De-Risking

What Is De-Risking?

De-risking is the practice of financial institutions terminating or restricting business relationships with whole categories of customers, rather than assessing and managing the risk of each customer individually. The aim is usually to avoid compliance cost, regulatory exposure or reputational risk altogether, instead of managing it.

Typical examples include a bank closing the accounts of all money transmitters, refusing every charity that operates in conflict zones, or withdrawing correspondent banking services from all banks in a particular region. The decision is driven by the category, not by evidence about the specific customer.

De-risking should be distinguished from legitimate exits. Ending a relationship because a particular customer presents a risk the institution cannot manage, or because of specific suspicion, is part of a functioning risk-based approach. De-risking is the wholesale version of that decision, applied without individual assessment.

Why De-Risking Matters

De-risking can look prudent from inside one institution, but it has wider consequences that regulators and standard setters have repeatedly highlighted.

• Financial exclusion. Legitimate customers, including migrants sending remittances and small businesses in higher-risk sectors, lose access to regulated services.
• Displacement of risk. Funds that cannot move through regulated channels often move through informal or unregulated ones, where they are less visible to authorities.
• Humanitarian impact. Non-profit organizations working in crisis regions may struggle to pay staff and suppliers when banks refuse to serve them.
• Concentration in correspondent banking. When correspondent relationships are withdrawn from smaller jurisdictions, cross-border payments are channeled through fewer banks, increasing dependency and reducing transparency.
• Competition. Fintechs, payment institutions and money services businesses may find it difficult to obtain the bank accounts they need to operate.

For the institution itself, de-risking can also create risk: regulators may treat blanket exits as evidence that the firm's risk-based approach is not working as intended, and some customer groups have legal rights of access to accounts.

Sectors Most Affected

Categories commonly reported as affected by de-risking include:

1. Money services businesses and remittance providers
2. Respondent banks in smaller or higher-risk jurisdictions
3. Non-profit organizations and charities, especially those working internationally
4. Payment institutions, e-money issuers and virtual asset service providers
5. Customers connected to jurisdictions under increased monitoring or sanctions
6. Politically exposed persons and their family members

Regulatory Expectations

FATF has stated that de-risking is not consistent with the risk-based approach set out in its Recommendations, which call for risk to be identified, assessed and managed case by case, not avoided wholesale. FATF has also carried out work on the unintended consequences of its standards, including financial exclusion and the treatment of non-profit organizations, and has revised its guidance on Recommendation 8 to discourage disproportionate measures against the non-profit sector.

In the European Union, the European Banking Authority has published an opinion on de-risking and guidance on how institutions should manage risk when providing access to financial services. The Payment Accounts Directive (2014/92/EU) gives consumers legally resident in the EU a right to a payment account with basic features, and PSD2 (Directive (EU) 2015/2366) requires that payment institutions have access to credit institutions' payment account services on an objective, non-discriminatory and proportionate basis.

In the United States, the AML Act of 2020 required a review of de-risking, and the Treasury Department has published a strategy on the subject. In the United Kingdom, regulators have likewise emphasized that firms should not decline or exit entire categories of customers without assessing individual risk.

The common expectation is that firms should be able to show why a relationship was refused or ended, and that the reason relates to the risk of that customer, not merely to the sector it belongs to.

Best Practices

• Write sector policies as risk appetite, not exclusions. Define the controls and information needed to serve a higher-risk sector rather than banning it outright.
• Assess individually. Apply customer risk rating and, where needed, enhanced due diligence to each applicant, and document the outcome.
• Use better data instead of blanket rules. Accurate screening and ownership information make it practical to accept customers that a cruder process would reject.
• Give customers a path. Where appropriate, explain what additional information or controls would allow the relationship to continue.
• Review exit decisions. Have a second line or committee review mass exit decisions for consistency with the stated risk appetite.

How on8.ai Helps

De-risking is often a response to the cost of managing risk customer by customer. SmartSanction provides sanctions, PEP and risk screening with an ownership and relationship graph for KYB, and every match comes with the reasoning behind it, which supports documented individual decisions instead of category-level exclusions.

Related Terms

• Risk-Based Approach (RBA)
• Correspondent Banking
• Money Services Business (MSB)
• Customer Risk Rating (CRR)
• Compliance Risk
• FATF Grey List