De-Risking: Regulatory Responses and What They Mean

De-risking — the practice of banks and payment firms withdrawing financial services from entire categories of customers or geographies, rather than managing individual customer risk — has been one of the most contentious issues in global financial regulation for the past decade. The phenomenon is not new: large global banks have been contracting their correspondent networks and shedding entire industry sectors since the post-2008 compliance investment surge. But the scale of the problem, and its cascading effects on legitimate businesses, NGOs, remittance corridors, and financial inclusion, has attracted sustained attention from regulators, international bodies, and policymakers that is now generating concrete regulatory responses.

The Scale of the Problem

The Financial Stability Board (FSB), World Bank, IMF, and FATF have all produced research quantifying the de-risking problem. The FSB's 2023 progress report on correspondent banking found that the number of active correspondent banking relationships globally had declined by approximately 22% between 2011 and 2022, with the steepest declines in small island developing states, sub-Saharan Africa, and Central America. The World Bank's "Withdrawal from Correspondent Banking" report identified multiple small jurisdictions that had lost all but one or two correspondent relationships, creating effective financial isolation for entire national economies.

At the sector level, the impacts are equally stark. Money service businesses — essential for remittances to developing economies — have faced mass account closures by major banks in the UK, US, and EU since 2013. Cannabis-related businesses remain almost entirely excluded from the banking system in most jurisdictions where the activity is legal. Charities operating in conflict zones face persistent banking difficulties despite explicit regulatory exemptions. Adult entertainment businesses, gaming operators, and payment institutions serving specialist industries all report difficulty maintaining basic banking relationships even where they are fully regulated and compliant.

G20 and FSB Responses

The G20 and FSB have made addressing de-risking a priority since 2015, when the problem was formally recognised at the Antalya Summit. The FSB's action plan identified four root causes: unclear and inconsistent regulatory expectations, disproportionate compliance costs, information asymmetries between correspondent and respondent institutions, and inadequate feedback from law enforcement to financial institutions about the value of their AML efforts.

The FSB's response has focused primarily on improving information sharing and standardisation. The creation of the Wolfsberg CBDDQ and the expansion of the SWIFT KYC Registry have reduced the information asymmetry problem. FATF's 2021 statement on de-risking explicitly clarified that the risk-based approach does not require categorical withdrawal from entire sectors, and that "de-risking is not a compliant response to money laundering/terrorist financing risk." These statements have regulatory significance: they give supervisors the basis to challenge banks that apply blanket sector exclusions as departing from the risk-based approach.

FCA Expectations and the Proportionality Principle

The FCA has been among the most vocal national regulators in addressing de-risking. Its 2021 report on access to banking services for money service businesses found that 63% of MSBs surveyed had experienced account closures or restrictions over the preceding five years, and that 27% had been unable to replace closed accounts. The FCA made clear in that report — and in subsequent Dear CEO letters — that it does not consider category-level exclusion of MSBs to be compliant with FCA expectations under the risk-based approach.

The FCA's Financial Crime Guide (FCG) states explicitly that a firm must not apply a blanket policy of refusing business from customers based solely on country or sector without individual risk assessment. Where a firm decides to exit a customer relationship for AML risk reasons, the FCA expects this to be based on an individual assessment of that customer's specific risk profile, not a portfolio-level decision driven by category membership alone.

The proportionality principle underpins this expectation: the compliance burden placed on any customer must be proportionate to the actual risk they present, not the theoretical risk of their category. A well-run, HMRC-registered, FCA-supervised MSB with audited accounts and a documented compliance programme does not present the same risk as an unregistered informal value transfer system — and treating them identically is both disproportionate and commercially irrational.

The Access to Banking and Payment Services (ABPS) Regime

The UK government responded to the debanking controversy — brought to a head by the Farage/NatWest case in 2023 — with the Access to Banking and Payment Services provisions in the Financial Services and Markets Act 2023. These provisions strengthen the requirements on payment service providers to notify customers of account closures with advance notice (minimum 90 days for personal accounts, with some exceptions) and to provide a reason for the closure. The FCA has subsequently consulted on guidance implementing these provisions, including expectations around the adequacy of reasons given.

While these provisions address the due process aspects of debanking, they do not create a right to banking services. A bank that provides adequate notice and a genuine reason remains free to exit a customer relationship. The more fundamental challenge — ensuring that legitimate businesses can actually find alternative banking — remains unresolved.

What Genuine Proportionality Looks Like

Regulatory guidance on de-risking converges on a consistent message: the risk-based approach requires individual assessment, not categorical exclusion. In practice, proportionate risk management for higher-risk customer segments involves:

• Documenting the specific risk factors relevant to each customer or class of customer, rather than applying a generic "high-risk sector" label
• Identifying what enhanced due diligence measures would adequately mitigate the identified risks, and implementing them
• Assessing whether the cost of managing the risk exceeds the commercial return — and if so, exiting the relationship on that commercial basis with appropriate notice, rather than hiding behind an AML justification
• Distinguishing between "we cannot manage this risk within our current framework" and "this risk cannot be managed by anyone" — the former may justify an exit; the latter is rarely true

The Role of Specialist Providers

The de-risking problem has created a market for specialist financial infrastructure providers — firms that have built the compliance capabilities, risk appetite, and sector expertise necessary to serve customer segments that mainstream banks have abandoned. For businesses in the sectors most affected by de-risking, these specialist providers are not a second-best option; they are often the only realistic route to compliant payment infrastructure. The key is selecting providers that are themselves genuinely regulated and compliant, rather than firms that offer banking access precisely because they have lower compliance standards.