Skip to content
EBA · EU-wide

When due diligence fails — refrain, terminate, consider

Fintech Passport
August 20, 2026 · 4-min read
When due diligence fails — refrain, terminate, consider

Article 21 is the shortest path from a stalled onboarding to a decision, and it prescribes three steps rather than one. Where an obliged entity is unable to comply with the customer due diligence measures in Article 20(1), Regulation (EU) 2024/1624 requires it to refrain from carrying out a transaction or establishing a relationship, terminate the business relationship, and consider reporting a suspicious transaction to the FIU under Article 69. All three, in that order.

1. The three steps

StepWhat it requiresCommon failure
RefrainDo not carry out the transaction or establish the relationshipAllowing activity to continue while remediation is “in progress”
TerminateEnd the business relationshipLeaving a restricted account open indefinitely instead of closing it
Consider reportingAn explicit consideration of whether to report under Article 69Treating termination as the end of the matter

2. Three limits on what termination means

The Regulation then qualifies termination in ways that matter operationally:

  • Funds due to the entity may still be received. Termination does not prohibit the receipt of funds, as defined in Article 4, point (25) of Directive (EU) 2015/2366, that are due to the obliged entity. A firm owed money is not required to forgo it.
  • Customer assets need not be disposed of. Where the entity has a duty to protect its customer’s assets, termination is not to be understood as requiring their disposal. Closing a relationship is not liquidating a portfolio.
  • Life insurance has an alternative. For life insurance contracts, entities must where necessary, as an alternative to termination, refrain from performing transactions for the customer, including payouts to beneficiaries, until the Article 20(1) measures are complied with.

Article 21(2) then disapplies paragraph 1 to notaries, lawyers, other independent legal professionals and auditors in the circumstances the article defines — the professional-privilege carve-out, which does not reach financial institutions.

3. The de-risking tension

Article 21 sits at the centre of the de-risking debate, and reading it precisely helps. It requires termination where the entity is unable to comply with the due diligence measures — not where the customer is inconvenient, unprofitable, or in a category the firm would rather avoid.

The distinction is evidential. A file showing what was requested, when, how many times, what was received, and why the remaining gap prevents compliance supports an Article 21 termination. A file showing a category-level exit decision does not, and it invites the opposite question about access to financial services.

The practical discipline is therefore to make the inability concrete before terminating: name the Article 20(1) measure that cannot be completed, and say why.

4. Sequencing it in a real process

Facts: a corporate customer onboarded eight months ago has not responded to three requests for documentation of a beneficial owner identified through a complex ownership chain. The account is active and transacting.

What the rules engage: Article 20(1)(b) cannot be completed, so Article 21 applies — refrain, terminate, consider reporting. Article 69 makes the inability to conduct due diligence a circumstance in which suspicion may arise and must be reported. Article 73 governs what may be said to the customer about any assessment.

What the practitioner does: stops outbound activity first, since refraining is the immediate step and termination takes longer; records the specific measure that cannot be completed; runs the Article 69 consideration as a distinct, documented decision rather than as a by-product of closure; and keeps the customer communication to the commercial fact of termination, without touching the assessment.

FAQ

Must we always terminate?

Article 21(1) requires termination where the entity is unable to comply with the Article 20(1) measures. For life insurance contracts there is an express alternative — refraining from performing transactions, including payouts, until compliance is achieved.

Can we still collect what the customer owes us?

Yes. Termination does not prohibit the receipt of funds due to the obliged entity.

Do we have to file a report?

You must consider it, and Article 69 expressly covers suspicions arising from the inability to conduct customer due diligence. The consideration and its result are retained either way.


Related: Reporting suspicions · Timing of verification · De-risking

Related reads.