The De-Risking Judgement Call: Keep, restrict or exit a higher-risk relationship
When a relationship keeps its risk after everything the firm has tried, decide what the law fixes, what it leaves to judgement and what it leaves open, and write the decision so it survives review.
UKMLR 2017 as amended by SI 2026/62158 min read2 worked scenarios, 3 decisions
Jurisdiction
United Kingdom
Status
Rules in force, five points open
Key change in force
30 June 2026
FATF list status
As at 19 June 2026
Evidence reviewed
21 September 2026
Last reviewed
21 September 2026
The question, and what this guide will not decide
A relationship manager, an MLRO and, sooner or later, a supervisor will ask the same thing about a higher-risk relationship: was keeping it, restricting it or ending it a decision the firm can defend?
This guide answers one question. When a UK bank faces a higher-risk correspondent bank or customer relationship, at what point does exit stop being a defensible anti-money-laundering decision and become de-risking, and can the analyst show that line to a supervisor? It is a practitioner framework, not legal advice.
Some of the answer is fixed by the text. Some is judgement that a record can defend. Five points are open on the text as it stands, and the guide says so rather than choosing a reading. That matters because an outcome that rests on a contested reading is the first thing an independent reviewer will find.
Name what the law fixes, what it leaves to judgement and what it leaves open, and never let one stand in for another.
Decision object. One outcome for one relationship: ordinary continuation, enhanced continuation, conditional or restricted continuation, discretionary decline or exit, or mandatory decline or termination. Practitioner outcome. After this guide you should be able to sort a relationship into mandatory or discretionary, test the mitigants before you exit, record a rationale another analyst could follow, and say which notice and tipping-off rules apply if you do exit.
What would change a conclusion. A jurisdiction moving lists, a shell bank link, a reg 28 measure that cannot be applied, a suspicion, or mitigants that stop being verifiable. Each changes the duties or the decision path, and the scenarios show how.
How evidence is labelled
Established Statute or an in-force regulation.
Guidance FATF, FCA or other official guidance, which is not itself a rule.
Industry position JMLSG guidance, which is approved by the Treasury but is not law.
FinCrimeRadar assessment Our analysis of how the text applies.
Unknown The text does not settle it.
Out of scope: sanctions, the Consumer Duty, other jurisdictions, and the reporting duties in POCA and the Terrorism Act beyond how they touch these decisions. No verdict here depends on the Consumer Duty.
Five outcomes, and only some are choices
Most of the argument in this field is about outcome four, discretionary exit. The law decides outcome five, and it does so in fewer cases than practitioners assume.
Outcome
Ordinary continuation
The standard due diligence applies and nothing in the assessment changes it.
Outcome
Enhanced continuation
The relationship continues with enhanced due diligence and enhanced ongoing monitoring where the law or the assessment calls for them. [1]
Outcome
Conditional or restricted continuation
The relationship continues on conditions, such as limited payment types or a reduced scope, that the firm can show it runs.
Outcome
Discretionary decline or exit
Nothing forces the outcome. The firm chooses it, and the defence is the record of why.
Outcome
Mandatory decline or termination
The regulations require it. On the plain terms of regulation 31, that is where the firm is unable to apply the regulation 28 measures. [1]
The FCA puts the boundary this way. It says effective risk management does not need to end in wholesale de-risking, that a bank should not enter into or maintain a relationship it cannot manage, and that the decision is ultimately a commercial one for the bank, with relatively few cases where declining solely because of AML requirements is necessary. [13] The FATF defines de-risking as refusing, terminating or restricting relationships to avoid risk rather than understanding and managing it, and says wholesale de-risking is contrary to the risk-based approach. [9]
Two of the fixed points are worth naming early. Regulation 34(2) says the firm must not enter into or continue a correspondent relationship with a shell bank. Regulation 31(1) requires termination where the firm is unable to apply customer due diligence measures as regulation 28 requires. [1]
The working sequence
A working order, not a form to complete in full every time. The exit step is reached only when an exit is on the table.
Identify the risk
Customer, geography, product, channel and transactions. Regulation 18(2) sets the factors for the business-wide assessment and regulation 33(6) lists the risk factors for a case. [1]
Check what the law fixes
Do this before any judgement, because it can end the analysis. Regulation 31 on its plain terms, regulation 34(2) on shell banks and regulation 33(1)(b) with the 33(3A) content are the fixed points. [1]
Test the mitigants
Which measures could reduce the risk, and whether each can be shown to work. FinCrimeRadar assessment.
Test capacity
Whether the firm can run the mitigant at the intensity needed. A practical input. It creates no AML duty to exit, but may inform a commercial decision, subject to other applicable law.
Assess residual risk
A FinCrimeRadar assessment, not regulator terminology. No source sets a threshold for it.
Escalate and approve
Senior management approval is statutory in some paths, such as 33(3A)(e) and 34(1)(d), and good practice in others. [1][14]
Choose the outcome
Ordinary continuation, enhanced continuation, conditional or restricted continuation, discretionary decline or exit, or mandatory decline or termination.
Execute the exit, if there is one
Notice, reasons, complaint information and the tipping-off check. Reached only when an exit is on the table.
Record the decision
Facts, assumptions, indicators, mitigants, decision and rationale, in that order.
The legal check comes early because it can end the analysis. If the regulation 28 measures cannot be applied, the firm does not get to weigh residual risk. It applies regulation 31.
What the text settles, and what it does not
Three questions come up in every review. What does the law fix? What is guidance? What is open?
