De-risking is when a bank or firm exits or refuses whole categories of customers to avoid financial crime risk, rather than managing that risk. It can cut off legitimate customers from banking and push activity into less visible channels, which is why regulators discourage it.
Key takeaways
- De-risking means dropping whole customer groups to avoid risk, not manage it.
- It often hits money service businesses, charities, and correspondent banking.
- It can cause financial exclusion and push activity into less visible channels.
- The number of correspondent banking relationships fell by about 20 percent from 2011 to 2019.
- The FATF and other regulators discourage wholesale de-risking.
- The alternative is the risk-based approach: manage risk case by case.
On this page
What it isWhy firms do itWho is affectedThe problem with itRegulators’ viewVs the risk-based approachAlternativesManaging risk insteadFAQsRead more
~20%
Fall in active correspondent banking relationships, 2011 to 2019
Source: Financial Stability Board
2014
Year the FATF issued a statement warning against wholesale de-risking
Source: FATF
$800B to $2T
Laundered worldwide each year that risk controls target
Source: UNODC
What is de-risking?
De-risking is when a firm avoids financial crime risk by cutting off whole groups of customers, rather than assessing and managing each one. Instead of deciding case by case, the firm makes a blanket call to exit or refuse a category.
A bank might drop every money service business, or refuse every customer from a certain country, because the group is seen as risky. The individual customer’s own risk is never really weighed.
It is often a reaction to cost and fear of penalties. Read more: it is the opposite of the risk-based approach regulators expect.
Why firms de-risk
Firms de-risk for reasons that are understandable, even where the outcome is criticized. A few pressures drive it.
- Cost. Managing a high-risk customer well can cost more than the customer earns.
- Fear of penalties. After large fines, some firms decide whole categories are not worth the risk.
- Uncertainty. Where the rules feel unclear, exiting can seem safer than judging.
- Simplicity. A blanket rule is easier to apply than a case-by-case judgment.
The logic is defensive, and from inside one firm it can even look responsible. The problem is that it solves one firm’s worry by creating a wider one.
Who is affected by de-risking?
De-risking tends to hit the same groups, often ones that are legitimate but seen as harder to serve. The impact can be severe.
- Money service businesses. Remittance firms that many people rely on to send money home.
- Charities and non-profits. Especially those working in high-risk regions.
- Correspondent banking. Smaller banks losing access to the global system.
- Customers from certain countries. Whole nationalities treated as too risky.
- Cash-intensive and crypto businesses. Seen as harder to monitor.
For the people behind these groups, losing banking can mean losing access to the financial system altogether.
Turn customer details into a risk rating
Enter a few details about a customer and get an indicative risk level, so you can judge the case rather than the category.
The problem with de-risking
De-risking carries costs that reach well beyond the firm making the decision. Two stand out.
The first is financial exclusion. When legitimate customers lose banking, they can be cut off from safe, regulated services, which is unfair and harmful. Remittance customers and charities are often the ones who suffer.
The second is reduced visibility. When activity is pushed out of the regulated system, it does not stop, it moves to smaller firms or informal channels with weaker controls. That makes the money harder for everyone to see.
There is a fairness point too. The customers most often de-risked, remittance users sending money to family, small charities, and businesses in poorer regions, are frequently the ones who can least afford to lose access. A control meant to fight crime can end up punishing the people it should protect.
Screen a customer instead of dropping them
Run one search across sanctions, PEP, and adverse media data to judge a real customer rather than a category.
Regulators’ view of de-risking
Regulators have been clear that wholesale de-risking is not what the rules intend. They see it as a misreading of the risk-based approach.
The FATF issued a statement in 2014 warning that the risk-based approach does not require firms to refuse whole categories of customers, and that de-risking can undermine the goals of financial crime rules. Other regulators have echoed this, urging firms to manage risk rather than avoid it.
The message is that declining a category to save effort is not a substitute for judging real risk.
De-risking vs the risk-based approach
De-risking and the risk-based approach are often confused, but they point in opposite directions. One avoids risk, the other manages it.
| De-risking | Risk-based approach | |
|---|---|---|
| Approach | Exit whole categories | Assess each customer |
| Basis | The group’s perceived risk | The customer’s actual risk |
| Effect | Excludes and hides activity | Keeps activity visible and managed |
High risk, under the risk-based approach, means more checks, not automatic refusal. Treating high risk as prohibited is where de-risking begins.
Alternatives to de-risking
There is almost always a middle path between accepting all risk and refusing a whole group. The alternatives focus on managing the risk.
- Enhanced due diligence. Apply deeper checks to higher-risk customers rather than exiting them.
- Closer monitoring. Watch higher-risk accounts more carefully.
- Clear risk appetite. Decide what the firm will accept and manage, and why.
