By David Carlisle

Vice President of Policy and Regulatory Affairs

Regulators now treat virtual asset service providers (VASPs) and stablecoin issuers as the equivalent of correspondent banks, and expect them to apply equally robust controls against illicit finance. These firms have grown from simple on- and off-ramps for niche sets of users into the providers of liquidity and infrastructure through which the cryptoasset industry connects to the wider financial system. That position makes them a chokepoint, in the same way correspondent banks are for cross-border payments.

The US Treasury made this requirement explicit on April 8, 2026, when it proposed rules under the GENIUS Act that would require regulated stablecoin issuers to treat their counterparty relationships as correspondent relationships. Under the Notice of Proposed Rulemaking (NPRM), issuers would apply the same due diligence that US banks apply to their correspondent accounts and comply with PATRIOT Act Section 311 measures. They would also have to block or reject activity covered by US sanctions in secondary markets, even where they are not a direct party to the transaction.

Sanctions authorities are applying the same logic. In May 2026, the UK designated the cryptoasset exchange HTX under Regulation 17A of its Russia sanctions regulations. Regulation 17A bars UK financial institutions, including cryptoasset firms, from maintaining correspondent accounts for designated entities or processing payments to, from or via them. The EU’s sanctions package that same month targeted the third-country infrastructure Russia uses to evade sanctions. In August, the US Treasury extended secondary sanctions authorities to Iran’s cryptoasset sector. Since the takedown of Garantex, authorities have stopped chasing sanctions evaders one exchange at a time and are putting the responsibility on the firms that provide access instead. For those firms, cryptoasset compliance now has to go beyond standard know-your-customer (KYC) checks, transaction monitoring and screening, and extend to denying illicit actors access to liquidity and infrastructure globally.

This piece makes four points:

  1. Correspondent banking became the central chokepoint of the anti-money laundering and countering the financing of terrorism (AML/CFT) and sanctions regime because of how cross-border payments settle. The controls built around it over the past 25 years explain what regulators now expect from cryptoasset firms. 
  2. Much of that model maps directly onto VASPs and stablecoin issuers: They control access to liquidity, carry nested risk and can conduct counterparty due diligence using on-chain data. 
  3. The analogy breaks down where cryptoasset activity has no formal counterparty, such as peer-to-peer transfers through unhosted wallets, decentralized finance (DeFi) protocols and cross-chain bridges. 
  4. Firms should respond by applying three principles: senior management accountability, counterparty due diligence at the center of risk management, and on-chain data used as intelligence instead of only as a screening output.

Correspondent banking activity is the plumbing beneath the global financial sector and plays a central role in the modern regime for combating illicit finance. If you work in a bank, you know this history and can skip to “The regulatory convergence with cryptoassets” section below. If you come to it from the cryptoasset side, this section explains why regulators reach for the correspondent banking model, and what that model has required of banks since 2001.

Correspondent banking is the mechanism that allows financial institutions to access services in different jurisdictions and process cross-border payments on behalf of their customers. At its most basic level, correspondent banking involves a bank in one jurisdiction establishing a direct relationship with a bank overseas (known as the respondent bank) in order to provide them with direct services that would otherwise not be available. 

For example, a bank in the United States may provide correspondent banking services to a respondent bank in Germany, enabling the German bank to access US dollar clearing services on behalf of its own customers and counterparties. This type of arrangement allows the German bank’s customers to undertake US dollar-denominated transactions relatively seamlessly when arranging for payment in goods and services that require settlement in US dollars. The expansion of correspondent banking activity has played a critical role in the growth of global financial services and trade over the past several decades, and has been an especially vital mechanism for enabling the dominance of the US dollar in global markets. 

But correspondent banking presents a set of significant illicit finance risks. For example, if the German bank mentioned above maintains its own relationships with banks in jurisdictions subject to US sanctions, such as Iran, then the German bank can use its US dollar account to process transactions on behalf of those Iranian banks. If left uncontrolled and unmonitored, the correspondent banking relationship can become a conduit for nested proxy access to the US financial system by sanctioned actors. 