Established
Regulation 33(1)(b) now applies to a “FATF call for action country”. Before 30 June 2026 the definition covered both FATF lists. [2][1] Regulation 34(1) applies to a payments correspondent with a respondent from a third country, meaning a state other than the UK. [1] Regulation 34(2) prohibits shell bank relationships. In a Call for Action case regulation 33(3A) fixes the EDD content. [1] For a politically exposed person regulation 35(5) adds senior management approval, source of wealth and funds, and enhanced monitoring. [1]
Guidance and Industry position
The FATF guidance on financial inclusion, the FCA de-risking page and the FCTR examples are not rules. [9][13][14] The FATF says it does not call for enhanced due diligence on Increased Monitoring jurisdictions. [10] JMLSG says firms should document the rationale for additional measures they undertake or waive. [15] The current JMLSG text pre-dates SI 2026/621. [15] In February 2025 the FATF amended Recommendation 1 to stress proportionate measures and to require countries to allow and encourage simplified measures in lower risk cases. [12]
FATF list status, as at 19 June 2026
The FATF publishes two lists and the tiers matter. The Call for Action list, as at 19 June 2026, names three jurisdictions in two tiers: countermeasures for two, and enhanced due diligence “and not countermeasures” for one. [11] The Increased Monitoring list is a separate, larger list of jurisdictions working with the FATF on action plans. [10] Both change at each plenary, and the statute follows the Call for Action list “as such list has effect from time to time”. [1] Date-stamp any list position you rely on.
The stated purpose of the change. HM Treasury’s Explanatory Memorandum, a separate document from the Explanatory Note printed with the Regulations, describes an objective of a more risk based and proportionate approach, including narrowing mandatory EDD for high-risk jurisdictions to the Call for Action list. [3] The Regulations do not state that purpose, and the objective is the Treasury’s, not the wording or effect of the amendment. [2]
Five points the text does not settle
On each of these, careful practitioners can read the same words differently. The guide gives both readings, says what they share, and says where the firm must decide with legal advice and record why.
In the worked scenarios below, the recommended step holds however the five are resolved. Where a choice between continuing and exiting does turn on one of them, the guide says so. One thing also holds however the five are resolved: where regulation 51C(c) applies, regulation 51B(1) does not apply, so no 51B notice is due. The contract’s own notice terms and any 51A period may still apply, and 51C(c) removes only the 51B(1) requirement and the protections that depend on it. [4]
A required EDD item is missing. Does regulation 31 apply? Unknown, the text is ambiguous
Regulation 31(1) applies where a firm “is unable to apply customer due diligence measures as required by regulation 28”. [1] Regulation 3(1) defines the term to include, “where relevant, those required by regulations 29 and 33 to 37”. [1] Regulation 3(1) also defines “enhanced customer due diligence measures” as “the customer due diligence measures required under regulations 33 to 35”. [1] The qualifier and the definitions point in different directions.
Narrow
Regulation 31 bites only where the measures required by regulation 28 cannot be applied. The qualifier “as required by regulation 28” ties the trigger to those measures. They are wider than identifying and verifying: they include the purpose and intended nature of the relationship and ongoing monitoring. Regulation 33 EDD is a separate requirement, added “in addition to” them. If a mandatory EDD item stays unmet, the firm is still not applying regulation 33 as it requires.
Wide
The definition in regulation 3(1) makes required EDD and the regulation 34 measures “customer due diligence measures”, so inability to complete them engages regulation 31(1)(a) to (c): no transaction through a bank account, no new business relationship and no transaction outside a bank account, and termination of an existing relationship, subject to the 31(2) repayment proviso and the 31(3) to (5) exceptions. Legal advice and a short interim period are not statutory exceptions. The separate definition of “enhanced customer due diligence measures” is one textual argument that enhanced measures sit inside the wider term. It is an argument, not a settled answer.
What both readings agree: Mandatory EDD items cannot be ignored, and the firm must test its separate reporting duties under POCA and the Terrorism Act on the facts. The consideration of a disclosure that regulation 31(1)(d) requires follows only if regulation 31 applies.
Where they diverge: Whether regulation 31(1)(a) to (c) apply at all to an EDD-only failure. One route to the wide outcome runs through regulation 28(12), which says the extent of the regulation 28 measures must reflect the risk assessment. That is an argument about what the regulation 28 measures require. It is not a third reading.
The firm must decide with legal advice and record why. No preferred verdict in this guide rests on either reading.
How far does regulation 33(1)(c) reach? Unknown, the text is ambiguous
Regulation 33(1)(c) requires EDD “in relation to correspondent relationships with a credit institution or a financial institution”, and adds “(in accordance with regulation 34)”. [1] A “correspondent relationship” has the meaning given by regulation 34(4), which includes relationships for securities transactions. The limits “from a third country” and “involving the execution of payments” sit in regulation 34(1). [1]
Signpost
Regulation 33(1)(c) points to regulation 34 and follows its scope. For a payments relationship with a third-country respondent, the regulation 34(1) measures apply. For other relationships within the regulation 34(4) definition, no EDD duty arises from 33(1)(c) itself, although 33(1)(a) and 33(1)(g) still require EDD where the firm assesses the relationship as higher risk.
Independent trigger
Regulation 33(1)(c) applies to every relationship within the regulation 34(4) definition, including a UK institution or a securities relationship. Regulations 33(5) to (7) inform the content and extent of the EDD, and do not set them. Using the regulation 34(1)(a) to (f) content is a FinCrimeRadar template, not a textual requirement.
What both readings agree: Relationships within the regulation 34(1) scope need the regulation 34(1) measures. Higher-risk relationships outside it need EDD under 33(1)(a) or 33(1)(g). A broad reading of 33(1)(c) does not import 33(3A)(e), which is confined to the 33(1)(b) case. Establishment approval under 34(1)(d) applies to a new relationship.
Where they diverge: Whether a low-risk relationship outside the regulation 34(1) scope needs EDD at all, and how much. Doing more is not prohibited by the provisions reviewed, but the record of the risk reasoning is what defends it.
The firm must decide with legal advice and record why. No preferred verdict in this guide rests on either reading.
Is a tipping-off offence a “legal requirement” under 51B(4)? Unknown, the text is ambiguous
Regulation 51B(4) says that where a requirement in 51B(1) to (3) conflicts with “another legal requirement”, the other requirement prevails “to the extent of the conflict”. [4] The offence in POCA section 333A and Terrorism Act section 21D needs a disclosure of a specified matter and a likelihood of prejudice, and sections 333D(3) and 21G(3) give no offence where the person does not know or suspect that prejudice. [6][7]
Offence displaces the reasons duty
A tipping-off offence counts as a legal requirement, so the duty to give reasons “sufficiently detailed and specific” gives way to the extent of the conflict, and reasons may be limited to that extent.