- Better tools. Use technology to make managing risk affordable at scale.
Do this: get an indicative read on your exposure with the AML Risk Assessment before making blanket calls.
How to manage risk without de-risking
Managing risk instead of avoiding it takes more effort, but it keeps customers served and activity visible. It is also what regulators expect. A few steps help.
- Rate the customer, not the label. Judge each case on its own facts.
- Apply proportionate checks. Match the depth of due diligence to the risk.
- Monitor and review. Keep watching higher-risk relationships over time.
- Document decisions. Record why a customer was kept and how the risk is managed.
The effort is real, and smaller firms sometimes feel they cannot afford it. This is where good tools matter, because technology can make managing a higher-risk customer affordable enough that keeping them, rather than dropping them, becomes the sensible choice.
Get an indicative financial crime risk rating
See where your risk is concentrated so you can manage it case by case instead of dropping whole groups.
Frequently asked questions
What is de-risking?
De-risking is when a bank or firm avoids financial crime risk by cutting off whole groups of customers, rather than assessing and managing each one. Instead of judging case by case, the firm makes a blanket decision to exit or refuse a category. It is the opposite of the risk-based approach that regulators expect.
Why do banks de-risk?
Banks de-risk for reasons such as cost, since managing a high-risk customer well can cost more than the customer earns, fear of penalties after large fines, uncertainty where the rules feel unclear, and simplicity, since a blanket rule is easier than case-by-case judgment. The logic is defensive, but it shifts the problem elsewhere.
Who is affected by de-risking?
De-risking tends to hit money service businesses that people rely on for remittances, charities working in high-risk regions, smaller banks losing correspondent banking access, customers from certain countries, and cash-intensive or crypto businesses. For the people behind these groups, losing banking can mean losing access to the financial system altogether.
Why is de-risking a problem?
De-risking causes two main harms. The first is financial exclusion, where legitimate customers lose access to safe, regulated banking. The second is reduced visibility, because activity pushed out of the regulated system does not stop but moves to smaller firms or informal channels with weaker controls, making the money harder for everyone to see.
What do regulators say about de-risking?
Regulators discourage wholesale de-risking. The FATF issued a statement in 2014 warning that the risk-based approach does not require refusing whole categories of customers, and that de-risking can undermine the goals of financial crime rules. Other regulators have echoed this, urging firms to manage risk rather than simply avoid it.
What is the difference between de-risking and the risk-based approach?
De-risking exits whole categories based on a group’s perceived risk, while the risk-based approach assesses each customer on their actual risk. De-risking excludes customers and hides activity, whereas the risk-based approach keeps activity visible and managed. Under the risk-based approach, high risk means more checks, not automatic refusal.
What are the alternatives to de-risking?
The alternatives focus on managing risk rather than avoiding it. They include applying enhanced due diligence to higher-risk customers instead of exiting them, monitoring those accounts more closely, setting a clear risk appetite for what the firm will accept and manage, and using technology to make managing risk affordable at scale.
Is de-risking illegal?
De-risking is not illegal in itself, and firms can decline or exit customers. However, regulators discourage wholesale de-risking because it can cause financial exclusion and reduce visibility of activity. In some places, blanket de-risking of certain groups can raise fair-treatment or access concerns, so firms are expected to judge risk case by case.
How does de-risking cause financial exclusion?
De-risking causes financial exclusion when legitimate customers, such as remittance users or charities, lose their bank accounts because their category is seen as risky. Cut off from safe, regulated services, they may be forced into more costly or less secure alternatives. This harms the customers and can push money into channels that are harder to monitor.
What is correspondent banking de-risking?
Correspondent banking de-risking is when large banks withdraw the relationships that let smaller or foreign banks access the global financial system. The number of active correspondent banking relationships fell by about 20 percent between 2011 and 2019, according to the Financial Stability Board. This can cut whole regions off from cross-border payments.
How can a firm avoid de-risking?
A firm can avoid de-risking by rating each customer on their own facts rather than their label, applying checks in proportion to the risk, monitoring and reviewing higher-risk relationships over time, and documenting why a customer was kept and how the risk is managed. This keeps customers served and activity visible while controlling risk.
Does the risk-based approach require de-risking?
No. The risk-based approach does not require de-risking. It requires firms to match controls to risk, which means applying deeper checks to higher-risk customers, not refusing them outright. The FATF has made clear that treating high risk as automatic grounds for refusal is a misreading of the approach, not a requirement of it.
Read more: our ultimate guides, whitepapers and templates
Related guides and resources to help you act on what you just read.
Last reviewed July 12, 2026 · 10 min read · Written for compliance and risk professionals · By the WhoWiki editorial team
Key takeaway: de-risking is dropping whole categories of customers to avoid risk instead of managing it, and it can cut off legitimate people and push activity out of sight.