The Wolfsberg correspondent banking questionnaire SAMA examiners now use as a de facto audit standard presents a challenge for many Saudi banks: the questionnaire was designed as a mutual due-diligence tool between correspondent and respondent institutions, yet the Saudi Central Bank increasingly treats completed questionnaires as evidence that a bank's KYC procedures meet the requirements of the Anti-Money Laundering Law and its Implementing Regulations. When examiners arrive on-site, they compare answers provided to correspondent banks against the underlying policies, risk assessments, customer files and monitoring records. Discrepancies between what was represented in the questionnaire and what exists in the KYC file constitute a deficiency, and in some cases evidence of inadequate due diligence or misrepresentation.
This article identifies the twelve sections of the Wolfsberg Group Correspondent Banking Due Diligence Questionnaire that SAMA examiners routinely cross-reference against internal documentation, and explains the evidence format and level of detail the regulator expects for each.
Why the Wolfsberg Questionnaire Has Become an Audit Template
The Wolfsberg Group publishes the Correspondent Banking Due Diligence Questionnaire as a standardized tool for financial institutions to assess the money-laundering and terrorist-financing risks of their correspondent relationships. Saudi banks complete this questionnaire when establishing or renewing correspondent accounts with international banks, and receive completed questionnaires from respondent banks seeking accounts with them.
SAMA examiners have observed that the questionnaire's structure closely mirrors the risk-based approach required under the FATF Recommendations and the Kingdom's AML/CTF framework. Rather than develop a separate examination checklist, examiners now request copies of completed Wolfsberg questionnaires during on-site inspections and use the twelve core sections as a roadmap to test whether the bank's actual practices align with its representations.
The practical result: any answer provided in a Wolfsberg questionnaire must be supported by current policies, documented procedures, system configurations, training records or file evidence. Treating the questionnaire as a marketing document or allowing relationship managers to complete it without compliance review creates audit risk.
The Twelve Sections SAMA Cross-References
1. General Information and Ownership Structure
Examiners verify that the ownership details disclosed in Section A match the bank's commercial registration, shareholder registers and beneficial-ownership records. For Saudi banks, this includes confirmation that any changes in ownership above five percent have been reported to SAMA as required, and that ultimate beneficial owners are identified to the natural-person level.
Evidence expected: Current commercial registration extract, organizational chart showing ownership layers, board resolution approving the correspondent relationship, and beneficial-ownership declaration signed by authorized officers.
2. Regulatory and Supervisory Framework
Section B asks which regulators supervise the institution and whether it holds the necessary licenses. Examiners compare the disclosed licenses against SAMA's own records and check that the bank has not omitted any regulatory actions, restrictions or conditions attached to its banking license.
Evidence expected: Copy of the banking license, most recent SAMA examination letter, and any correspondence regarding license conditions or operational restrictions.
3. Nature of Business and Customer Base
The questionnaire requires a description of the bank's business lines, geographic footprint and customer segments. Examiners cross-reference these representations against the bank's enterprise-wide ML/TF risk assessment, which must categorize customers by risk and explain the rationale for each classification.
Evidence expected: Board-approved enterprise ML/TF risk assessment, customer segmentation matrix, and product risk ratings. The risk assessment must reflect the customer types and geographies disclosed in the questionnaire.
4. Anti-Money Laundering and Counter-Terrorist Financing Policies
Section D requests confirmation that the bank maintains AML/CTF policies aligned with FATF standards and local law. Examiners review the policy manual to verify that it addresses all elements described in the questionnaire response, including customer due diligence, enhanced due diligence triggers, ongoing monitoring and suspicious-activity reporting.
Evidence expected: Current AML/CTF policy manual, date of last board approval, evidence of distribution to staff, and attestation records confirming employees have read and understood the policies.
5. Know Your Customer and Customer Due Diligence
This section asks detailed questions about CDD procedures, including the documents collected, verification methods and refresh intervals. Examiners select a sample of correspondent and respondent bank files and check that the due diligence performed matches the procedures described in the questionnaire.
Evidence expected: CDD procedure document, file checklists, copies of identification documents, beneficial-ownership declarations, source-of-funds documentation for high-risk accounts, and evidence of periodic reviews at the intervals stated in the questionnaire.
6. Politically Exposed Persons
The questionnaire asks whether the bank has procedures to identify and apply enhanced due diligence to PEPs, their family members and close associates. Examiners test whether the bank's PEP definition aligns with FATF guidance, whether screening covers domestic and foreign PEPs, and whether enhanced due diligence is documented in the files of identified PEPs.
Evidence expected: PEP policy defining domestic and foreign PEPs, list of data sources used for PEP screening, evidence of senior-management approval for PEP relationships, and enhanced due diligence documentation including source-of-wealth verification and ongoing monitoring plans.
7. Sanctions Compliance
Section G addresses compliance with United Nations, local, OFAC and EU sanctions regimes. Examiners verify that the bank screens correspondent transactions against all applicable sanctions lists, maintains documented escalation procedures for potential matches, and retains evidence of screening results.
Evidence expected: Sanctions compliance policy covering all relevant regimes, system configuration showing which sanctions lists are loaded, screening logs, escalation and investigation records for matches, and evidence of list updates. The bank must demonstrate that screening occurs at the points described in the questionnaire—typically at onboarding, periodically and at transaction level.
8. Transaction Monitoring
The questionnaire asks whether the bank operates automated transaction monitoring and what scenarios or rules are in place. Examiners request the scenario library, review threshold settings and test whether alerts are investigated and documented. They also verify that monitoring coverage extends to correspondent banking activity, not only retail transactions.
