The Conventional Wisdom
Many sanctions compliance programs treat correspondent banking due diligence as a one-time screening task. You onboard a correspondent, check them against OFAC's Specially Designated Nationals (SDN) List and other sanctions lists, document the results, and move on. Annual reviews repeat this process. If the correspondent isn't designated, you assume it's safe to process payments through that relationship.
This approach is straightforward: screen the entity you're directly dealing with, and you've met your sanctions obligations. It's clean, auditable, and fits existing workflows.
Why This Approach Falls Short
Screening your direct correspondent is necessary but not enough. The designation of VTB Bank under Executive Order 13902 highlights the flaws in this thinking. VTB Bank wasn't designated for a single prohibited transaction. Treasury designated it because the bank "established correspondent banking relationships with sanctioned Iranian financial institutions over the past three years" and built settlement infrastructure using those relationships.
The issue is clear: if you maintain a correspondent relationship with VTB Bank, or any institution that has ties with sanctioned entities, you're potentially facilitating sanctions evasion, even if you never directly engage with an Iranian counterparty. Your correspondent's connections become your risk.
This isn't just theoretical. It's how secondary sanctions operate. Under E.O. 13902 and related authorities, OFAC can impose restrictions on foreign financial institutions that engage in significant transactions involving designated persons. This means a non-U.S. bank could lose access to the U.S. financial system not for its own direct violations, but for its relationships with entities that support sanctioned activities.
The Evidence
The VTB Bank action is part of Operation Economic Outcast, Treasury's effort to target financial networks supporting Iran's sanctions evasion. Treasury warned that this operation "is increasing secondary sanctions risks for foreign financial institutions that continue doing business with sanctioned Iranian entities."
The details are significant. VTB Bank didn't just handle a few transactions. According to Treasury, the bank "moved billions of dollars in frozen Iranian assets and established a settlement structure using Iranian rials and Russian rubles through correspondent accounts to facilitate bilateral trade." This is infrastructure-level support for sanctions circumvention.
OFAC had already designated VTB Bank under Russia-related sanctions in 2022 and 2025. The September 14 action brought its Iranian financial-sector activities within E.O. 13902's scope, showing how institutions can accumulate designations across multiple sanctions programs as their risk profile evolves.
For compliance teams, the message is clear: your correspondent's sanctions compliance posture directly affects your own risk. If your correspondent has ties with high-risk jurisdictions or designated entities, you inherit that risk through the payment chain.
What to Do Instead
First, map your correspondent network beyond the first tier. Document not just who your correspondents are, but who they bank. This isn't about getting complete customer lists from every correspondent. It's about understanding their geographic footprint, their appetite for high-risk jurisdictions, and whether they have relationships in Iran, North Korea, Syria, or other comprehensively sanctioned regions.
Second, incorporate network-level due diligence into your correspondent risk assessments. During onboarding and periodic reviews, ask specific questions:
- Does the correspondent have relationships with financial institutions in FATF Black List jurisdictions?
- Has the correspondent faced enforcement actions or regulatory criticism related to sanctions compliance in the past three years?
- Does the correspondent process significant payment volumes involving countries subject to comprehensive U.S. sanctions?
Third, monitor for changes in your correspondents' sanctions exposure. A correspondent that's clean at onboarding can develop risk through new relationships or geographic expansion. VTB Bank's January 2025 expansion into Tehran is a case study: institutions change their risk profiles, and static annual reviews won't catch it.
Fourth, establish transaction-level controls that look beyond the immediate counterparty. When processing payments through correspondents, screen not just the originator and beneficiary but also intermediary banks in the payment chain. SWIFT message fields MT 52a (ordering institution), MT 56a (intermediary), and MT 57a (account with institution) all represent potential sanctions exposure points.
Fifth, assess your secondary sanctions risk if you're a non-U.S. institution. OFAC's warning about correspondent account restrictions is not just theoretical. The agency has used this authority before and will use it again. If you maintain relationships that could trigger secondary sanctions, document your risk assessment and decision-making process. If you can't justify the relationship, exit it before OFAC makes the decision for you.
When the Conventional Wisdom Holds
Point-in-time correspondent screening remains essential. You can't build network-level due diligence on a flawed foundation. If your correspondent is directly designated, no amount of enhanced due diligence makes that relationship compliant.
Annual reviews are valuable, especially for stable correspondent relationships in low-risk jurisdictions. A European correspondent bank with no presence in sanctioned regions and a strong compliance track record doesn't require monthly re-screening.
The conventional approach also works well for smaller institutions with limited correspondent networks. If you maintain five correspondent relationships, all with Tier 1 banks in FATF-compliant jurisdictions, network-level due diligence may not materially change your risk assessment.
However, if you're processing payments through correspondents in jurisdictions with weak sanctions enforcement, or if your correspondents operate in regions near comprehensively sanctioned countries, the conventional wisdom leaves you exposed. The VTB Bank designation isn't an outlier. It's a template for how OFAC will use secondary sanctions to pressure financial institutions that provide infrastructure for sanctions evasion.
Your correspondent's compliance failures can become your designation. Screen accordingly.