Since September 11, 2001, financial sector watchdogs and standard setters have placed a greater focus on ensuring that banks providing correspondent services act as gatekeepers responsible for keeping illicit actors from exploiting cross-border financial flows. These efforts address specific features of correspondent banking that present financial crime risks, including: 

  • Cross-border nature of settlement
  • Opaqueness and lack of visibility into underlying activity, where correspondent banks lack insight about their respondents’ specific customers
  • The potential for nested activity, where third-party banks access correspondent banking service indirectly, via relationships they maintain with respondent banks
  • High volume and value activity
  • The potential for activity tied to sensitive goods and services across borders, such as dual-use technology used in the proliferation of weapons of mass destruction (WMDs)

Examples of specific counter-illicit finance efforts over the past two and a half decades designed to address these risks include:

  • USA PATRIOT Act: Following the terrorist attacks of September 11, the US government enacted the PATRIOT Act, which includes measures aimed at disrupting terrorist financing. Among its provisions is Section 311, which allows the US Treasury to designate a foreign financial institution, type of account, or class of transactions as a “primary money laundering concern” and prohibit or restrict US financial institutions from maintaining correspondent accounts on behalf of the target. The US has relied on this authority to restrict US correspondent banking access to entire jurisdictions — such as Iran and North Korea — and to call out specific financial institutions involved in facilitating financial crime, imposing what has been referred to as a “death sentence” for any designated bank. 
     
  • Financial Action Task Force (FATF): In 2012, the FATF, the global AML/CFT standard setting body, adopted Recommendation 13, which states that jurisdictions should require financial institutions engaged in correspondent banking to implement specific due diligence measures for assessing and managing the illicit finance risks among their respondents.    
     
  • Wolfsberg Correspondent Banking Principles and Questionnaire: In 2014, the Wolfsberg Group, an association of 12 global banks that develops financial crime guidance, published correspondent banking principles, which it updated in 2022. These offer guidelines for banks globally to ensure the effective implementation of AML/CFT and sanctions measures in correspondent banking. Wolfsberg also developed a Correspondent Banking Due Diligence Questionnaire (CBDDQ) that serves as the global standard for banks when establishing or renewing correspondent relationships. 

Parallel to these efforts, from about 2008 onward, US authorities began taking aggressive regulatory enforcement actions to prevent sanctioned jurisdictions, such as Iran, North Korea and Russia, from accessing US dollar clearing services via correspondent banking. This has included the increasingly aggressive use of secondary sanctions measures to target third country financial institutions that deal with designated financial institutions in sanctioned jurisdictions. It has also included the imposition of massive financial penalties against non-US banks, such as the US government’s $8.9 billion settlement with BNP Paribas in 2014, for routing prohibited transactions via US correspondent banks.  

It is no exaggeration to say that the correspondent banking system is perhaps the critical chokepoint in the global AML/CFT and sanctions regime today, and the key lever that policymakers look to for expanding the reach and impact of counter-illicit finance efforts globally. 

This focus has resulted in banks globally facing stringent risk management obligations, including conducting rigorous ongoing due diligence on their counterparty institutions, undertaking robust sanctions screening on cross-border payment messages transmitted by the SWIFT system and performing enhanced transaction monitoring to identify potential illicit or prohibited activities nested in correspondent relationships. It has also resulted in many financial institutions undertaking de-risking of certain cross-border business segments in the name of combating illicit finance — a problem that governments and organizations like the FATF have given attention insofar as it can jeopardize financial inclusion efforts.  

The cryptoasset industry has faced a steady increase in the scope of AML/CFT and sanctions compliance obligations ever since the US Treasury’s Financial Crimes Enforcement Network (FinCEN) first published guidance on virtual currencies in March 2013. Since June 2019, when the FATF expanded application of its Standards to virtual assets and VASPs, the industry globally has faced expectations to apply common AML/CFT standards, including the Travel Rule, which requires VASPs to share beneficiary and originator information with their VASP counterparts to create greater payments transparency. 

More recently, however, some jurisdictions have begun directing efforts at cryptoasset market participants that draw directly on the correspondent banking playbook. For example: 

  • US Combating Russian Money Laundering Act: In January 2023, the US designated a cryptoasset exchange, Bitzlato, as a “primary money laundering concern” under the Combating Russian Money Laundering Act, preventing US financial institutions from transmitting funds to the exchange. 
     
  • US GENIUS Act: In April 2026, the US Treasury issued a Notice of Proposed Rulemaking (NPRM) on AML/CFT and sanctions standards under the GENIUS Act, which establishes a framework for regulated stablecoin issuers. The NPRM, which is still undergoing review, recommends that relationships between stablecoin issuers and their counterparties be treated as correspondent relationships, which would require issuers to implement correspondent banking due diligence on their counterparties, and to ensure compliance with PATRIOT Act Section 311 measures. The NPRM also proposes that issuers must comply with sanctions in secondary markets, obliging them to block or reject activity covered by US sanctions, even where the issuer is not a direct counterparty to the transaction. 
     
