De-risking — the line between exit and exclusion
De-risking is what happens when a firm applies the risk-based approach in one direction only. The term describes exiting or refusing customers by category rather than by assessment — a whole nationality, a whole sector, everyone who triggers a particular flag. EU AML law does not contain a rule called “no de-risking”, but it contains several provisions that make category-level exclusion hard to defend, and one that makes lawful exit specific and evidenced.
1. What a lawful exit looks like
Article 21 of Regulation (EU) 2024/1624 is the operative provision, and it is narrower than it is often used. It requires refraining, terminating and considering a report where the entity is unable to comply with the customer due diligence measures laid down in Article 20(1). The trigger is a specific inability on a specific customer file.
| Basis for exit | Evidential position |
|---|---|
| A named Article 20(1) measure cannot be completed, with a documented record of what was sought and received | Strong — this is what Article 21 describes |
| Assessed unacceptable residual risk on this customer, documented against the firm’s risk appetite and the Annex III factors | Defensible — a risk decision, individually reasoned |
| Membership of a category, applied without individual assessment | Weak — no evidence the risk-based approach was applied at all |
2. Where the pressure comes from
De-risking is rarely a policy decision taken openly. It emerges from three ordinary operational pressures:
- Cost asymmetry. Enhanced due diligence on a small customer can cost more than the relationship earns, and the cheapest response is exit.
- Alert volume. Where a segment generates disproportionate alerts, removing the segment removes the alerts — which looks like control improvement in the metrics.
- Ambiguity aversion. Categories the firm finds hard to assess are exited not because the risk is high but because the assessment is uncertain, which is a different problem.
Each of these has a legitimate answer that is not exit: pricing, better-calibrated monitoring, and investing in the assessment capability respectively. Naming which pressure is driving a proposed exit is the most useful single question in the governance discussion.
3. The measures short of exit
The AMLR supplies a graduated toolkit, and using it is what distinguishes risk management from exclusion:
- Enhanced due diligence under Article 34 — the named measures for higher-risk cases.
- Source of funds and source of wealth enquiry, which is a standing measure for politically exposed persons under Article 42 and available more widely.
- Enhanced ongoing monitoring and a shortened refresh cycle under Article 26(2), which makes the period between updates depend on the risk of the relationship.
- Product or capability restriction — constraining what the relationship can do rather than ending it.
- Senior management approval as a condition of continuing, which is the mechanism Article 42 uses for PEPs and which works as an internal control generally.
4. Evidencing the decision
Facts: a firm proposes to exit all customers in a sector after a supervisory publication identifies elevated risk in it.
What the rules engage: the publication is an input to the business-wide risk assessment under Article 10(1)(d) and to the higher-risk assessment under Article 34(3). Neither provision authorises a category exit; both require the information to be taken into account.
What the practitioner does: uses the publication to re-tier the sector, applies enhanced due diligence and shortened refresh to the re-tiered population, and exits individual relationships under Article 21 where due diligence cannot in fact be completed. The record shows a population reassessed and a subset exited for stated reasons — which is a risk-based response, and is evidenced as one.
FAQ
Is de-risking prohibited by the AMLR?
There is no article by that name. What the Regulation requires is that risk factors be taken into account and that exits under Article 21 rest on an inability to complete specific due diligence measures — which is what makes undocumented category exits hard to defend.
Can we ever exit for risk appetite reasons?
Yes, where the decision is an individually reasoned assessment of residual risk against a documented appetite. What is weak is applying the label without the assessment.
What is the practical test?
Whether the file shows what was assessed about this customer. If the reasoning would read identically for every customer in the category, the assessment did not happen.
Related: When due diligence cannot be completed · Enhanced due diligence · The customer risk profile