Reasons duty stands
A tipping-off offence does not count as a legal requirement for this purpose, so the 51B(2)(a) duty to give detailed reasons stands in full and no displacement is available.
What both readings agree: The offence turns on disclosing a report or an investigation and on likely prejudice. Explaining the underlying conduct without revealing a report or an investigation may be possible, and is fact specific. Disclosure to law enforcement for the detection or investigation of an offence is a permitted purpose. [6][7] NCA contact is neither approval nor immunity and cannot waive regulation 51B.
Where they diverge: Where the only true reason for the exit is the suspicion itself and 51C(c) does not apply. A reasons statement detailed about the suspicion risks the offence. One that withholds it risks non-compliance with 51B(2)(a) if the offence is held not to be a legal requirement.
The firm must decide with legal advice and record why. No preferred verdict in this guide rests on either reading.
Is a correspondent arrangement a payment services framework contract? Unknown, the text is ambiguous
A framework contract is a contract for payment services that “governs the future execution of individual and successive payment transactions”. [4] Payment transactions between payment service providers “for their own account” are not payment services. [4] A correspondent account may carry both kinds of activity.
In scope
The arrangement is a payment services framework contract. For an indefinite-term contract entered into on or after 28 April 2026, where Part 6 applies under regulation 40(1), there is no regulation 40(7) agreement and no 51C or 51D ground applies, regulation 51B requires notice with detailed reasons, complaint and ombudsman information, and at least 90 days. Earlier contracts fall under 51A.
Out of scope
The arrangement is not one. No PSRs notice period applies, and the contract’s own termination terms and the general law govern.
What both readings agree: Check the contract for a regulation 40(7) agreement and its termination clause. Regulation 31(1)(c), the tipping-off provisions and the firm’s other AML duties apply either way. Where regulation 34(2) or 34(3) requires non-continuation, a notice period that preserves the relationship is not compatible with it.
Where they diverge: Whether a shorter period is permitted. For an urgent exit with no 51C or 51D ground, and where regulation 34(2) or 34(3) does not require non-continuation, no immediate termination action is safe on both readings. A compliant 90-day notice remains available if 51B applies.
The firm must decide with legal advice and record why. No preferred verdict in this guide rests on either reading.
Does later evidence cure an inability under regulation 31? Unknown, the text is ambiguous
Regulation 31 contains no express cure or grace provision and does not state the effect of later evidence. It applies where a firm “is unable” to apply the measures, and 31(1)(c) says it “must terminate any existing business relationship”. [1]
Prospective cure
Evidence supplied before a prohibition or termination duty has crystallised removes the trigger going forward.
Accrued duty persists
A duty that has already accrued survives later evidence, and the text does not say what then happens to it. Legal advice does not suspend the termination duty, and an approach that applies only 31(1)(a) and (b) omits the 31(1)(c) duty.
What both readings agree: There is no statutory grace period. Regulation 31(1) says the firm “is unable”, not that it “concludes” it is unable, so a firm may be unable earlier than it records, and a recorded conclusion date is not the statutory trigger. Dated requests and deadlines, and a dated escalation record, are useful on either reading.
Where they diverge: Whether later evidence cures a firm that has not yet terminated. No single action holds on both readings in that case.
The firm must decide with legal advice and record why. No preferred verdict in this guide rests on either reading.
If the answer is exit: what has to happen at the door
A sound decision can still be badly executed. Check the notice rules and the tipping-off boundary before drafting anything.
Source
Where Part 6 applies under regulation 40(1), regulation 51B applies to an indefinite-term framework contract entered into on or after 28 April 2026. It requires reasons “sufficiently detailed and specific”, provision as regulation 55(1) requires, complaint and ombudsman information, and at least 90 days. [4] Regulation 51A allows termination of an earlier contract on at least two months’ notice “if the contract so provides”. [4] Regulation 51C lists grounds on which 51B(1) does not apply. Regulation 51D disapplies the 90-day period in two listed cases and requires the notice without delay after the decision to terminate instead, subject to 51D(2), under which another legal requirement prevails to the extent of the conflict. Regulation 40(7) allows Part 6 to be disapplied only where the user is none of a consumer, a micro-enterprise or a charity, and the parties have agreed. [4]
Application
Where the firm is required by regulation 27 to apply customer due diligence and cannot apply the regulation 28 measures, 51C(a) removes the 51B(1) requirement. A discretionary exit is where 51B is likely to matter, but only if Part 6 applies under regulation 40(1), the arrangement is an indefinite-term framework contract entered into on or after 28 April 2026, there is no regulation 40(7) agreement, and no 51C or 51D ground applies. Micro-enterprise status turns on the statutory size test, applied when the contract was entered into. This guide does not apply it. Whether a correspondent arrangement is a framework contract at all is open.
Recommendation
Confirm the contract date, whether Part 6 applies to the user and whether an exemption applies, before setting the notice period. Check the reasons text against the tipping-off provisions. This is a FinCrimeRadar recommendation.
Two limits on what you say to the customer. First, the offences in POCA section 333A and Terrorism Act section 21D need a disclosure of a report or of an investigation, plus likely prejudice. Neither offence is committed where the disclosure is made for a purpose listed in section 333D(1)(b) or 21G(1)(b), or where the person does not know or suspect that it is likely to have the prejudicial effect (sections 333D(3) and 21G(3)). [6][7] Second, never telling the customer about the suspicion or the disclosure is a conservative FinCrimeRadar limit, not the statutory test. [6] The FATF Interpretive Note 10 says that if a firm reasonably believes performing the due diligence would tip off the customer, it may choose not to pursue it and should file a report. [8]
Worked scenario 1 · Correspondent respondent
The respondent that would not confirm its customer checks
A bank in a listed jurisdiction answers most of the questions and refuses the one that matters.
Composite scenario for teaching. It does not describe a real firm, respondent or customer.
The firm is a UK credit institution. The respondent is a bank established outside the UK, and the relationship involves the execution of payments.