Evidence expected: Transaction monitoring policy, list of active scenarios with thresholds, alert investigation procedures, sample of closed alerts with documented rationale, and evidence that monitoring parameters are reviewed and tuned at least annually.
9. Suspicious Activity Reporting
Section I asks how the bank identifies, escalates and reports suspicious activity to the Saudi Financial Intelligence Unit. Examiners review a sample of suspicious transaction reports filed during the examination period and assess whether the bank is reporting activity that meets the legal threshold, whether reports are timely, and whether the quality of information supports FIU analysis.
Evidence expected: STR policy and procedures, escalation workflow, copies of filed STRs, evidence of FIU acknowledgment, and records showing that the compliance function reviews borderline cases and documents the decision to file or not file.
10. Training and Awareness
The questionnaire requests details of AML/CTF training programs, frequency and coverage. Examiners verify that training is provided to all relevant staff—including relationship managers, operations teams and senior management—and that the content addresses correspondent banking risks specifically.
Evidence expected: Training curriculum, attendance records, test results if applicable, and evidence that training is refreshed at least annually. For correspondent banking teams, specialized training on FATF Recommendation 13 and red flags for nested accounts is expected.
11. Independent Testing and Audit
Section K asks whether the AML/CTF program is subject to independent testing or audit. SAMA expects that this testing occurs at least annually and is performed by internal audit, external audit or an independent consultant. Examiners request the most recent independent testing report and verify that identified deficiencies have been remediated or are being tracked.
Evidence expected: Independent testing or audit report from the past twelve months, management response to findings, remediation tracker, and evidence that the board or board audit committee has reviewed the results.
12. Regulatory Actions and Investigations
The final section asks whether the bank has been subject to regulatory enforcement actions, fines or investigations related to AML/CTF. Examiners cross-reference the bank's response against SAMA's own enforcement records and any public disclosures. Failure to disclose a known action is treated as a serious compliance deficiency.
Evidence expected: Copies of any enforcement letters, settlement agreements, consent orders or formal warnings issued by SAMA or foreign regulators, along with evidence of remediation and current compliance status.
Common Gaps Between Questionnaire Responses and File Evidence
Many Saudi banks encounter findings in three areas:
Overstated capabilities. The questionnaire response states that the bank performs enhanced due diligence on all high-risk correspondents, but file testing reveals that source-of-funds documentation is missing or that periodic reviews are overdue.
Policy-practice divergence. Policies describe a robust PEP identification and approval process, yet examiners find PEP relationships in the portfolio that were never escalated to senior management or subjected to enhanced due diligence.
Incomplete sanctions screening. The bank confirms in the questionnaire that it screens against OFAC, UN and EU lists, yet system logs show that only OFAC and UN lists are loaded, or that screening occurs at onboarding but not at transaction level.
Building a Sustainable Approach
To align Wolfsberg questionnaire responses with actual practice and the evidence SAMA expects, banks should adopt three disciplines:
Compliance ownership of questionnaire completion. Relationship managers should not complete Wolfsberg questionnaires without compliance review and sign-off. The compliance function must verify that every answer is accurate and supported by current documentation before the questionnaire is submitted.
Annual questionnaire self-assessment. Even if no correspondent is requesting a refresh, the bank should review its last submitted questionnaire annually and confirm that all representations remain true. Changes in policy, systems, ownership or regulatory status must be communicated to correspondents and reflected in updated questionnaires.
Pre-examination file hygiene. Before any SAMA examination, the compliance function should select a sample of correspondent and respondent files, pull the most recent Wolfsberg questionnaire for each, and verify that the file contains the evidence the questionnaire represents. Gaps should be remediated before examiners arrive.
How Independent Assessment Supports This Work
An independent assessment of the AML/CTF program provides an objective view of whether policies, procedures and file evidence align with the representations made in Wolfsberg questionnaires and the requirements of SAMA's AML/CTF framework and the FATF Recommendations.
The assessment covers governance, enterprise-wide ML/TF risk assessment, policy and procedure review, and sample testing of customer files and alerts, with findings rated by severity, a remediation roadmap and a board summary delivered over five to eight weeks. The assessment is designed to serve as independent testing of the AML/CTF program, and the sample is risk-based and agreed with the institution, typically covering every high-risk segment.
This process surfaces the same gaps that SAMA examiners identify—overstated capabilities, policy-practice divergence, incomplete sanctions screening—and provides the institution with time to remediate before the next regulatory examination.
For banks that need deeper work on specific controls, independent validation of transaction monitoring scenarios and name-screening tools tests data quality, thresholds, fuzzy-matching performance and coverage of the risk assessment, while a dedicated sanctions compliance program review addresses UN, local, OFAC and EU regimes, covering screening, trade and payment controls, escalation and reporting.
Closing
The Wolfsberg correspondent banking questionnaire has evolved from a voluntary due-diligence tool into a regulatory benchmark. SAMA examiners now expect that every answer can be substantiated by current policies, documented procedures, system evidence and file testing. For AML compliance officers and heads of correspondent banking, the task is to ensure that what the bank represents to its correspondents reflects what actually happens in the KYC file, the monitoring system and the compliance function's day-to-day work.
CISO Consulting's AML Assessment delivers an independent review of your AML/CTF program against SAMA rules, FATF Recommendations and Wolfsberg standards, with sample testing of customer files and alerts, rated findings and a remediation roadmap. To discuss how an independent assessment can prepare your institution for the next SAMA examination, contact the team.
