October 28, 2026

Exiting a High-Risk Customer: De-Risking Without Defensive SARs

Axle Team

Key takeaways

The exit decision and the SAR decision are separate. Closing an account doesn't satisfy, replace, or delay a SAR obligation, and a planned exit isn't a reason to file one.
Put decision rights in writing: who can recommend an exit, who approves it, and when legal and the SAR committee have to be in the room.
Exit memos should name specific financial crime risks and the controls you considered. After the 2026 OCC/FDIC reputation-risk rule, "reputational concerns" is a weak rationale on its own.
Customers can be told a closure may relate to suspected fraud or suspicious activity. They cannot be told, or led to infer from you, that a SAR was filed.
The exit isn't done when the account closes. Exited parties should be screened at onboarding so they don't come back through a new entity.

A high-risk customer exit strategy for AML teams

Short answer: A defensible high-risk customer exit strategy for AML separates the exit decision from the SAR decision, documents the specific financial crime risk that can't be mitigated, routes approval through a named committee, gives notice without revealing any SAR, screens before returning funds, and screens exited parties at future onboarding.

Most institutions have a de-risking process. Fewer have one that holds up when an examiner pulls five exits at random and asks why each one happened, who approved it, and whether the SAR timeline was met. That is the standard to design against.

Who decides

The FFIEC manual already sets the governance expectation for the most common exit trigger, repeat SAR filings. Banks should have procedures that include:

"Review by senior management and legal staff (e.g., BSA compliance officer or SAR committee). Criteria for when analysis of the overall customer relationship is necessary. Criteria for whether and, if so, when to close the account. Criteria for when to notify law enforcement, if appropriate."
— FFIEC BSA/AML Examination Manual, Suspicious Activity Reporting

A workable split of decision rights looks like this:

Investigator or EDD analyst: Documents the risk facts and recommends exit, retain with conditions, or retain
Relationship owner: Supplies commercial context and any customer explanations; does not approve
BSA officer or SAR committee: Approves or rejects the recommendation; confirms SAR status
Legal: Reviews notice language, contract terms, and any law enforcement keep-open request
Operations: Executes closure, final screening, and disbursement

Keep the relationship owner out of the approval chain. Their input matters. Their sign-off creates the appearance that revenue decided the outcome.

Timing relative to SAR filing

Treat the SAR and the exit as two clocks. If the activity that prompted the exit meets the SAR threshold, the 30-day filing deadline runs from the determination that the activity is suspicious. Closing the account doesn't stop that clock. If the activity doesn't meet the threshold, the exit alone doesn't create a filing obligation. Filing a "defensive" SAR to paper the closure adds noise for law enforcement and creates a SAR record with nothing reportable in it.

FinCEN's October 2025 FAQs also removed a common reason for keeping a risky relationship open while you deliberate:

"A financial institution is not required to conduct a separate review—manual or otherwise—of a customer or account following the filing of a SAR to determine whether suspicious activity has continued."
— FinCEN and federal banking agencies, SAR FAQs, October 2025

The opposite case is a law enforcement request to keep the account open. The FFIEC manual says to get it in writing, with the purpose and duration, and adds: "Ultimately, the decision to maintain or close an account should be made by a bank in accordance with its own standards and guidelines." Diary the expiry date. A keep-open letter that lapsed six months ago is not cover.

Notice language

The September 2026 joint statement on SAR confidentiality gave front lines clearer room to speak. Among the permitted communications it lists: "Notifying a customer that a delay, limitation, or restriction on an account or service or closure of an account may be related to suspected fraud or other suspicious activity." What stays off-limits is anything that reveals a SAR exists.

"The BSA prohibits the disclosure of a SAR or information that would reveal the existence of a SAR, including to a customer or other person who is the subject of the SAR."
— FinCEN, Federal Reserve, FDIC, NCUA and OCC, Joint Statement on SAR Confidentiality

Practical notice letters stay short: the closure date, the contractual basis, how the balance will be returned, and a single sentence on the reason if your policy allows one. Never write "due to a regulatory filing" or "we are required to report." Script the call center the same way, because customers call.