On the FATF lists published on 19 June 2026, the respondent’s jurisdiction is under Increased Monitoring and is not on the Call for Action list. [10][11]
The respondent is not a shell bank, and no sanctions designation or other legal prohibition affects the relationship.
The firm applied its customer due diligence to the respondent as a customer.
The respondent has answered questions about its business, its supervisor and its controls. It will not confirm that it verifies and monitors the customers who have direct access to the firm’s accounts.
The annual review is due and the relationship manager wants to keep the relationship.
What the listing changes, and what it leaves
Removed as an automatic trigger
Before 30 June 2026, a relationship with a person established in a country on either FATF list triggered mandatory EDD under regulation 33(1)(b). Now only the Call for Action list does. The stated objective of the change appears in HM Treasury’s Explanatory Memorandum, not in the Regulations. [3]
Still operating
Regulation 33(1)(f), the regulation 33(6) risk factors (which the listing may inform), regulation 34 for this respondent, and the firm’s own assessment. Regulation 33(7) reminds firms that a risk factor may not always indicate high risk. [1]
The listing may be weighed under regulation 33(6)(c), 33(1)(a) and 33(1)(g). That is a FinCrimeRadar application. The statute does not name the Increased Monitoring list in those provisions.
How each option grades
Rests on one reading of an open point Terminate the relationship now. The refusal means the firm is unable to apply its due diligence measures, so regulation 31 requires termination.
Source
Regulation 31(1) applies where a firm “is unable to apply customer due diligence measures as required by regulation 28”, and regulation 3(1) defines those measures to include, “where relevant, those required by regulations 29 and 33 to 37”. [1]
Application
Whether a gap in the regulation 34 respondent measures is inability under regulation 31 is not settled by the text. One reading confines regulation 31 to the regulation 28 measures. The other lets the regulation 3(1) definition bring regulation 34 in. A verdict that terminates on the second reading alone cannot be scored as correct.
Recommendation
Treat the gap as a potential regulation 31 event, take legal advice on which reading to adopt, and record the choice. This is a FinCrimeRadar recommendation.
Not supported on the text Continue unchanged. The jurisdiction is under Increased Monitoring, not on the Call for Action list, so enhanced measures are not required.
Source
From 30 June 2026, regulation 33(1)(b) applies to a “FATF call for action country”. Before that date the definition covered both FATF lists. [2][1] The FATF page for Increased Monitoring says it does not call for enhanced due diligence on those jurisdictions. [10] Regulation 34(1) separately applies to a third-country respondent in a payments relationship, and “third country” means a state other than the UK. [1]
Application
The change removes one automatic trigger. It does not remove regulation 34(1), which applies to this respondent, or the firm’s own assessment of higher risk. The missing confirmation is a regulation 34(1)(f) point, and this option ignores it.
Recommendation
Do not treat the list position as the decision. Record what the listing changes and what it leaves in place.
Supported on the text, whichever reading applies Escalate to legal and the MLRO, apply the measures the firm can complete, treat the gap as a potential regulation 31 event, and record the reading adopted and why.
Source
Regulation 34(1)(a) to (f) list the measures for a third-country payments correspondent, and (f) covers the respondent’s verification and monitoring of customers with direct account access. [1] JMLSG Part I 4.77 says firms should document the rationale for additional due diligence measures they undertake or waive. That is an industry position, not law. [15]
Application
The gap sits in 34(1)(f), and the text does not say whether it engages regulation 31. The recommended step therefore holds on both readings. The choice between continuing and exiting does depend on the reading. On the wide reading, while the inability persists, regulation 31 bars transactions through a bank account and requires termination. On the narrow reading regulation 31 does not apply to the gap, and continuing on conditions or exiting is a risk decision. Escalation, a dated record of what was asked and answered, and a record of the reading adopted stay sound on both.
Recommendation
Escalate, take advice, and record the reading and the reason. That step is the same on both readings. Choose continuation or exit once the advice is in, because the choice follows the reading adopted. This is a FinCrimeRadar recommendation. It does not decide the regulation 31 question.
Rests on one reading of an open point Continue with restricted payment types and enhanced monitoring, and keep asking for the missing confirmation. Regulation 31 cannot apply to a gap in respondent information.
Source
Regulation 31(1)(a) bars transactions through a bank account. Regulation 31(1)(b) bars establishing a business relationship, or carrying out a transaction, with the customer otherwise than through a bank account. Regulation 31(1)(c) requires termination of an existing relationship. All apply where the inability condition is met. [1]
Application
If a regulation 34 gap is inability under regulation 31, continuing with restrictions still carries out transactions and does not terminate. That reading is open, so continuing on the view that regulation 31 cannot apply rests on one reading. Legal advice and a short interim period are not statutory exceptions to regulation 31(1)(a) to (c) on the wide reading.
Recommendation
Restrictions and monitoring do not answer the regulation 31 question. Take legal advice, record the reading adopted, and keep any interim period short and dated. This is a FinCrimeRadar recommendation.
Counterfactual: change one fact
The respondent’s jurisdiction moves onto the Call for Action list, in its enhanced due diligence tier. As at 19 June 2026, that was Myanmar’s position: the FATF called for enhanced due diligence “and not countermeasures”. [11] Regulation 33(1)(b) then requires EDD, and regulation 33(3A) fixes its content, including senior management approval. [1] Regulation 33 does not itself mandate exit. For the two jurisdictions in the countermeasures tier, the FATF calls for measures that include correspondent relationship steps. Whether UK law implements them is outside this guide. The FATF said that if there is no further progress on Myanmar by October 2026 it will consider countermeasures. [11] Date-stamp any list position you rely on.
What Would Change My Decision?
Towards exit: Evidence that the respondent is a shell bank, or allows its accounts to be used by one. [1] A refusal that means the firm cannot apply the regulation 28 measures to the respondent as a customer. A sanctions designation or other legal prohibition, which is outside this guide.
Towards continuation: Written confirmation, with evidence, that the respondent verifies and monitors its direct-access customers and can supply the CDD information on request. Better evidence of supervision. A recorded legal view on the open point.
