners, plus procedures and control maps.
- Screening & monitoring: sanctions and TM hit-rate snapshots, sample alerts, escalation SLAs.
- Travel Rule orchestration (if relevant): data capture, counterparty discovery, exceptions.
- Independent assurance: internal audit schedule or third-party reviews.
- KPI deck: false positive rate, SAR/STR ratios, turnaround times, reject/return ratios.
Mirroring FFIEC expectations on CDD/beneficial ownership and program effectiveness makes this pack resonate. FFIEC BSA/AML
4) Treat correspondents like examiners: speak CBDDQ
Even if you’re not a bank, counterparties adopt Wolfsberg CBDDQ-style questions: products, customers, geographies, controls, sanctions, PEPs, adverse media, training, audit, governance. Fluency here smooths bank due diligence—and reduces “please clarify” loops. Keep a CBDDQ-inspired summary ready. Wolfsberg Group
5) Make Travel Rule execution boring—in a good way
For any model touching virtual assets, bank due diligence now zeroes in on your Travel Rule coverage: what you collect, how you validate, how you transmit, and how you handle exceptions. State your discovery method (protocol/providers), your fallback when counterparties aren’t reachable, and your resolution SLAs. Link to weekly coverage metrics. FATF’s updated guidance plus the 2025 Rec. 16 revisions set clear expectations; show you meet them. FATF+1
6) Prove your model works with live-like tests
A yes is easier when banks see you operate cleanly. Run low-risk pilot flows with a sandbox or test partner, export the logs, and include:
- Sample transactions with sanctions/TM checks and timestamps.
- Reconciliation extracts (bonus if you’re ISO-20022-ready).
- Incident runbooks with post-mortems.
Reviewers love demonstrations, not presentations. This is bank due diligence judo: you flip skepticism with evidence.
7) Show governance that actually governs
Regulators and banks both care about the who. Publish named owners for key risks and controls, committee charters, training records, and board reporting cadences. Basel guidance stresses embedding AML/CTF risks in the bank-wide framework; mirror that discipline in your own governance and your bank due diligence feels mature. Bank for International Settlements
8) Solve “de-risking anxiety” up front
MSBs and VASPs are often casualties of blanket de-risking. Counter it by quoting the interagency/OCC/FinCEN stance that banks should manage, not automatically exit, MSB relationships—then show how your controls make management feasible. Include an MSB banking one-pager with your mitigants, SLAs, and escalation paths. This reframes bank due diligence from “risky” to “manageable.” OCC.govFinCEN.gov+1
9) Write like a reviewer will read: short, labeled, evidence-linked
Long walls of text stall bank due diligence. Use short paragraphs, label exhibits, and link artifacts with explicit filenames. Replace “available on request” with “attached: 03-TM-Runbook-v7.pdf (pp. 4–7 show sanctions exceptions).” Reviewers reward clarity with speed.
10) Make your partner’s life easy (third-party discipline)
Banks evaluate you and your vendors. Document how you select, risk-assess, onboard, monitor, and—if needed—exit third parties. Pull language from OCC third-party expectations and adapt it; it’s familiar to reviewers and telegraphs operating maturity, which greases bank due diligence decisions. consumerfinancemonitor.com
11) Package your credibility: assurance and continuity
Independent reviews (internal audit or external assessments) are rocket fuel for bank due diligence. So are continuity plans: backup rails, failover liquidity, and communications runbooks. If you can hand a bank a tidy Assurance & Resilience appendix, you look like a low-maintenance client before you’ve sent a single payment.
Your 30–60–90 onboarding sprint
30 days — Narrative, controls, evidence
Your bank due diligence sprint starts with a board-approved risk appetite, a one-page business explainer, and an index of policies → procedures → controls → evidence. Freeze document versions. Pull a three-month slice of sanctions/TM logs with outcomes and escalation timing. Write a one-pager that names your open issues and remediation dates (banks love candor).
