A Wolfsberg questionnaire SAMA AML assessment is rarely planned, yet many Saudi banks effectively undergo one each time a foreign correspondent reviews their completed questionnaire. The correspondent reads the answers, compares them with public information and asks for evidence. If the answers do not match what the bank's own documents show, the weakness surfaces in a partner's inquiry rather than in the bank's own testing.
This article is for compliance heads and AML officers who complete the Wolfsberg Correspondent Banking Due Diligence Questionnaire (CBDDQ) for foreign partners. It identifies four sections that behave like an independent assessment, explains a cross-reference method for the risk-assessment section, and describes an evidence format that serves both correspondents and internal audit.
Why the questionnaire works as an assessment
The questionnaire asks a bank to describe its AML, sanctions and related controls in a structured way. Each answer is a claim that a reader can test. SAMA's AML/CTF rules and the FATF Recommendations set the standard against which those claims should hold. When a yes/no answer cannot be backed by a policy, a record or a sample, the gap is already there; the questionnaire simply makes it visible.
Treat each answer as something an examiner could ask you to prove. That mindset changes who completes the form: not one person copying last year's responses, but a process with owners and evidence.
The four sections that reveal the most
Section numbering varies between questionnaire versions, so confirm it against the version your correspondent sends. The four areas below consistently expose weaknesses.
1. Section 2.1: ML/TF risk assessment
This is the most revealing area. It asks whether the bank has an enterprise-wide money laundering and terrorist financing risk assessment, and how it is used. Gaps appear when the assessment exists as a document but does not drive customer risk ratings, monitoring thresholds or resource decisions. Both SAMA and the FATF expect a risk-based approach, and a risk assessment that nobody applies fails that test.
2. Policies, procedures and governance
Questions on policy approval, a designated compliance officer, board oversight and independent testing check whether governance is real. Typical gaps include policies not updated after rule changes, unclear escalation lines, and no independent testing in the period you are describing.
3. Customer due diligence and beneficial ownership
Answers on KYC, enhanced due diligence, politically exposed persons and beneficial ownership can be checked directly against customer files. If your answer says beneficial owners are always identified, a file sample will confirm or contradict it quickly.
4. Monitoring and suspicious activity reporting
These questions cover transaction monitoring, alert handling, escalation and reporting to the competent authority. Gaps appear in alert backlogs, weak narrative quality in reports, and monitoring rules that do not reflect the risks named in Section 2.1.
The cross-reference method for Section 2.1
The aim is to show that what you tell a correspondent about risk is consistent with how you rate countries internally. A practical method:
- Extract the claims. List every statement in Section 2.1 and related answers: which risk factors you assess (customers, products, geographies, channels), how often you update, and who approves.
- Map your country-risk matrix. Document how your methodology rates jurisdictions, including how it draws on FATF public statements on high-risk and monitored jurisdictions, mutual evaluation outcomes and any internal factors.
- Match answer to method. For each geography-related answer, identify the matrix rule that supports it. If you state that high-risk jurisdictions receive enhanced measures, point to the rating threshold and the control that follows.
- Trace to operations. Check that the matrix rating feeds customer risk scoring, onboarding approvals and monitoring scenarios. A rating that stops at the document is a gap.
- Check currency. Confirm the matrix reflects the latest FATF lists and the date of your last review, and that the questionnaire answer reflects the same date.
- Record the differences. Where an answer is broader than practice, either correct the practice or correct the answer before submission.
Evidence format that serves both audiences
Correspondents and SAMA internal audit ask different questions, but they accept the same kind of evidence if it is organised well. For each questionnaire answer, keep an evidence record containing:
- the question reference and the exact answer submitted
- the owner who approved the answer and the date
- the supporting document, with version and approval date
- the sample or test result, where the answer depends on operation rather than policy
- any known exception and the action taken
Hold these records in one file for each submission. When a correspondent challenges an answer, you respond from evidence rather than recollection. When internal audit tests the same area, the records show how the answer was verified.
Where an independent assessment helps
Self-review has limits, because the people who wrote the answers are checking them. An independent assessment tests the program against SAMA rules and FATF Recommendations, and the Wolfsberg questionnaire is a useful lens for scoping it.
CISO Consulting's AML Assessment is an independent assessment of your AML/CTF program against the SAMA rules and the FATF Recommendations, covering governance, risk assessment, KYC, monitoring, reporting and training. It includes an enterprise-wide ML/TF risk assessment review, which is where Section 2.1 gaps usually begin. It also includes policy and procedure review, sample testing of customer files and alerts, and a look at suspicious activity reporting quality.
The work follows four steps: plan the scope, risk profile and sample design; review policies, risk assessment and governance; test customer files, alerts and reports; and report rated findings, a roadmap and a board summary. The sample is risk-based and agreed with you, typically covering every high-risk segment.
Closing
The assessment typically takes 5–8 weeks and produces an independent AML/CTF assessment report, findings rated by severity, a remediation roadmap and a board summary. It is designed to serve as independent testing of your AML/CTF program. If your next questionnaire cycle is approaching, an AML Assessment lets you find and fix the gaps first, and answer your correspondents from evidence.