  • UK Regulation 17A: The UK’s May 2026 sanctions targeting the exchange HTX and other entities drew on part 17A of the UK’s Russian sanctions regulations. This prohibits UK financial institutions, including cryptoasset firms, from opening or maintaining correspondent accounts on behalf of HTX and other entities designated under 17A, or from processing payments to/from or via those designated entities. 
     
  • EU sectoral sanctions: In addition to its prohibition on dealings with Russian and Belarussian VASPs, the EU’s sanctions have increasingly targeted third-country infrastructure Russia uses to evade sanctions, and include a restriction on dealing with third country payment agents providing “netting” services that can mask activity involving prohibited Russian actors.  

Though regulators are already starting to think of cryptoasset firms through a correspondent banking lens, it is worthwhile considering whether the analogy holds. 

There are several ways in which the services that VASPs and stablecoin issuers provide are akin to those of correspondent banks, and where AML/CFT and sanctions controls can be applied in analogous ways. For example: 

  • Global scope of services and network access gatekeeping: Stablecoin issuers and large VASPs serve as the on/offramps through which smaller players access global liquidity and vital payments infrastructure.
     
  • Exposure to nested services: VASPs and stablecoin issuers may be exposed to nested risks hidden within their counterparty relationships, exposing them to sanctions evasion risks in particular. 
     
  • Counterparty due diligence: VASPs and stablecoin issuers can conduct counterparty due diligence on their respective counterparties, drawing on guidance from the FATF and using resources such as the Global Digital Finance VASP Due Diligence Questionnaire, which draws on the Wolfsberg framework. VASPs are expected to do this already when establishing arrangements with other VASPs to transmit data under the Travel Rule. 
     
  • Second-order transaction and risk monitoring: On-chain data can provide a VASP or stablecoin issuer with insights into a counterparty’s risk profile. While VASPs and issuers — like banks — are not expected to conduct full due diligence on their counterparties’ underlying customers, leveraging insights about their counterparties’ on-chain transactions is essential to understanding the level of risk those relationships pose via underlying customer activity, and should inform decisions about whether to enter or maintain counterparty relationships. 
     
  • Global governance and senior accountability: Regulated VASPs and stablecoin issuers are expected to ensure board-level and senior management oversight of compliance and risk management arrangements. For cryptoasset firms operating globally, their governance arrangements and senior accountability are expected to reflect a particularly high standard.

But there are several ways in which the analogy breaks down, owing to technical features of cryptoassets and blockchains, as well as the operations of ecosystem participants. 

For example, VASPs may not always have formalized, contractual relationships with their counterparties in the manner that correspondent/respondent banking relationships are formalized. Additionally, cryptoasset transactions can be sent peer-to-peer via unhosted wallets, and via decentralized finance (DeFi) protocols and cross-chain bridging services that generally do not feature a central party. Consequently, regulated entities such as VASPs and stablecoin issuers will frequently encounter funds transfers that do not involve an identifiable counterparty that resembles a correspondent.

Despite these discrepancies, policymakers are making clear that cryptoasset market participants need to behave more like correspondent banks, responsible for ensuring that illicit actors cannot gain access to cross-border liquidity and services. 

As the cryptoasset ecosystem continues to evolve and grow, it will be vital for global VASPs and stablecoin issuers to ensure that they are evolving the design of their compliance and risk management frameworks to take account of this shifting paradigm. The increasing expectations around correspondent banking-type standards in cryptoassets, after all, will not only come from regulators. As a growing number of large banks and financial institutions engage with cryptoassets, they are likely to apply robust standards to their interactions with cryptoasset market participants that draw upon their experience of correspondent banking. Indeed, in September 2025, Wolfsberg issued guidance on providing banking services to stablecoin issuers that does just that. 

Cryptoasset firms that are proactive in meeting those expectations will be more likely to thrive in a world where cryptoasset products and services are increasingly indistinguishable from traditional finance — and can avoid the major penalties and regulatory challenges that befell large banks a decade ago as a result of correspondent banking-related compliance and risk management failures. Doing so, however, requires applying certain key principles:

Senior management buy-in and accountability. Addressing these shifting expectations demands a top-down approach to oversight of crypto compliance and risk management. To achieve a correspondent banking-like standard in the design of their compliance arrangements, VASPs, stablecoin issuers and other relevant market participants must not treat compliance as a simple operational matter, but rather as a strategic priority that requires board level oversight, with accountability driven through clear articulations of risk appetite and and the use of management information (MI) to demonstrate adherence to that appetite. 

