{"id":35854,"date":"2026-10-01T16:39:32","date_gmt":"2026-10-01T16:39:32","guid":{"rendered":"https:\/\/www.complycube.com\/?p=35854"},"modified":"2026-10-01T15:18:06","modified_gmt":"2026-10-01T15:18:06","slug":"austrac-warnt-vor-pauschalem-de-risking","status":"publish","type":"post","link":"https:\/\/www.complycube.com\/de\/austrac-warns-against-blanket-de-risking\/","title":{"rendered":"AUSTRAC Warns Businesses Against Blanket De-Risking"},"content":{"rendered":"

On 30 September 2026, the Australian Transaction Reports and Analysis Center (AUSTRAC) cautioned financial institutions against indiscriminately closing or restricting accounts for entire groups of customers deemed \u201chigh risk\u201d.\u00a0This act is referred to as de-risking.<\/p>\n\n\n\n

The regulator is urging companies to conduct individual assessments, apply proportionate controls, and adopt a Risk-Based Approach (RBA) to Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF). The message is clear: greater risk does not necessarily mean restricting customers.<\/p>\n\n\n\n

AUSTRAC Draws a Line on Blanket De-Risking<\/h2>\n\n\n\n

AUSTRAC\u2019s message is especially pertinent to sectors often affected by debanking, such as remittance providers, Virtual Asset Service Providers (VASPs), fintech companies, not-for-profit organizations, and businesses that rely heavily on cash.<\/p>\n\n\n\n

Debanking, also known as de-risking, happens when financial institutions refuse or limit their services because it regards a customer or a group of customers as \u201ctoo risky\u201d. A higher-risk rating does not automatically justify suspending or terminating user access or a business relationship. <\/p>\n\n\n\n

Instead, the regulator expects more proportionate controls<\/a>. In particular, businesses should evaluate other risk signals. These include the customer\u2019s jurisdiction, the nature of the transaction, and delivery channels before reaching a decision.<\/p>\n\n\n\n

Why Indiscriminate Debanking Can Increase Financial Crime Risk<\/h2>\n\n\n\n

At first glance, removing high-risk customers might seem to lower AML-Risiko<\/a> exposure. However, widespread debanking can have the reverse effect. For example, excluding legitimate businesses can increase activity towards less regulated services and channels. Additionally, it can make customers less transparent about the nature of their activities if they believe they might lose access to banking services.<\/p>\n\n\n\n

\n

We discourage indiscriminate or widespread account closures across entire sectors.<\/p>\n<\/blockquote>\n\n\n\n

As such, having full visibility over transactions and suspicious activity will be harder to detect and monitor. Furthermore, debanking can worsen financial inclusion. A registered business may be denied access without justification of a money-laundering threat. This can occur simply because it operates in a high-risk sector.<\/p>\n\n\n\n

Most importantly, sector-wide exclusion can weaken a risk-based AML framework. Effective AML compliance requires knowing when to apply step-up verification and enhanced due diligence, and when a customer\u2019s risk is genuinely too high to manage.<\/p>\n\n\n\n

Regulators Are Converging Around the Risk-Based Approach<\/h2>\n\n\n\n

AUSTRAC’s warning is not unique. In fact, leading regulators have repeatedly advocated the risk-based approach, bringing the focus away from blanket de-risking. Across EMEA, APAC, and AMER, supervisors are echoing the same message: higher risk should trigger investigation, not automatic exclusion.<\/p>\n\n\n\n

\n

Businesses must ensure customers have access to the financial services they need to fully participate in society and are not denied<\/a> this access.<\/p>\n<\/blockquote>\n\n\n\n

The European Banking Authority (EBA) notes that rejecting groups of users without considering individual risk profiles is a telling indication of ineffective AML and CTF risk management. It also emphasizes the negative implications of unsubstantiated de-risking for vulnerable customers and organizations. <\/p>\n\n\n\n

\n

Enforcing overly<\/a> stringent CDD processes prevents many legitimate businesses and individuals from opening or maintaining accounts.<\/p>\n<\/blockquote>\n\n\n\n

Hong Kong mirrors a similar approach. The Hong Kong Monetary Authority (HKMA) stresses the importance of risk differentiation. It notes that effective Customer Due Diligence (CDD) measures must ensure customers and businesses are treated fairly, with transparent and reasonable documentation of compliance decisions.<\/p>\n\n\n\n

\n

De-risking threatens<\/a> financial integrity and the risk-based approach by creating opacity and eliminating the ability to manage ML\/TF risks.<\/p>\n<\/blockquote>\n\n\n\n

In South Africa, the Financial Intelligence Center (FIC) states that wholesale de-risking to avoid risk goes against the RBA. A proper risk assessment does not require complete risk avoidance. It enables addressing ML and TF risks instead. <\/p>\n\n\n\n

\n

The FATF Standards do not envisage de-risking, or cutting-off<\/a> entire classes of customers.<\/p>\n<\/blockquote>\n\n\n\n

FATF, the body that sets global standards for fighting ML, TF, and financial crime, has repeatedly warned about de-risking. The regulator emphasizes the need to identify, assess, and understand financial crime risk before making decisions. It also states that jurisdictions under increased monitoring should not invite indiscriminate Enhanced Due Diligence (EDD).<\/p>\n\n\n\n

Implement Effective Risk-Based Approach<\/h2>\n\n\n\n

While it is crucial to avoid wholesale de-risking, it is equally important to identify, prevent, and mitigate ML and TF risk effectively. As such, the answer is not weaker compliance. Rather, the approach demands precise compliance. It distinguishes entities and users needing scrutiny from risks that cannot be managed entirely.<\/p>\n\n\n\n

For an effective, risk-based approach, businesses must identify risk accurately. They should apply proportionate controls and explain why each decision was made.<\/p>\n\n\n\n