De-Risking Does Not Reduce Money Laundering Risk. It Relocates It.

De-risking does not reduce money laundering risk. It relocates it to corridors with less visibility.

When a correspondent bank terminates a relationship with a regional or community bank, or with an entire class of customers, the underlying financial activity rarely disappears. It moves to a different correspondent relationship, to a money services business, to an informal value transfer network, or to a jurisdiction with weaker monitoring infrastructure. FATF guidance has made this point for a decade. De-risking is not a risk mitigation strategy. It is a risk transfer strategy, and the destination usually has less transparency than the relationship that was terminated.

The well-documented FinCEN Files investigation illustrated exactly how this plays out inside the correspondent relationships that remain. Across the sample of suspicious activity reports reviewed, information about at least one participating entity was missing in roughly half of all filings. Requests for additional information about underlying corporate vehicles went unanswered in roughly thirteen percent of cases. The funds were processed anyway. A correspondent bank is not obligated to perform due diligence on the respondent bank’s underlying clients; that obligation sits with the respondent. When the respondent’s due diligence is weak, the correspondent’s exposure is real but largely invisible until after the fact.

This gap between technical compliance and actual effectiveness shows up in the data too. FATF mutual evaluations rate the large majority of jurisdictions as compliant or largely compliant on the correspondent banking standard itself. Far fewer demonstrate substantial effectiveness on the beneficial ownership transparency that makes the standard meaningful in practice. Being compliant on paper and being effective in practice are not the same exercise, and the gap between them is where the risk actually lives.

If your institution has terminated correspondent relationships or entire customer classes in recent years, tracing where that activity went is worth the exercise. The risk did not disappear. It just stopped being visible.