Join our Newsletter — 33% off our NHI Course
Home› Glossary› Governance, Ownership & Risk› Source Of Funds Declaration
Governance, Ownership & Risk

Source Of Funds Declaration

← Back to Glossary
By NHI Mgmt Group Updated October 31, 2026 Domain: Governance, Ownership & Risk

A source of funds declaration explains where a company’s money comes from and how it was generated. Banks use it to test whether deposits and transactions are credible, lawful, and consistent with the business profile. It is especially important for cross-border activity and higher-risk sectors.

What a source of funds declaration tells banks

A source of funds declaration is not just a statement of turnover or cash balance. It gives the bank a defensible explanation for how money was generated, so the institution can judge whether the flow of funds makes sense for the customer’s activities, geography, and sector risk. That makes it a credibility and legality check, not a bookkeeping formality.

In practice, the declaration sits alongside business records, invoices, contracts, payroll evidence, sale proceeds, or other supporting material. The stronger the mismatch between declared activity and observed inflows, the more likely the bank is to ask for additional evidence or escalate the review.

Why source of funds is central to financial crime controls

Source of funds checks help banks identify whether money could be linked to fraud, money laundering, sanctions evasion, tax evasion, corruption, or disguised third-party financing. The control matters because the bank is not only testing where the money came from, but whether the stated explanation is coherent enough to trust the relationship.

This is especially important when the customer operates across borders, in cash-intensive sectors, or in industries where revenue patterns are irregular. In those cases, a credible explanation often depends on understanding the customer’s normal commercial cycle, not just the latest deposit.

For organisations building customer due diligence and enhanced due diligence workflows, the practical reference point is CDD, EDD, PEP and sanctions screening, because source of funds review usually sits inside that wider risk-based assessment.

What banks expect to see in support of the declaration

A useful declaration is specific, internally consistent, and evidence-backed. It explains the transaction path as well as the economic source, for example business revenue, asset sale proceeds, investment capital, inheritance, or intercompany transfers. It should also align with the customer profile already on file, including ownership structure, expected volume, and country exposure.

Banks commonly compare the declaration against account behaviour, entity documents, and external information. If the funds are described as business income, they will expect the numbers to resemble the company’s actual trading activity. If the funds came from a one-off event, they will usually want documentary proof that the event occurred and that the value is plausible.

Where the customer’s activity is unusually complex or high risk, the bank may ask for a source of wealth explanation as well. Source of wealth explains how the person or company became wealthy overall, while source of funds explains the immediate origin of the specific money being introduced into the relationship.

How the declaration is used in review and escalation decisions

The declaration helps analysts decide whether the funds are credible enough to accept, whether the case should be escalated, or whether the relationship should be restricted or exited. It is often a judgement exercise: the question is not merely whether the customer supplied a document, but whether the explanation is consistent, proportionate, and corroborated.

In a stronger control environment, the declaration is treated as part of ongoing monitoring rather than a one-time onboarding artifact. New payment patterns, unexpected counterparties, or changes in business model can all make an earlier explanation obsolete, which is why periodic refresh matters.

Where transaction routing or payment initiation depends on APIs and automated access paths, weak control design can widen exposure; the OWASP API Security Top 10 remains a useful external reference for understanding access and authorisation failures that can affect financial workflows. OWASP API Security Top 10

Common weaknesses and false confidence in source of funds reviews

The biggest failure mode is accepting a form without testing the story behind it. A declaration that is vague, generic, or unsupported can create false confidence, especially when it uses high-level phrases such as “business revenue” or “investment returns” without enough detail to verify the claim.

Another common weakness is over-reliance on a single document type. One bank statement or one invoice rarely proves the full picture on its own. Effective review depends on triangulating the explanation across account behaviour, ownership, transaction history, and the customer’s normal operating model.

Because this control relies on evidence quality, analysts also need to be alert to fabricated records, circular fund movements, nominee arrangements, and hidden third parties. Those patterns do not always prove wrongdoing, but they do mean the explanation is not yet strong enough to trust.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

FrameworkControl / ReferenceRelevance
CIS Controls v8CIS-5 — Account ManagementSource of funds review depends on knowing who controls money flows and account access.
Recommendation — Review account ownership and transaction authority before accepting declared fund origins.
NIST SP 800-53 Rev 5AU-6 — Audit Review, Analysis, and ReportingDeclared fund origins must be compared against transaction records and anomalies reviewed.
Recommendation — Correlate source-of-funds statements with transaction logs and escalate unexplained inconsistencies.
ISO/IEC 27001:2022A.5.15 — Access controlFinancial controls depend on restricting who can initiate, approve, and evidence payments.
Recommendation — Restrict payment and evidence-handling access to authorised roles with clear approval boundaries.
NIST CSF 2.0GV.RM-01 — Risk Management StrategySource of funds is a risk-based control used to judge financial crime exposure and business credibility.
Recommendation — Apply a risk-based review threshold that scales source-of-funds scrutiny with customer and sector risk.

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org