Decision Record
Facts
Payments correspondent, third-country respondent, Increased Monitoring jurisdiction as at 19 June 2026, no shell bank concern, no prohibition. Direct-access customer checks unconfirmed.
Assumptions
The refusal is a refusal and not a delay. The firm has asked in writing and dated the request.
Indicators
A gap in regulation 34(1)(f) information on a payments relationship. A listing that may inform the risk assessment.
Mitigants
Applied customer due diligence on the respondent, answers on business, supervision and controls, and a willing relationship owner.
Decision
No outcome fixed. Escalated for advice, with the reading of regulation 31 recorded and a short dated review.
Rationale
The text does not say whether the gap engages regulation 31, so the recommended step is the same on both readings. The choice between continuing and exiting depends on the reading adopted. The record shows what was asked, what was answered and why the firm chose its route.
Worked scenario 2 · UK customer, two branches
One customer type, two different questions
Everything turns on one fact: can due diligence be completed? If it cannot, the law takes over. If it can, judgement has to carry the decision.
Both branches use a UK payment account under an indefinite-term contract entered into after 28 April 2026. The first branch is a regulation 31 case. The second is a discretionary decision. If it ends in exit, regulation 51B applies only where Part 6 applies under regulation 40(1), the contract is an indefinite-term framework contract entered into on or after 28 April 2026, there is no regulation 40(7) agreement and no 51C or 51D ground applies. Each branch has its own decision and Decision Record. [4]
Worked scenario 2, first branch · UK customer, due diligence cannot be completed
The remittance business whose owner cannot be identified
Where the law fixes the answer, the job is to apply it without dressing it up as a risk call.
Composite scenario for teaching. It does not describe a real firm, respondent or customer.
The customer is a company that runs a small money remittance service and holds a payment account under an indefinite-term contract entered into after 28 April 2026.
The firm cannot identify and verify a beneficial owner under regulation 28(4), after trying alternative ways to establish who owns the company and checking whether the problem is missing documents rather than missing ownership information.
The scenario stipulates that the firm is applying customer due diligence to this existing customer at an appropriate time on a risk based approach, which is an occasion within regulation 27(8)(a). The regulation does not itself say that any particular review is such a time. [1]
The firm has no suspicion, and no disclosure has been made.
The customer belongs to a segment the FCA names as often affected by de-risking. [13]
How each option grades
Supported on the text, whichever reading applies Make no transaction through a bank account and no relationship or transaction outside one, terminate, repay deposited funds only as regulation 31(2) permits, and consider a disclosure.
Source
Regulation 31(1)(a) bars transactions through a bank account. Regulation 31(1)(b) bars establishing a business relationship, or carrying out a transaction, with the customer otherwise than through a bank account. Regulation 31(1)(c) requires termination of an existing relationship, and 31(1)(d) requires the firm to consider a disclosure under the Terrorism Act or POCA. Regulation 31(2) permits repayment of deposited money, with consent where a disclosure is required. [1] Regulation 51C(a) removes the 51B(1) notice requirement where the firm is required by regulation 27 to apply customer due diligence measures and is unable to apply them as regulation 28 requires, which is this case on the stipulated facts. [4] JMLSG Part I 5.2.7 asks firms to consider whether the problem is missing documents. [15]
Application
The facts fit the plain regulation 28 case, so the open point about EDD-only failures does not arise, and the inability already persists, so the firm is not waiting on a cure. The firm has tested the document explanation.
Recommendation
Apply regulation 31, use the 31(2) proviso for any repayment, record why the firm is unable, and make the disclosure consideration required by 31(1)(d). This is a FinCrimeRadar recommendation on the statutory text.
Not supported on the text Continue on enhanced terms. The ownership risk can be managed with enhanced monitoring and lower limits, so identifying the owner is not needed.
Source
Regulation 28(4) requires the firm to identify the beneficial owner and take reasonable measures to verify identity. Regulation 31(1)(a) to (c) apply where the firm “is unable to apply customer due diligence measures as required by regulation 28”. [1]
Application
Enhanced measures are added to the regulation 28 measures. They do not replace identification, so enhanced terms cannot cure the inability on these facts.
Recommendation
Do not use enhanced monitoring as a substitute for identifying the owner. Treat the case as a regulation 31 case.
Not supported on the text Terminate on 90 days’ notice under the payment services rules, keep the account open and transacting while it runs, and note that the owner could not be identified.
Source
Regulation 51C(a) says 51B(1) does not apply where the payment service provider is required by regulation 27 to apply customer due diligence measures and is unable to apply them as regulation 28 requires. [4] Regulation 31(1)(a) bars transactions through a bank account. [1]
Application
A 90-day continuing relationship is not what the plain regulation 31 words allow. On the stipulated facts both 51C(a) conditions are met: the firm is applying customer due diligence at an occasion within regulation 27(8)(a) and is unable to apply it as regulation 28 requires, so the 51B notice duty is not engaged.
Recommendation
Do not build the exit around a 51B notice period. Check the contract only for how the termination is communicated.
Not supported on the stated facts Ask for the ownership evidence again and keep the account open and transacting while the customer replies, because the firm has not yet concluded that it is unable to comply with regulation 28.
Source
Regulation 31 contains no express cure or grace provision and does not state the effect of later evidence. Regulation 31(1)(a) to (c) apply where the firm “is unable to apply customer due diligence measures as required by regulation 28”. [1]
Application
On the stated facts the firm has already tried alternatives and remains unable, so the inability already persists. While it persists, regulation 31(1)(a) bars transactions through a bank account and 31(1)(c) requires termination, so keeping the account open and transacting while waiting is not supported. What follows if the customer later supplies evidence is the open cure-timing point, dealt with in the counterfactual. It does not make waiting supported when the inability already exists.
Recommendation
Apply regulation 31 on the facts as they stand, and reassess if evidence arrives. Keep a dated record of every request and reply, and do not treat the date the firm records as the date it became unable. This is a FinCrimeRadar recommendation.
Counterfactual: change one fact
The customer supplies the missing ownership evidence. The inability condition may end. If it ends before a prohibition or termination duty under regulation 31 has crystallised, the trigger is removed going forward. The text does not say what happens to a duty that has already accrued. On that footing regulation 31 mandates no particular outcome, and the firm reassesses on the completed due diligence. The result is not fixed by the regulation.
