The Wolfsberg Group

The Wolfsberg Group is an association of twelve global banks that develops frameworks and guidance for managing financial crime risk. It has no regulatory authority whatsoever — and its questionnaires have nonetheless become the de facto standard for due diligence between banks worldwide.

How it works

The Group publishes principles, guidance and standardized questionnaires. Nothing it produces is binding on anyone. Its influence comes from who its members are: when twelve of the largest correspondent banks in the world adopt a common due diligence questionnaire, every institution that wants a correspondent relationship with them completes it.

The Correspondent Banking Due Diligence Questionnaire is the clearest example. Correspondent banking — where one bank provides services to another, typically to give it access to a market or currency it cannot reach directly — carries elevated risk, because the correspondent is exposed to customers it never onboarded and cannot see. The CBDDQ standardizes what a respondent bank must disclose about its ownership, licensing, AML program, sanctions controls and governance.

Before it existed, every correspondent asked its own questions in its own format, and respondent banks completed dozens of overlapping questionnaires annually. Standardization was the point, and it worked.

The Group also publishes guidance on payment transparency, sanctions screening, negative news screening, and the use of artificial intelligence and machine learning in financial crime compliance — areas where regulation lags practice and institutions want a defensible reference for what reasonable looks like.

Why it matters for identity verification

Wolfsberg guidance matters here for a reason that is easy to miss: it shapes what counts as adequate before regulators formalize it.

Because the guidance is written by practitioners at institutions under the heaviest supervisory scrutiny, it tends to describe where expectations are heading. Institutions that align with it early are rarely caught out; those that treat it as optional sometimes are, because examiners read it too and it informs their view of what a reasonable program looks like.

The correspondent banking context also inverts a familiar problem. A correspondent bank is exposed to the respondent’s customers without ever having verified any of them, so it is relying entirely on the quality of someone else’s onboarding. That makes the strength of a respondent’s identity verification a matter of direct commercial interest to its correspondent — and it is why the CBDDQ asks in detail about how a bank identifies its customers rather than only about its policies.

For an institution answering those questions, being able to describe an auditable verification process is worth more than describing an accurate one. Screening that records what ran and what it returned is what makes the answer evidenced rather than asserted, and Microblink’s AML, PEP and sanctions screening is built for that.

Wolfsberg Group vs FATF

Neither body regulates anyone directly. FATF works through governments, which turn its recommendations into binding law. Wolfsberg works through commercial pressure — you complete the questionnaire because the correspondent relationship depends on it.

What it can’t do

It cannot compel anyone. Guidance is voluntary and the Group has no enforcement mechanism. Compliance with Wolfsberg standards is not a defense to a regulatory finding, though it is useful evidence of a reasonable program.

It does not speak for the whole industry. Twelve very large global banks share concerns that a regional bank or a fintech may not. Guidance written for that membership sometimes sets expectations smaller institutions struggle to meet, and the CBDDQ is a substantial undertaking for a small respondent bank.

A completed questionnaire is a disclosure, not an assurance. The CBDDQ records what a bank says about its controls. It does not verify those answers, which is why correspondents supplement it with their own review rather than treating it as the whole of due diligence.

It cannot move faster than consensus. Guidance requires agreement among twelve institutions with different regulators and risk appetites, so it necessarily lags emerging threats. It describes settled good practice rather than the current frontier.

Frequently asked questions

Is the Wolfsberg Group a regulator?

No. It is a private association of twelve global banks with no legal authority. Its guidance is voluntary. Its influence comes from its members’ market position — institutions seeking correspondent relationships with them complete its questionnaires as a practical condition of doing business.

What is the Wolfsberg CBDDQ?

The Correspondent Banking Due Diligence Questionnaire, a standardized set of questions a respondent bank completes about its ownership, licensing, AML program and sanctions controls. It replaced a proliferation of bank-specific questionnaires and is now the industry standard.

Which banks are members of the Wolfsberg Group?

Banco Santander, Bank of America, Barclays, Citi, Deutsche Bank, Goldman Sachs, HSBC, J.P. Morgan Chase, MUFG, Société Générale, Standard Chartered and UBS — twelve global institutions.

What is the difference between the Wolfsberg Group and FATF?

FATF is intergovernmental and works through national legislation; its recommendations become binding law in member countries. Wolfsberg is a private banking association whose guidance is voluntary and takes effect through commercial pressure between banks.

Related reading

• Customer due diligence — what the CBDDQ asks a respondent bank to evidence
• Enhanced due diligence — the tier correspondent relationships usually sit in
• Egmont Group — the public-sector counterpart, for financial intelligence units
• Anti-money laundering — the framework this guidance operates inside