What is a Wolfsberg questionnaire?

A Wolfsberg questionnaire works as a signed statement rather than a one-off form. A financial institution answers it about its own financial crime controls, named senior officers put their names to it, and the correspondent banks that serve the institution rely on it in their due diligence. Because those banks go on relying on it after it has been sent, the institution keeps it current. The CBDDQ's declaration commits it to an update at least every eighteen months.

The term covers the Wolfsberg Group's two questionnaires only. It is not a supplier due diligence questionnaire, the KYC an institution runs on its own customers, or any of the Group's other papers.

How a Wolfsberg questionnaire works

A Wolfsberg questionnaire is a standard form a financial institution completes about itself. It uses one of two templates that the Wolfsberg Group publishes as the global standard for due diligence between institutions in a correspondent relationship. The answers describe the institution's own controls, not its customers or its suppliers.

Two forms from the Wolfsberg Group

The two forms are the Wolfsberg Correspondent Banking Due Diligence Questionnaire (CBDDQ) and the Wolfsberg Financial Crime Compliance Questionnaire (FCCQ). "Wolfsberg Group questionnaire" and "Wolfsberg questionnaire" refer to either one. On its correspondent banking resources page, the Group presents them as the global standard for due diligence when financial institutions set up a correspondent relationship.

The same page carries guidance, a glossary and FAQs for the questionnaires, published by the Group alongside the forms. The versions in use are CBDDQ v1.4 and FCCQ v1.2.

One questionnaire for many correspondent banks

The form is the same for every correspondent bank. Some institutions post their completed copy on their own websites. Answering it is part of the wider work of answering due diligence questionnaires. The CBDDQ's signatories show who owns the answers: the correspondent banking business and financial crime compliance.

The questionnaire is therefore a document the institution maintains, not a reply to one request. The CBDDQ declaration commits the institution to keep its answers current. That is why the update rules matter as much as the first completion.

What a Wolfsberg questionnaire covers

A CBDDQ covers one legal entity and its branches, never its subsidiaries. Each section asks the institution to confirm that its answers hold for every branch. These rules are set out for the CBDDQ in its own instructions and in the Wolfsberg Group's CBDDQ guidance.

One legal entity

The instruction box of the CBDDQ v1.4 requires the questionnaire to be answered at legal entity level. A single questionnaire must not cover more than one legal entity.

A group whose correspondent relationships run through several legal entities therefore needs one questionnaire per entity. Each one carries its own answers and its own declaration.

Branches but not subsidiaries

The Wolfsberg Group's CBDDQ Guidance v2.0 states that the questionnaire covers all of the legal entity's branches but not its subsidiaries. A subsidiary is a legal entity in its own right, so it falls under the one-entity rule and needs a questionnaire of its own.

The form's instruction box frames the branch rule more narrowly. It brings in branches whose client base, products and control model are materially similar to the head office's.

When a branch differs from the head office

Each CBDDQ section carries a row asking the institution to confirm that its answers are representative of all the legal entity's branches. Where the answer is No, the institution states which questions the difference relates to and which branches it applies to.

An Italian bank's published CBDDQ v1.4 shows how this reads in practice. Its fraud section answers No to the branch row. A note at question 132 explains that real-time monitoring differs according to the local legal requirements of each European country where its branches sit.

Who signs a Wolfsberg questionnaire

The CBDDQ is signed by two people. The FCCQ is signed by one person, a second-line senior compliance manager. That person certifies that the answers are complete and correct to their honest belief.

The CBDDQ declaration statement

The CBDDQ v1.4 declaration statement names both signatories. The first is the global head of correspondent banking or an equivalent position holder. The second is the group money laundering prevention officer, head of anti-money-laundering (AML), chief compliance officer or head of financial crimes compliance, or an equivalent.

One signature comes from the correspondent banking business and one from financial crime compliance. Both sign the same declaration, including its commitment to keeping the questionnaire current.

The FCCQ signature page

The FCCQ v1.2 signature page is signed by a single senior compliance manager, described on the form as the second-line representative. That person certifies having read and understood the declaration and that the answers are complete and correct to their honest belief.

How long a Wolfsberg questionnaire stays valid

Neither Wolfsberg form is meant to expire on a fixed date. The Wolfsberg Group recommends updating both questionnaires every 12 to 18 months.

The eighteen-month commitment

The CBDDQ v1.4 declaration holds two commitments. The information will be kept current, and it will be updated no less frequently than every eighteen months. The first has no set interval. The second puts an outer limit on how long the answers can stand without an update.

Version 1.4 revised the update period. In its announcement of the 2023 release, the Wolfsberg Group said the declaration statement had been updated to include a revised period for updating the questionnaire.

Why the window is 12 to 18 months

The Wolfsberg Group chose a window because a questionnaire seen as expiring on a specific date could hold up work when that date did not match a correspondent's customer due diligence review period. A window lets each correspondent work to its own review cycle.

The recommended window applies to both forms, not only to the CBDDQ.

Signature dates and older declaration wording

The signature date is what a reader of a completed copy sees first. A French institution's FCCQ v1.2, posted on its own website, shows a signature by its senior compliance manager dated 27 May 2024. Every bank that downloads the copy sees that date.

Published copies can also differ from the current form. The Italian bank's CBDDQ v1.4, signed in April 2024, carries a declaration promising updates no less frequently than on an annual basis. That is not the eighteen-month wording of the Wolfsberg Group's own v1.4 form.

How a Wolfsberg questionnaire differs from related questionnaires

A financial institution answers a Wolfsberg questionnaire about its own financial crime controls, for the banks it holds correspondent relationships with. That sets it apart from the other due diligence questionnaires the same institution meets. The two Wolfsberg forms also differ from each other.

The CBDDQ and the FCCQ

Both forms come from the Wolfsberg Group, and both end in a signed statement. The visible difference is the signature: the CBDDQ is signed by two people, one of them from correspondent banking, while the FCCQ is signed by one second-line compliance manager. The legal entity and branch rules described above come from the CBDDQ and its guidance.

The two forms have also changed on their own lines. Version 1.4 of the CBDDQ added a fraud section, along with new questions on whistleblower policy, virtual bank licences and approval of the sanctions policy. The FCCQ moved to version 1.2 in the same release.

A supplier DDQ

A due diligence questionnaire (DDQ) in the supplier sense is answered by a supplier when a bank, insurer, institutional investor or corporate buyer assesses it as a third party. Its subject is the supplier, not an institution's controls in a correspondent relationship.