De-Risking's Impact on Legitimate Businesses: The Human Cost of Compliance Over-Caution

The financial crime compliance infrastructure that has been built over the past two decades has undoubtedly caught real criminals. It has also, systematically and at scale, damaged legitimate businesses, excluded law-abiding individuals from financial services, and created second-order harms that regulators are only now beginning to address seriously. This article examines the real cost of de-risking — not the PR version, but the operational and human reality.

What De-Risking Is

De-risking is the practice by which financial institutions terminate or restrict business relationships, or refuse to enter new relationships, with entire categories of customers, sectors, or geographic regions, rather than managing risk on an individual basis. It is fundamentally a response to regulatory and penalty risk: if compliance with AML regulations is difficult and the penalties for failure are severe, the rational response for a bank is to avoid the categories of customer that create that difficulty, regardless of whether any individual within that category poses a genuine risk.

The FATF recognised this problem in its 2014 guidance note on de-risking and updated its position in 2021, noting that blanket de-risking "is not consistent with the risk-based approach" to AML/CFT. The Financial Stability Board, the World Bank, and the IMF have all published reports documenting the macroeconomic harm caused by correspondent banking de-risking in developing countries. Yet the practice continues because the incentives that drive it — regulatory risk aversion, reputational risk management, and a compliance function that is measured on the absence of problems rather than the efficiency of access — have not changed materially.

The Business Impact: What It Actually Means

For a licensed iGaming operator, de-risking might mean: an account closure with two months' notice from a bank that has decided the sector is too complex for its risk appetite. Six months of frantic searching for alternatives while the existing account counts down. Operational disruption when player withdrawals slow as the business scrambles to migrate to a new provider. Potential regulatory scrutiny from the gaming commission because player fund segregation was briefly disrupted during the transition.

For a fintech business, it might mean being unable to open a settlement account for a new product launch because no high-street bank will onboard a business whose activities touch cryptocurrency. The product that was due to launch in Q2 is delayed to Q4 while the founders spend months in banking applications instead of building the business.

For a charity operating in fragile states, it might mean being unable to receive donations because the correspondent bank that processes USD payments to the jurisdiction has severed the relationship, and the charity cannot pay field workers or suppliers in the affected country.

The Regulatory Paradox

The regulatory paradox at the heart of de-risking is this: the businesses and individuals excluded from mainstream banking do not disappear. They move to less regulated, less transparent channels. A money service business that cannot open a bank account does not cease operating — it processes transactions through informal channels where no AML monitoring exists at all. A crypto exchange that cannot get a banking relationship does not stop trading — it uses opaque workarounds that are harder for regulators to see.

De-risking therefore achieves the opposite of its stated purpose in a significant proportion of cases: it reduces the financial system's ability to detect financial crime by pushing activity out of the regulated sector and into the shadows. The FATF itself has acknowledged this dynamic.

The UK's Regulatory Response

The UK government and FCA have taken some steps to address de-banking. Following high-profile cases of political figures and legitimate businesses having accounts closed without explanation, the Financial Services and Markets Act 2023 introduced amendments to the Payment Services Regulations 2017 requiring payment service providers to give 90 days' notice before closing a payment account and to provide a statement of reasons on request.

The FCA's subsequent consultation on de-banking — which resulted in guidance published in early 2024 — made clear that banks must not refuse or terminate accounts based solely on reputational concerns without an individual risk assessment, and that blanket exclusions of entire sectors are inconsistent with the regulatory framework. Whether this guidance will materially change bank behaviour is uncertain; the enforcement consequences of non-compliance remain limited.

The Specialist Institution as Structural Solution

The most practical response to de-risking, for businesses in affected sectors, is not to wait for regulatory reform to change high-street bank behaviour. It is to build banking relationships with institutions whose business model is specifically designed to serve these sectors, whose compliance frameworks are calibrated for the actual risk profile rather than generic worst-case assumptions, and whose commercial incentive is to maintain rather than terminate these relationships.

This is the structural role that specialist payment institutions play. They are not a compromise or a second-best option — they are the institutions that have correctly identified the market failure created by de-risking and built products to address it.