AML Published: Updated: By

What is de-risking and why is it controversial?

Quick answer

De-risking is when banks terminate entire categories of customer relationships to reduce AML compliance exposure, rather than assessing individual risk. It's controversial because it excludes legitimate customers, particularly in developing countries, while contradicting regulators' own risk-based approach requirements.

The full answer

De-risking is when a bank terminates or refuses business relationships with entire customer categories because those categories carry AML/CFT risk, rather than examining whether individual customers within those categories are actually problematic. A bank doesn't assess the specific remittance company applying for an account; it stops banking remittance companies altogether.

The term entered regulatory vocabulary around 2014, when the World Bank and FATF both began documenting the phenomenon systematically. It had been building since the early 2010s. It accelerated sharply after the HSBC enforcement action in December 2012 (a $1.9 billion settlement) and the BNP Paribas sanctions case in June 2014 ($8.97 billion penalty). Banks watching those cases concluded that any exposure to high-risk categories was potentially catastrophic, and that exit was safer than management.

The categories most consistently affected are money service businesses (MSBs), correspondent banking relationships with developing-country banks, charities operating near sanctioned jurisdictions, politically exposed persons (PEPs) from high-risk countries, and virtual asset service providers (VASPs). Correspondent banking has seen the most dramatic shrinkage. Countries on the FATF grey list often face automatic de-risking from correspondent banks, with no individual assessment applied to the specific institution.

Why this matters

The controversy has two components, and both are serious.

De-risking contradicts the regulatory framework that supposedly drives it. FATF Recommendation 1 requires a risk-based approach, which means assessing individual risk. Exiting entire customer segments is the opposite of individual risk assessment. FATF published guidance on this in 2014 and updated it in 2021, stating explicitly that wholesale de-risking is not consistent with the risk-based approach, and that exiting segments without individual assessment may itself be a compliance failure.

FinCEN, the OCC, the Federal Reserve, and the FDIC issued joint guidance in 2016 clarifying that banks are "neither prohibited nor discouraged" from banking MSBs or other high-risk categories. Terminating customer relationships purely to avoid managing risk, the agencies stated, is inconsistent with safe and sound banking practices.

The financial exclusion effects are real and documented. The Financial Stability Board has tracked correspondent banking relationship decline since 2011 and found consistent withdrawal from low-income country markets. The World Bank's survey found 75% of large international banks had reduced correspondent relationships by 2016. Sub-Saharan Africa, the Caribbean, and Pacific Island nations lost the most. Losing a correspondent relationship doesn't just inconvenience commercial customers; it cuts off remittance flows that families depend on and raises the cost of transfers that do get through.

Banks aren't behaving irrationally, though. The enforcement economics are asymmetric. Maintaining a high-risk relationship and having it go wrong produces a consent order, a monitorship, and potentially years of remediation costs that dwarf any revenue the relationship generated. Exiting produces nothing visible: no penalty, no enforcement action, no press release. Until regulators treat de-risking as an enforcement target rather than just a policy concern, the incentive to exit will persist.

The practical problem for compliance teams is that blanket exits don't eliminate risk; they shift it off-balance-sheet. Customers being de-risked don't stop needing financial services. They find informal channels or less-regulated providers, which may create more systemic risk than managing the original relationship would have. What regulators actually want is enhanced scrutiny proportional to risk. The difference between CDD and EDD captures that distinction exactly: enhanced due diligence is proportionate; categorical exit is not.

AI-assisted transaction monitoring is increasingly cited as one path out of the de-risking trap. If monitoring a high-risk segment costs less, the economic case for exiting it weakens. Perpetual KYC approaches that maintain continuously updated risk profiles reduce the periodic re-underwriting burden that makes certain segments feel unmanageable. How much AML compliance costs at a mid-market bank is central here: when compliance cost is the direct driver of segment exit decisions, reducing that cost changes the calculus.

A structural problem that technology alone won't fix is beneficial ownership complexity. Many MSBs and smaller correspondent banks can't produce the UBO documentation that large banks now require post-enforcement. That creates a due diligence asymmetry: the legitimate smaller institution fails the documentation bar, so it gets exited alongside bad actors. How often customer risk ratings should be refreshed is a related question, since continuous monitoring could reduce the burden of periodic UBO re-verification that currently makes these relationships feel uneconomic to maintain.

What triggers a regulatory exam also shapes de-risking behavior. Banks that understand exam triggers can calibrate their risk posture more precisely, rather than applying blanket exits as a hedge against examiner scrutiny they don't fully understand.

Related questions

Related concepts and regulations

← All compliance questions