For example, it is not sufficient for a VASP to ask, “Are we screening for indicators of exposure to sanctioned parties in Russia?” Rather, they must articulate clear risk appetite statements such as, “We have a low tolerance for sanctions evasion and will require senior management approval of relationships that present risks of sanctions evasion (such as prospective customers and counterparties with significant on-chain exposure to Russia, even where located in third countries).” Framed this way, control design becomes a means of ensuring proactive and durable risk management, and not simply an exercise in implementing technical controls to meet rote obligations.    

Counterparty due diligence at the heart of risk management. A second priority for any VASP or stablecoin issuer should be to develop a comprehensive and robust approach to counterparty due diligence. Despite the above-noted discrepancies between traditional correspondent banking and crypto-native activity, cryptoasset market participants are nonetheless in a position to conduct meaningful due diligence on their counterparties. This can include those counterparty VASPs or issuers with which they have formally established account relationships or partnerships, but may also include ecosystem participants they interact with frequently, informally. For example, a VASP in the UK may observe via wallet and transaction screening that its customers routinely send funds to or from another VASP located overseas — both directly and via intermediary hops. 

In such cases, the UK VASP should routinely assess the risk profile of the counterparty VASP and should consider whether it has appropriate controls in place to address the risks. Using solutions such as Elliptic Discovery, our set of on-chain VASP risk indicators, compliance teams can identify whether VASP counterparties have high levels of exposure on-chain to sanctioned and other high-risk entities. These insights can allow a compliance team to implement specific controls in response to perceived risks, such as placing restrictions on the ability of customers to send funds to or from higher risk VASPs. 

Where designed and implemented effectively, a robust counterparty due diligence framework can serve as a vital defense against exposure to high or unacceptable levels of risk.

Leveraging financial intelligence as a strategic building block. Compliance teams at VASPs and issuers should view on-chain data about customers, counterparties and transactions not merely as an output of compliance screening systems and processes, but rather as intelligence that can enable them to implement a more proactive risk management framework. 

For example, when it comes to sanctions compliance, VASPs, stablecoin issuers, and other firms must continue to leverage Elliptic’s sanctions screening solutions to identify indications of sanctions exposure that might require immediate actions, such as freezing or rejection. Elliptic’s Data Fabric solution — which allows users to plug directly into our data and intelligence platform — allows our customers to design controls that complement routine list-based screening, including blacklists and whitelists of prohibited wallets, lists of approved VASP counterparties, ecosystem-wide insights about the use of assets they’ve issued or other intelligence-rich data sets that enable them to proactively spot risk. Used this way, on-chain risk management serves as more than just a compliance input, and allows regulated entities to design and implement data-led risk management programs that ensure rigor with scalable efficiency and effectiveness.  

Banks built today’s correspondent banking controls over two decades, largely in response to Section 311 designations, secondary sanctions and penalties such as the US government’s $8.9 billion settlement with BNP Paribas in 2014. Cryptoasset firms have the opportunity to avoid that path, provided the controls they put in place can withstand the scrutiny that regulators and their banking partners will apply.

That scrutiny will fall on the controls described above. A correspondent bank does not wait for a payment to clear before asking who sits behind its respondent, and a cryptoasset firm cannot afford to either. Each of the following requires a risk decision made before funds move, on data the firm can defend to a regulator:

  • Identifying nested exposure to Russia across several intermediary hops
  • Assessing a counterparty VASP the firm has never signed a contract with
  • Blocking a sanctioned party transacting with an issuer’s token in secondary markets

Whether a firm can make those calls reliably depends on the engineering decisions its on-chain risk management provider has made over the years, such as what happens when volumes spike or a regulator asks about a decision made three years ago. Our “Built for compliance” paper sets out the nine engineering decisions Elliptic has made to test whether your controls can meet a correspondent banking standard. Download “Built for compliance” here.

The Correspondent Banking Due Diligence Questionnaire (CBDDQ) is the Wolfsberg Group’s standard questionnaire for assessing a respondent bank’s anti-money laundering, counter-terrorist financing and sanctions controls. Banks use it when they open or renew a correspondent relationship. The Global Digital Finance VASP Due Diligence Questionnaire applies the same approach to relationships between cryptoasset firms.

By Joe Bognanno

Dr. Tom Robinson

Dr. Tom Robinson

Meera Judge