On 21 February 2025 the standard setter behind the FATF grey list agreed to revise its standards "to better support financial inclusion", with around 1.4 billion people still unbanked by its count (Plenary outcomes).
The new Recommendation 1 encourages simplified measures where risks are lower. It answers a problem the FATF named a decade before: institutions closing whole groups of accounts instead of managing each one's risk.
What does de-risking mean, and who is affected?
The OCC's review of the nine largest US national banks, released on 14 October 2026, found that between 2020 and September 2025 all nine had policies that could limit access over customers' beliefs or lawful business, and that banks restricted whole sectors: oil and gas exploration, coal, firearms and ammunition, detention facilities, tobacco and electronic cigarettes, and digital asset activities (OCC release). The OCC calls this debanking. Standard setters call the same shape de-risking.
The FATF's 2014 wording is the reference definition of de-risking, also written derisking: it "refers to the phenomenon of financial institutions terminating or restricting business relationships with clients or categories of clients to avoid, rather than manage, risk". The drivers it lists reach beyond AML: profitability, prudential requirements, anxiety after the financial crisis and reputational risk.
The EBA's 2023 guidelines name refugees and homeless people among the most vulnerable customers and add an annex on nonprofit organizations as customers; its 2022 opinion points to payment institutions that need bank accounts. A respondent bank that loses its correspondent banking relationship, or a money services business refused an account, is the same pattern one step up the chain.
Why do FATF and supervisors push back on de-risking?
The FATF gave two reasons in its statement of 23 October 2014. De-risking "can introduce risk and opacity into the global financial system", because closed accounts can push people "into less regulated or unregulated channels", and traceable channels are what make AML and CFT controls work. It also misreads the standard, which requires termination only "on a case-by-case basis, where the money laundering and terrorist financing risks cannot be mitigated", never "the wholesale cutting loose of entire classes of customer".
The EBA's opinion of 5 January 2022 takes a middle line: de-risking "can be a legitimate risk management tool but it can also be a sign of ineffective" risk management.
The FATF's 2021 stocktake found de-risking, financial exclusion and undue targeting of nonprofits where countries misapply the risk based approach. That finding led to the 2025 change in FATF Recommendation 1.
Which rules limit de-risking in the EU, the UK and the US?
Table 1. Rules that shape an exit, by jurisdiction (as of October 2026).
| Jurisdiction | Rule | In force | What it asks before or at an exit |
|---|---|---|---|
| FATF (standard) | Statement of 23 October 2014; Recommendation 1 as revised on 21 February 2025 | 2014; 2025 | End relationships case by case where risk cannot be mitigated; simplified measures where risk is lower |
| EU | EBA guidelines on ML/TF risk management and access to financial services (31 March 2023) | 2023 | Consider each customer's risk profile; exits of entire categories "can be unwarranted" |
| EU | Regulation (EU) 2024/1624, Article 21(3) | 10 July 2027 | Keep the decision, documents and justification, also for refusals, terminations and alternative measures |
| UK | Payment Services Regulations 2017, regulation 51B | 28 April 2026 | For framework contracts of indefinite length made from that date: at least 90 days' notice, reasons "sufficiently detailed and specific", how to complain and the ombudsman |
| UK | Regulation 51C | 28 April 2026 | No notice duty where, among other cases, due diligence cannot be applied, serious crime is suspected or the FCA, Treasury or Secretary of State requires the exit |
| US | Executive Order 14331, signed 7 August 2025 | 2025 | Decisions on "individualized, objective, and risk-based analyses"; regulators to remove reputation risk |
| US | OCC and FDIC rule (91 FR 18279); NCUA rule (91 FR 38270) | 9 June 2026; 27 July 2026 | The OCC and FDIC may not act against a bank on reputation risk or push it to close accounts over views or lawful business; the NCUA leaves reputation risk out of supervision |
The three regimes start from different worries. The EU and the UK frame the problem as inclusion and AML visibility, the US as access regardless of views or lawful business. They end at the same file.
Picture a banking group (illustrative) with banks in Dublin, London and New York that decides in November 2026 to exit a payment institution customer in each. The EBA test asks the Dublin bank whether that customer's own risk was weighed. The UK rule gives the London customer 90 days' notice and reasons it can understand, and the US order asks New York for an individualized analysis. One exit note that names the customer's rating, the controls tried and the reason answers all three, and where the exit follows due diligence that could not be completed, the AMLR will require that record from 10 July 2027.
Which de-risking rules took effect in 2026?
- 26 February. The Federal Reserve proposed its own reputation risk rule (91 FR 9499); comments closed on 27 April, and the Federal Register shows no final rule by 29 October.
- 28 April. UK notice and reasons rules began for new framework contracts.
- 9 June and 27 July. The OCC and FDIC rule, then the NCUA rule, took effect.
- 14 October. The OCC published its review of the nine largest national banks, built on nearly 100,000 complaints.
What can a firm do instead of exiting a whole customer group?
- Rate the customer, not the category. A customer risk assessment scores each nonprofit, money services business or politically exposed person on its own KYC facts, and PEP screening flags a status without deciding the exit.
- Try controls before the exit. Limits, closer monitoring or a narrower product come first, since the FATF expects termination only where risk cannot be mitigated.
- Write the decision down. Where due diligence cannot be completed, Article 21(3) of the AMLR requires the record from 10 July 2027, refusals and terminations included.
- Give notice where the rule asks for it. In the UK, 90 days and specific reasons for framework contracts for an indefinite period made from 28 April 2026, unless regulation 51C applies.
- Keep the reporting duty separate. From 10 July 2027, Article 21(1) has the firm terminate where due diligence cannot be completed and consider a suspicious transaction report.
complead, formerly Sanction Scanner, returns each customer risk rating with every contributing factor, its weight and its source, and stamps the model version on it, so the exit note can show which rating drove the decision.
Is debanking the same as de-risking?
Not quite. Executive Order 14331 defines "politicized or unlawful debanking" as restricting or changing a customer's access on the basis of political or religious beliefs, or of lawful business activities the provider "disagrees with or disfavors for political reasons". Debanking in that sense turns on the reason for the decision. De-risking turns on avoiding risk by category.
The two meet where a bank drops a whole lawful sector, which is what the OCC's review found. The answer to both is the same: a decision on the individual customer's risk, with the reason on file.
Which leaves a bank one decision, taken customer by customer: exit this one, or keep it under limits, monitoring or a narrower product, with the choice and the reason on file before any account closes.
Related terms
- Correspondent banking. A bank providing accounts and payment services to another bank, the respondent.
- Customer risk assessment. The rating that places one customer in a risk tier.
- Simplified due diligence. Lighter measures where risk is lower.
- Risk based approach. Matching controls to the assessed risk.
- Money services business. A remitter, money transmitter or currency exchange.
- AML risk assessment. The firm wide assessment that sets risk appetite.
How this entry was checked. The definition is the FATF's, quoted from its statement of 23 October 2014; the rest of the page rests on texts opened on 29 October 2026: the FATF Plenary outcomes of 21 February 2025, the EBA's opinion of 5 January 2022 and guidelines of 31 March 2023, Article 21 of Regulation (EU) 2024/1624, regulations 51B and 51C of the UK Payment Services Regulations 2017, Executive Order 14331, the OCC and FDIC, NCUA and Federal Reserve texts on reputation risk in the Federal Register, and the OCC's release of 14 October 2026. The banking group exit is illustrative. Burçak Aydın, Finance Manager at complead, drafted the entry; Fatih Coşkun, Founder and CEO, compares each row of Table 1 with its text and date before publication. Last reviewed: 30 October 2026.
