Due diligence questionnaire
DDQAlso called vendor questionnaire, third-party questionnaire
A due diligence questionnaire (DDQ) is a structured set of questions a firm sends to a supplier, partner or counterparty to assess its ownership, controls and risks before and during a relationship. Answers on financial crime, security, resilience and governance feed the firm's risk rating and decision to proceed.
How it works
The firm picks a questionnaire to match the relationship's risk tier, with short forms for low-risk suppliers and full versions for critical ones. The counterparty answers and attaches evidence such as policies, audit reports and certifications. Analysts review answers, raise follow-up questions and record findings. Questionnaires are refreshed at set intervals, often every one to two years, or after a material change.
DDQs give firms a consistent record that supervisors can test. In correspondent banking, the Wolfsberg Group's standard questionnaire lets banks answer one form for many counterparties. The limit is that answers are self-reported, so firms verify key points with documents, site visits or continuous monitoring rather than relying on the form alone.
The rules
Standard questionnaire covering ownership, AML, sanctions and fraud controls that banks complete for correspondent banking counterparties.
Correspondent banks (industry standard, not law)Lists due diligence factors banking organisations consider before entering third-party relationships, scaled to risk and criticality.
Banking organisations supervised by the Federal Reserve, FDIC and OCCRequire due diligence on providers covering ability, resources, ownership and reputation. EBA/GL/2026/09, published September 2026, will repeal them once it applies.
Credit institutions, investment firms, payment and e-money institutionsCommon questions
Is a DDQ legally required?
No law prescribes a specific questionnaire. Rules require firms to carry out due diligence on third parties and counterparties, and DDQs are the common way to collect and record that information consistently.
What is the Wolfsberg CBDDQ?
It is a standard questionnaire published by the Wolfsberg Group of banks for correspondent banking. Version 1.4, published in 2023, includes a fraud section. Banks complete it once and share it with counterparties instead of answering many bespoke forms.
How often should a DDQ be refreshed?
Firms set frequency by risk. Critical suppliers and higher-risk counterparties are usually reviewed annually, lower-risk ones less often. A merger, breach or ownership change normally triggers an early refresh.
How is a DDQ different from a security questionnaire?
A security questionnaire focuses on information security controls. A DDQ is broader, covering ownership, financial crime, compliance, resilience and governance, and may include a security section.
