The final rule states that a covered financial institution should take a risk-based approach (based on factors such as the type of services it offers and the geographic locations of its correspondent account holders) when deciding what, if any, additional due diligence measures it adopts to guard against the indirect use of its correspondent accounts by Commercial Bank of Syria.