What Would Change My Decision?
Towards a different duty: Evidence supplied before any duty has crystallised, which may end the inability. Suspicion about why the ownership was concealed, which brings in the reporting route.
Towards the same outcome: Evidence that arrives after the firm has concluded it is unable and has acted on that conclusion.
Decision Record
Facts
Beneficial owner cannot be identified and verified under regulation 28(4) after alternatives, at an occasion the scenario stipulates under regulation 27(8)(a). No suspicion. Indefinite-term contract entered into after 28 April 2026.
Assumptions
The firm has checked whether the difficulty is missing documents. The requests were written and dated.
Indicators
Persistent inability, in a segment the FCA names as often affected by de-risking.
Mitigants
None that replaces identification of the owner.
Decision
Apply regulation 31: no transaction through a bank account and no relationship or transaction outside one, terminate, repay only as 31(2) permits, and consider a disclosure.
Rationale
The regulation applies on its own words to the regulation 28 measures. On the stipulated facts both 51C(a) conditions are met (the firm is applying customer due diligence at a regulation 27(8)(a) occasion and is unable to apply it as regulation 28 requires), so 51C(a) removes the 51B notice requirement and the decision does not depend on the open framework contract point.
Worked scenario 2, second branch · UK customer, discretionary decision
The charity whose risk stays high after everything the firm has tried
Due diligence is complete and nothing forces the outcome. This is a judgement, and it has to be a recorded one.
Composite scenario for teaching. It does not describe a real firm, respondent or customer.
The customer is a charity within the PSRs Part 6 meaning, and it holds a payment account under an indefinite-term contract entered into after 28 April 2026. No regulation 40(7) agreement exists.
Due diligence is complete. Cross-border flows to jurisdictions the firm assesses as higher risk leave residual risk high after the mitigants the firm has considered.
The enhanced due diligence and enhanced ongoing monitoring that the higher-risk flows require are in place and are adequate for the risk the firm has assessed.
The firm has no suspicion, and no disclosure has been made.
The customer belongs to a segment the FCA names as often affected by de-risking. [13]
How each option grades
Not supported on the text Give 30 days’ notice and exit now. High residual risk is enough on its own, and no mitigant needs to be tested first.
Source
Where regulation 51B applies, the notice must contain reasons “sufficiently detailed and specific”, be provided as regulation 55(1) requires, give complaint and ombudsman information, and be given at least 90 days before termination takes effect. [4][5] The FCA says it expects few cases where declining solely for anti-money laundering reasons is necessary. [13]
Application
Whether the 51B conditions are met depends on Part 6 applying under regulation 40(1), the contract being an indefinite-term framework contract entered into on or after 28 April 2026, no regulation 40(7) agreement, and no 51C or 51D ground. If they are met, thirty days falls short of 51B(3). The decision to exit is discretionary, and the FCA says relatively few cases need declining solely for anti-money laundering reasons.
Recommendation
Do not fix the notice period until you have confirmed whether 51B applies. Treat high residual risk as a reason to test the mitigants first.
Supported on the text, whichever reading applies Test whether each mitigant works and can be run, record why it does or does not reduce the risk, then choose conditions or exit and check the notice rules.
Source
The FATF guidance lists mitigating options to try before rejection. [9] FCTR 12.3.7G, which is guidance, treats failing to follow up outstanding due diligence information as poor practice. [14] Regulations 51A to 51D set the notice conditions. [4] JMLSG Part I 4.77 asks firms to document the rationale for additional measures they undertake or waive. [15]
Application
The discretionary decision is open on these facts. Capacity and cost do not themselves create an AML statutory duty to exit, but they may inform a commercial decision, subject to other applicable law. If exit follows and the 51B conditions are met (Part 6 applying under regulation 40(1), an indefinite-term framework contract entered into on or after 28 April 2026, no regulation 40(7) agreement and no 51C or 51D ground), the plan needs 90 days, detailed reasons and the complaint and ombudsman information.
Recommendation
Record the rationale for each mitigant. If exit follows and the 51B conditions are met, draft the reasons and plan the 90 days first. This is a FinCrimeRadar recommendation.
Not supported on the text Do not exit. FATF guidance says a relationship may be ended only where the risk cannot be mitigated, so the firm may not exit while any mitigant is still available.
Source
Paragraph 142 of the FATF guidance says regulated entities are only required to terminate or reject relationships case by case where risks cannot be mitigated. It is non-binding guidance. [9][12] On these facts, where due diligence is complete, the refuse or terminate consequence in Recommendation 10 is not engaged, because it turns on inability to comply with the due diligence requirements. Recommendation 13 separately deals with correspondent banking and shell banks. [8] The FCA calls the decision “ultimately a commercial one for the bank”. [13]
Application
FinCrimeRadar assessment: the guidance may shape what a supervisor expects the firm to have tried. It does not remove the firm’s discretion where due diligence is complete. This option treats guidance as a bar.
Recommendation
Use paragraph 142 as a list of options to try before rejection. Do not cite it as a legal prohibition.
Supported on the text but incomplete Keep the account unchanged. Due diligence is complete, so the risk is managed and nothing further needs to be tested or recorded.
Source
Regulation 28(11) requires ongoing monitoring, and 28(12) says the extent of the measures must reflect the risk assessment. [1] FATF Interpretive Note 1 expects enhanced measures where higher risks are identified. [8]
Application
Complete due diligence, with the required EDD and enhanced monitoring in place and adequate, is an input, not an answer. Residual risk is stated as high after those measures, so leaving everything as it is leaves the decision unmade. Keeping may still be right if the record supports it.
Recommendation
Record why the residual risk is acceptable, or the condition that would change it.
Counterfactual: change one fact
A suspicion arises, for example unexplained third-party funding. Regulation 51C(c) applies only if both conditions are met: the firm has reasonable grounds to suspect, and the suspicion is that a payment service under the contract has been, is being or will be used in connection with serious crime. [4] Where it applies, 51B(1) does not apply, which removes the 51B notice protections for the user. It neither requires nor authorises exit by itself. The contract’s own notice terms and any 51A period may still apply. The reporting route is separate, and what the firm may say to the customer runs into the open tipping-off point.
