The final rule states that a covered financial institution must take a risk-based approach based on factors such as the type of services offered by, and the geographic locations of, its correspondent account holders when deciding what, if any, additional due diligence measures it should adopt to guard against the indirect use of its correspondent accounts by Banco Delta Asia.