The risk category¶

A charity working in a country on a high-risk list applies for a bank account and is declined. So is the next one. Neither was assessed individually, and neither had to be, because the assessment is the expensive part and the answer was settled by the category they arrived in.

The European Banking Authority named this in January 2022. Where an institution refuses to enter into, or terminates, business relationships “with individual customers or categories of customers associated with higher ML/TF risk”, that is de-risking. The Opinion is careful about which half is the problem. Ending a particular relationship may be perfectly lawful. What the EBA calls unwarranted is de-risking “of entire categories of customers, without due consideration of individual customers’ risk profiles”, which it treats as a sign that the risk management is not working rather than that it is working hard.

The step the category replaces¶

Anti-money laundering law in the Union is built on a risk-based approach, which is to say on looking at the customer actually in front of the institution. The category is what gets used when nobody looks.

The EBA lists what drives the substitution: risks or reputational risks exceeding the institution’s appetite, institutions lacking “the relevant knowledge or expertise to assess the risks associated with specific business models”, and cases “where the real or expected cost of compliance exceeds profits”.

The third is the one doing the work. It describes a customer refused not for being risky but for being unprofitable to find out about. The cost of the assessment, weighed against the revenue from the account, decides whether an assessment happens, and the person on the other side of that arithmetic is never a party to it.

Who arrives in the wrong category¶

The EBA found de-risking across the Union, affecting respondent banks, payment institutions and electronic money institutions, and “certain categories of individuals or entities that can be associated with higher ML/TF risks, for example asylum seekers from high ML/TF risk jurisdictions or not-for-profit organisations”.

None of those groups is unusual. They are the ones whose paperwork is hardest to check cheaply: the organisation whose beneficial owners are a board of trustees, the person whose identity documents were issued by a state that is itself on a list, the payment firm whose business model the compliance department has not seen before. Difficulty of assessment and probability of wrongdoing are different quantities, and the practice does not distinguish between them.

The EBA is blunt about the consequence. Financial exclusion concerns it because “access to at least basic financial products and services is a prerequisite for participation in modern economic and social life”.

The right to be told, and the rule against telling¶

A person whose basic payment account is closed has a right to reasons. Article 19(4) of the Payment Accounts Directive says consumers are to be given the grounds and the justification. The EBA notes what that collides with: the right to be told “can be in conflict with the requirements of AMLD that prohibit ‘tipping-off’”.

The right to an account has a similar shape. Article 16 of the same Directive creates one for customers legally resident in the Union, and the EBA records that it “applies only to the extent that institutions can comply with their AML/CFT obligations”, adding that “no clarification is provided on the interaction” between the two.

Reasons do exist in the system, and it is worth noticing where they go. Under Article 36 of the second Payment Services Directive, a credit institution refusing a payment institution access to its services “shall provide competent authorities with duly motivated reasons for any rejection”. The reasons are produced, written down and delivered. To the regulator.

The clerk’s brief¶

July 2025: The new authority opens, with a different remit¶

The Authority for Anti-Money Laundering and Countering the Financing of Terrorism began operations in 2025 from a seat in Frankfurt am Main, tasked with coordinating national authorities, directly supervising high-risk entities and writing the technical standards for the new rulebook. The clerks record what its own account of its mandate contains, and note that financial inclusion and de-risking are not in it.

March 2023: Guidelines against the practice¶

The EBA issued Guidelines on ML/TF risk management and access to financial services on 31 March 2023, requiring institutions to weigh the options before refusing a customer and to consider the individual risk profile rather than the class. The clerks observe that the remedy for a category applied instead of an assessment is an instruction to carry out the assessment, and that the arithmetic which made the assessment unattractive is left where it was.

January 2022: The Authority puts a name to it¶

Opinion EBA/Op/2022/01 of 5 January 2022 set out the definition, the affected groups and the drivers, following information gathering across all competent authorities in the Union during 2020 and 2021. It found the practice unwarranted where whole categories are refused without consideration of individual profiles, and identified the cost of compliance exceeding profits as one of the reasons institutions do it. The clerks note that the Opinion is addressed to competent authorities, the Commission and the co-legislators, and that the parties whose accounts were refused are its subject rather than its audience.

Where the file leaves it¶

Three instruments in this file give a customer rights: to an account, to reasons for its closure, to non-discriminatory access. Each is drafted for somebody an institution has engaged with and then turned down. The practice the file describes works earlier than that, by declining to engage, and by settling the question at the level of the class so that no individual case is ever opened. The clerks’ standing assessment is that the cheapest moment to refuse somebody is before they become a case, and that nothing in this file reaches that moment.