Returning funds

Run a final sanctions screen on the customer, signers, and the disbursement payee before any money leaves. Send the balance to the customer, not to a third party they nominate, using a method your policy specifies, such as a cashier's check to the verified address.

If the final screen produces a true match, the funds are not returned. They are blocked, and the 10-business-day initial blocking report under 31 CFR 501.603 applies. Your exit procedure should hand off to the sanctions team at that point rather than improvise.

The 2026 reputation-risk rule and your exit rationale

In April 2026 the OCC and FDIC finalized a rule removing reputation risk from supervision (91 FR 18279, effective June 9, 2026). It binds the agencies, not your credit or risk decisions. But it changes how an exit memo reads. The preamble says the rule was a response to concerns in Executive Order 14331 and addresses BSA directly:

"The rule prohibits supervisors from using BSA and anti-money laundering concerns as a pretext for reputation risk."
— OCC and FDIC, Prohibition on the Use of Reputation Risk by Regulators, 91 FR 18279

The same preamble says the rule doesn't affect OFAC-driven prohibitions and rejections. The practical point for BSA officers: an exit memo that leans on "reputational concerns" or on the customer's industry alone is weaker in 2026 than it was in 2024. Ground it in observed activity, unresolved EDD gaps, unverifiable source of funds, or controls you can't apply. Note the mitigations you considered, such as product restrictions or volume limits, and why they weren't enough.

A seven-step exit workflow

Investigator documents risk facts and a recommendation in the case file.
SAR status is confirmed: filed, pending, or not warranted, with the date of determination.
BSA officer or committee approves; legal reviews any keep-open request and notice language.
Notice issued per contract terms, using pre-approved language.
Final sanctions screen on customer, signers, and payee.
Balance disbursed, or blocked and reported if the screen hits.
Exited customer, beneficial owners, and signers added to an internal onboarding watchlist.

The practitioner view: the exit isn't over at closure

Step seven is the one most programs skip, and it's where de-risking quietly fails. The individual you exited in March opens a new LLC in June with a different name, a new registered agent, and the same beneficial owner. If your onboarding screening only checks external lists, the new entity sails through. Now your EDD file shows you exited the risk and then took it back on.

The fix is mechanical: an internal exit list keyed on people, not accounts, screened against beneficial owners, signers, and addresses at onboarding and at refresh. Keep the reason codes on it so a hit routes to the person who knows the history. Justin, Axle's diligence agent, can check new business applicants against that history during KYB, and our AI readiness playbook covers how to structure exit data so an agent can use it.

FAQ

Do you have to file a SAR before closing a high-risk account?

No. File a SAR when activity meets the reporting criteria, on the regulatory timeline, whether or not you close the account. An exit doesn't create a SAR obligation, and closing the account doesn't remove one that already exists.

Can a bank tell a customer why it closed their account?

Within limits. The 2026 joint statement says a bank may tell a customer a closure may be related to suspected fraud or other suspicious activity. It cannot disclose a SAR or information that would reveal one exists.

Can law enforcement require a bank to keep an account open?

They can request it. The FFIEC manual says to get the request in writing, including purpose and duration, and that the final decision to maintain or close rests with the bank under its own standards.

Exit decisions are only as good as the diligence file behind them. See how Axle supports enhanced due diligence reviews with documented, examiner-ready analysis.

See how Axle's agents work

Axle's AI agents investigate compliance alerts and document every decision for your analysts to review.

See Axle in action

The Alert Queue

Get the next issue in your inbox

Every other Tuesday, one short read for compliance and risk teams.

Every other Tuesday. No pitches. Unsubscribe anytime.

Exiting a High-Risk Customer: De-Risking Without Defensive SARs

See how Axle's agents work

Get the next issue in your inbox

More from the blog