60 days — Dossier to doors
Shortlist two banks/PSPs that truly fit your flows and risk profile. Submit your dossier and hold weekly RFI clinics with internal SMEs. If you’re a VASP, run a Travel Rule dry-run across your top corridors and publish coverage stats; your bank due diligence gets easier when operational answers are ready. For MSB models, include your BSA/AML program memo and CDD/beneficial ownership procedures aligned to FFIEC/FinCEN expectations. FFIEC BSA/AMLFinCEN.gov
90 days — Test, tune, stabilize
Execute test transactions, lock reconciliation, tune thresholds, and agree escalation SLAs. Finish with a go-live readiness review and a 12-week post-live success plan: target reject ratios, ISR (instant success rate) where relevant, and issue-response timings. That’s the finish line of bank due diligence—when you stop explaining and start transacting.
Evidence banks love: the printable checklist
(Keep this as a living appendix to your bank due diligence pack. Swap bullets for short lines; it reads faster.)
- Ownership tree, governance chart, and board/SMF-equivalent bios (one page each).
- Policy index with owners and effective dates; procedures tied to controls; control testing calendar.
- Sanctions screening design, OFAC/EU lists sources, sample hits with resolution timestamps.
- Transaction monitoring typologies, alert thresholds, precision/recall snapshots, escalation SLAs.
- Travel Rule orchestration (discovery, data validation, transmission, exceptions) and weekly coverage metrics (VASPs). FATF
- CDD/beneficial ownership procedures aligning to FFIEC/FinCEN; sample CIP files (redacted). FFIEC BSA/AML
- Independent assurance: last review scope, findings, actions, and status.
- Outsourcing/third-party register; due-diligence records; monitoring cadence referencing OCC themes. consumerfinancemonitor.com
- KPIs: false positives, SAR/STR ratios, reject/return ratios, time-to-resolution, audit closure rate.
- Resilience: backup rails, liquidity playbooks, incident comms, and post-incident RCA template.
- Statement aligning to the Wolfsberg CBDDQ concepts to ease correspondent questionnaires. Wolfsberg Group
FAQ: hard questions, straight answers
Q1: We keep hearing “come back later.” What’s missing?
Usually legibility. Your bank due diligence likely lacks a coherent risk narrative or auditable evidence. Fix the one-pager, control map, and attach sample cases with timestamps. Many “no’s” become “yes, subject to…” once reviewers can see how you operate.
Q2: We’re a start-up VASP—do we really need a Travel Rule solution now?
If you want serious banking, yes. The FATF’s guidance and Rec. 16 revisions made Travel Rule transparency hard to ignore. Even phased execution should appear in your bank due diligence (coverage metrics, exception paths). FATF+1
Q3: Our model touches the U.S. indirectly—do we have to care about MSB rules?
Counterparties will ask. FinCEN’s CVC/MSB guidance consolidated how BSA rules apply to crypto/value transfer models; be ready with a memo stating applicability and your program stance. This proactive clarity speeds bank due diligence. FinCEN.gov
Q4: The bank wants proof our governance is “real.” What counts?
Named owners for risks/controls, committee minutes, training records, internal audit schedules, and recurring board reports. Basel and FFIEC expectations echo this; reference them in your bank due diligence deck. Bank for International SettlementsFFIEC BSA/AML
Q5: We’re being labeled “high-risk MSB.” How do we avoid a blanket decline?
Quote the OCC/FinCEN stance that banks should manage MSB risk rather than de-risk indiscriminately—then show how your controls make management feasible (SLAs, coverage, KPIs). Pair the position with an evidence pack; it reframes your bank due diligence from abstract to actionable. OCC.govFinCEN.gov
Work with Pipworth Partners (CTA)
At Pipworth Partners, we turn bank due diligence from a blocker into a fast lane. We help MSBs, VASPs, and FX brokers pressure-test dossiers, package bank-ready evidence, and make strategic introductions to banks, PSPs, and correspondents who fit your corridors and risk profile—then we stay engaged until first live transactions and stable operations.
- Meet us on About Us and see how we operate at the intersection of trust, strategy, and performance.
- Ready to brief your flows? Contact Us today for a targeted intro plan aligned to your bank due diligence story.
- Explore more playbooks on our News & Insights hub
If your next quarter depends on getting banked—and staying banked—partner with a team that knows what reviewers want to see and who is onboarding this quarter.