What Would Change My Decision?
Towards keeping, on conditions: Independent verification of the flows, a reduction in exposure to the jurisdictions the firm assesses as higher risk, and mitigants the firm can show it runs.
Towards exit: Mitigants that cannot be verified or run, or adverse information about the customer. Any suspicion, which changes the duties as well as the decision.
Decision Record
Facts
Complete due diligence, with required EDD and enhanced monitoring in place and adequate. Residual risk high after mitigants. Indefinite-term contract entered into after 28 April 2026. Customer is a charity within the Part 6 meaning. No suspicion.
Assumptions
The mitigants considered are the ones realistically available to the firm.
Indicators
Cross-border flows to jurisdictions the firm assesses as higher risk.
Mitigants
Complete due diligence, enhanced monitoring and any conditions the firm can attach to the account.
Decision
Test and record each mitigant, then choose conditions or exit. If exit, and the 51B conditions are met, plan 90 days, detailed reasons and the complaint and ombudsman information.
Rationale
Nothing forces the outcome, so the defence is the record: what was tried, why it did or did not work, and why the firm chose keep, restrict or exit.
Five reasoning traps
These are not five typologies. They are five ways a sound process produces an indefensible decision.
1. The List as Verdict
A jurisdiction listing is treated as the decision.
Risk
A relationship is kept or exited because a country sits on, or has left, a FATF list.
Signal
The rationale names the list and nothing about the respondent or the customer.
Response
Record what the listing changes in the law, what it leaves in place, and the firm’s own assessment. Date-stamp the list.
2. The Borrowed Reading
One reading of a contested provision is adopted without saying so.
Risk
An outcome is presented as required by a provision whose scope the text leaves open.
Signal
The record says “regulation 31 requires” or “regulation 31 does not apply” with no mention of the alternative.
Response
State the open point, name both readings, take advice and record the reading adopted and why.
3. The Capacity Alibi
Operational strain is offered as the reason for refusing or exiting.
Risk
A relationship is ended because the firm cannot resource the controls, and the file says the risk was too high.
Signal
The mitigants are never tested, and the rationale rests on workload.
Response
Test each mitigant on its merits. Record capacity as a practical input. It creates no AML duty to exit, but may inform a commercial decision, subject to other applicable law.
4. The Silent Exit
The exit is executed without checking what the door requires.
Risk
A notice period, reasons or complaint information are wrong, or the customer is told more than the tipping-off provisions allow.
Signal
The notice was drafted before anyone checked the contract date, Part 6 and the exemptions.
Response
Confirm the contract conditions and the exemptions first. Check the reasons text against the tipping-off provisions.
5. Guidance Promoted to Law
FATF, FCA or industry text is quoted as if it were a statutory rule.
Risk
A firm refuses to exit because “FATF says so”, or exits because an industry guidance paragraph uses the word must.
Signal
The rationale cites guidance with no statutory provision beside it.
Response
Label each source: statute, guidance or industry position. Pair guidance with the provision that carries the duty.
One Screen Operational Summary
TriggerA higher-risk correspondent or customer relationship reaches review, onboarding or an alert.
RiskIdentify the customer, geography, product, channel and transaction risk.
Law firstCheck regulation 31 on its plain terms, regulation 34(2) and regulation 33(1)(b).
MitigantsTest which measures work and whether the firm can run them.
Residual riskAssess it and label it as the firm’s own assessment.
EscalateTake senior management approval where the law requires it and where good practice expects it.
OutcomeKeep, restrict or exit, from the five outcomes.
Open pointsIf one of the five applies, name both readings, take advice and record the reading adopted.
ExitCheck the notice conditions, the exemptions and the tipping-off boundary before drafting.
RecordWrite the Decision Record so another analyst could reach the same outcome.
Red Team Questions
Have we said what the listing changes in the law, or only that a listing exists?
Are we relying on one reading of an open point without saying so?
Would an independent reviewer see the mitigants we tested and why each did or did not work?
Is capacity or cost doing work in the rationale that only risk should do?
Have we checked which notice conditions apply before we set the period?
Does the customer letter explain the reasons without revealing a report or an investigation?
Have we kept guidance, industry position and statute visibly apart?
Would another competent analyst reach the same outcome from the Decision Record?
A relationship decision is defended by its record, not by its outcome.
Knowledge check
Choose one answer for each question. The score is an aid to review, not a credential or a case decision.
Answer notes
Question 1.Source: Regulation 33(1)(b) now applies to a business relationship or relevant transaction involving a person established in a “FATF call for action country”. [2][1]Application: The trigger is the establishment link to a Call for Action country, not a listing alone. The amendment removes Increased Monitoring as an automatic trigger. The firm may still weigh a listing in its own assessment. Recommendation: Update jurisdiction triggers and record what the listing does and does not change.
Question 2.Source: Regulation 34(1)(a) to (f) list those measures for a respondent from a third country. [1]Application: Regulation 33(3A) governs the content of EDD in the Call for Action case, and 51B, where it applies, governs termination notices. Recommendation: Map each respondent measure to its provision before scoring a relationship.
Question 3.Source: Regulation 51C says regulation 51B(1) does not apply where its listed conditions are met. [4]Application: The contract’s own notice terms and any 51A period may still apply, and 51C(c) neither requires nor authorises exit. Recommendation: Record why 51C(c) is met, and check the contract and any 51A period separately.
Question 4.Source: The paragraph sits in FATF guidance. [9] Recommendation 10 ties refusal or termination to inability to comply with the due diligence requirements, and Recommendation 13 separately covers correspondent banking and shell banks. [8]Application: FinCrimeRadar assessment: the guidance may shape what a supervisor expects the firm to have tried. It does not itself impose a duty. Recommendation: Cite the guidance beside the statutory provision that carries the duty.
Question 5.Source: Regulation 34(2) and regulation 31(1)(c) state their duties in terms. [1] The reach of regulation 31 to an EDD-only failure depends on how the definition in regulation 3(1) meets the qualifier in regulation 31(1). Application: Two readings are open. The recommended step in each scenario holds on both, and where the choice between continuing and exiting turns on the reading, the guide says so. Recommendation: Where the text is open, take advice and record the reading adopted and why.
The Radar View
Signal
From 30 June 2026 the mandatory jurisdiction trigger in regulation 33(1)(b) attaches to the Call for Action list only. [2][1] The Explanatory Memorandum gives the stated objective as narrowing mandatory EDD for high-risk jurisdictions to that list. [3]
Exposure
Procedures that still refer to both lists, and guidance that pre-dates the change. The current published JMLSG Part I and Part II were updated in August and December 2025 and still use the earlier “high-risk third country” wording. [15]
Control
Separate the listing from the decision, keep dated records, and state the open points with both readings rather than picking one.
Watch
FATF list changes at each plenary, including the Myanmar position by October 2026. [11] JMLSG conforming its text to the change. Any authority that settles one of the five open points.
Risk, Signal, Response
1. The List as Verdict
A jurisdiction listing is treated as the decision.
Risk
A relationship is kept or exited because a country sits on, or has left, a FATF list.
Signal
The rationale names the list and nothing about the respondent or the customer.
Response
Record what the listing changes in the law, what it leaves in place, and the firm’s own assessment. Date-stamp the list.
2. The Borrowed Reading
One reading of a contested provision is adopted without saying so.
Risk
An outcome is presented as required by a provision whose scope the text leaves open.
Signal
The record says “regulation 31 requires” or “regulation 31 does not apply” with no mention of the alternative.
Response
State the open point, name both readings, take advice and record the reading adopted and why.
3. The Capacity Alibi
Operational strain is offered as the reason for refusing or exiting.
Risk
A relationship is ended because the firm cannot resource the controls, and the file says the risk was too high.
Signal
The mitigants are never tested, and the rationale rests on workload.
Response
Test each mitigant on its merits. Record capacity as a practical input. It creates no AML duty to exit, but may inform a commercial decision, subject to other applicable law.
4. The Silent Exit
The exit is executed without checking what the door requires.
Risk
A notice period, reasons or complaint information are wrong, or the customer is told more than the tipping-off provisions allow.
Signal
The notice was drafted before anyone checked the contract date, Part 6 and the exemptions.
Response
Confirm the contract conditions and the exemptions first. Check the reasons text against the tipping-off provisions.
5. Guidance Promoted to Law
FATF, FCA or industry text is quoted as if it were a statutory rule.
Risk
A firm refuses to exit because “FATF says so”, or exits because an industry guidance paragraph uses the word must.
Signal
The rationale cites guidance with no statutory provision beside it.
Response
Label each source: statute, guidance or industry position. Pair guidance with the provision that carries the duty.
FAQ
Does a FATF Increased Monitoring listing still mean enhanced due diligence?
Not automatically. Since 30 June 2026 regulation 33(1)(b) applies through a person established in a Call for Action country, and the Increased Monitoring list is no longer an automatic trigger. [2] The FATF says it does not call for enhanced due diligence on Increased Monitoring jurisdictions, and encourages firms to take the information into account in their risk analysis. [10] A firm can still weigh a listing under its own assessment.
Is de-risking prohibited?
The sources read do not prohibit it. The FCA says effective risk management does not need to end in wholesale de-risking, and that the decision to accept or maintain a relationship is ultimately a commercial one. [13] The FATF describes wholesale cutting loose of entire classes of customers as contrary to the risk-based approach. [9]
Does the FATF say a firm may exit only where the risk cannot be mitigated?
Paragraph 142 of the FATF guidance says that regulated entities are only required to terminate or reject relationships, case by case, where risks cannot be mitigated. It is guidance. [9] For a customer where due diligence is complete, the refuse or terminate consequence in Recommendation 10 is not engaged, because it turns on inability to comply with the due diligence requirements. Recommendation 13 separately deals with correspondent banking and shell banks. [8]
Can a firm tell a customer why it is exiting them?
It depends on the reason. The tipping-off offences need a disclosure of a report or an investigation and a likelihood of prejudice, and sections 333D(3) and 21G(3) give no offence where the person does not know or suspect that prejudice. [6][7] Where the only true reason is a suspicion and 51C(c) does not apply, the text leaves the point open.
Does a correspondent exit need a 51B notice?
Only if the arrangement is an indefinite-term payment services framework contract entered into on or after 28 April 2026, Part 6 applies under regulation 40(1), there is no regulation 40(7) agreement, and no 51C or 51D ground applies. Whether a correspondent arrangement is such a contract is an open point. [4]
Why does this guide leave five points open?
Because the text does not settle them. Each is set out with both readings, what both agree on and where the firm must decide with legal advice. The recommended steps in the scenarios hold on either reading, and where a continue-or-exit choice turns on the reading, the guide says so.
Sources and methodology
Scope: UK relationship decisions under the Money Laundering Regulations 2017 as amended through SI 2026/621, with the payment services termination rules that apply at exit. It does not cover sanctions, the Consumer Duty or other jurisdictions. This is decision support for practitioners, not legal advice.
Method: Statutory text was read from legislation.gov.uk on 21 September 2026. FATF documents were read from fatf-gafi.org, including the Recommendations as updated in June 2026. FCA material was read from the FCA website and Handbook, and JMLSG Part I and Part II from the current published PDFs. The two scenarios are composites written to test judgement. They do not describe real customers or predetermine an outcome.
Evidence separation: Source blocks state what an authority establishes. Application blocks are FinCrimeRadar analysis of the composite facts. Recommendation blocks are operational judgements, and they are labelled as ours where they go beyond the text.
Limits: The five open points are presented as open because the sources listed do not settle them. Some provisions were read only for the parts this guide uses, and the text of the wider POCA and Terrorism Act reporting duties was not analysed. Draft JMLSG revisions awaiting Treasury approval were not used.
Last reviewed: 21 September 2026. Recheck after each FATF plenary, when JMLSG conforms its text to SI 2026/621, and if any authority settles one of the five open points.