KYC Offboarding: How to Exit a Customer the Right Way

KYC offboarding is the controlled exit of a customer whose money laundering, sanctions or due diligence risk you can no longer accept. It has four parts: a documented decision, a lawful notice, correct handling of any suspicious activity report, and a retained record. Get the order wrong and you can breach tipping off rules or destroy evidence a regulator later asks for.

The mistake most firms make is treating exit as an operations task. Someone in account services closes the account, sends a form letter, and the file disappears into an archive. Then an examiner asks who approved it and on what basis, and nobody can answer.

What follows is a working process: the triggers that justify exit, who decides, how to give notice without tipping off, what to do with pending transactions and frozen funds, and how long to keep the file.

What counts as a KYC reason to exit

Commercial exits and compliance exits are different animals. A customer who stopped being profitable is a commercial decision. A customer whose ownership chain leads to a sanctioned party is a compliance one, and it carries obligations the commercial exit does not.

The compliance triggers fall into recognisable groups.

Mandatory exits

The customer, an owner, or a controlling party is a designated person under an applicable sanctions regime. Here you do not simply exit. You freeze and report first, because dealing with designated property is itself an offence.
You cannot complete or refresh customer due diligence. Where CDD cannot be completed, most AML regimes require that the relationship is not established or is terminated, and that you consider filing a report.
The customer refuses to provide beneficial ownership information you are required to hold.
You establish that documents supplied were forged or that the identity is false.

Risk appetite exits

The customer’s risk rating has moved above the level your board has agreed to accept, and no control brings it back.
Repeated suspicious activity reports on the same customer with no plausible explanation.
The customer has moved into a business line or a country your policy excludes.
A change of ownership or control has introduced an owner you would not have onboarded.

Cost driven exits

Some relationships are simply too expensive to monitor. Continuous alert review, translated documents, annual enhanced due diligence and repeated escalations cost real money. Firms are entitled to decide the return does not justify it. Be honest in the record that this is the reason, because a cost exit dressed up as a suspicion exit will not survive review.

De-risking and why it is criticised

De-risking means exiting whole categories of customer rather than assessing each one. Money service businesses, charities working in conflict zones, correspondent banks in certain regions, and customers from particular nationalities have all been affected.

FATF has publicly stated that wholesale de-risking is not consistent with a risk based approach. The risk based approach requires you to assess, mitigate and manage risk, not to avoid it by refusing an entire class of customer. Regulators in several jurisdictions have made similar statements.

Two practical consequences. First, your exit policy should require a customer specific assessment, even where a category is under review. Second, keep the reasoning. If you exit thirty customers in one sector, you want thirty individual assessments on file, not one memo about the sector.

Who decides, and the order of the steps

Exit is not a decision for the relationship manager alone, and it is not one for compliance alone either. Build a standing decision path and follow it every time.

Trigger recorded. Whoever spots it writes down what happened, when, and where the information came from.
Immediate containment. If sanctions are in play, freeze before anything else. If fraud is suspected, consider blocking new transactions while you review.
Review the relationship. Pull the full file: original CDD, transaction history, alert history, previous reports, and the current risk rating.
Re-screen. Run the customer, its owners and its known counterparties again. A stale screening result is not a basis for a decision. Use a free denied party screening tool and date the output.
Assess against risk appetite. Compare the current risk rating with the documented appetite. State whether any control could bring it back inside.
Reporting decision. Decide separately whether the facts meet your reporting threshold. This decision is independent of the exit decision.
Senior approval. The money laundering reporting officer or equivalent signs. In many firms an exit committee with compliance, legal, operations and the business unit reviews first.
Legal review of the notice. Legal drafts or approves the wording of the letter.
Execute. Notice given, wind down window opened, balance returned or frozen, access revoked at the end of the window.
Archive. The whole decision trail goes into retention.

Step six matters more than any other. Firms regularly conflate “we are exiting” with “we have reported”. They are separate obligations. Exiting a customer does not discharge a reporting duty, and reporting does not by itself require you to exit.

Tipping off: what you can and cannot say

Tipping off is disclosing to the customer or a third party that a suspicious activity report has been made, or that a money laundering investigation is under way or contemplated, in a way likely to prejudice it. In most AML regimes it is a criminal offence for the individual, not only a regulatory breach for the firm.

The rule is narrower than people assume. You are not prohibited from closing an account. You are not prohibited from telling the customer the account is closing. What you cannot do is link the closure to a report or an investigation.

Safe wording

“We have decided to end the banking relationship in accordance with clause X of the terms and conditions.”
“The account will close on [date]. Please provide settlement instructions for the balance.”
“We are not able to provide further detail on the reasons for this decision.”

Wording that creates exposure

Any reference to a report, a filing, a regulator, or law enforcement.
“Following a review of transactions on [specific date].” This narrows the customer’s attention to the reported activity.
“Compliance has flagged your account.” Staff say this on the phone constantly. Train it out.
Volunteering an explanation in the hope of preserving goodwill. Sympathy is the most common route to a tipping off breach.

Brief every person who may speak to the customer before the letter goes out. Give them a single approved line and instruct them to escalate anything beyond it. A prepared script for the front line is worth more than any policy document.

Handling the money and the notice period

Notice periods come from your contract, from local rules on payment account closure, and from what is fair in the circumstances. Thirty days is a common standard notice in commercial practice, though it is a convention rather than a universal legal requirement. Where a sanctions freeze applies, immediate action displaces the notice period entirely.

Pending and in-flight transactions

Decide before you send the letter what happens to direct debits, standing orders, unsettled trades, open letters of credit and guarantees. Trade instruments are the hard case. An issued letter of credit is an independent undertaking to the beneficiary, so closing the applicant’s account does not extinguish it. If you are unfamiliar with how those obligations sit outside the account relationship, our explainer on how a letter of credit works sets out the mechanics.

Returning the balance

Returning funds can itself be a problem. If you suspect the balance is criminal property, moving it may be an offence in its own right. The standard route is to seek consent or a defence from the financial intelligence unit before releasing funds. Never return money to an account you have not screened. Never return it to a third party account on the customer’s instruction without a fresh assessment.

Exit routes compared

Not every exit looks the same. The trigger determines the speed, the approver and the reporting position.

Trigger	Notice	Funds	Approver	Reporting
Sanctions designation confirmed	None. Freeze immediately	Frozen, not returned	MLRO plus sanctions officer	Mandatory report to the sanctions authority
CDD cannot be completed	Standard contractual notice	Returned to source account	Compliance manager	Consider a report on the failure
Repeated suspicious activity	Standard notice, careful wording	Released only with a defence	MLRO	Report already filed, consider continuing activity report
Risk rating above appetite	Standard notice, longer if practical	Returned normally	Exit committee	None unless suspicion arises
Cost of monitoring	Generous notice	Returned normally	Business head with compliance sign off	None
Export control or licence breach	Depends on the breach	Case by case	Trade compliance plus legal	Consider voluntary disclosure to the regulator

Offboarding in trade and logistics, not just banking

Most offboarding guidance is written for banks. Exporters, freight forwarders and distributors face the same decision with different mechanics and almost no published guidance.

If a customer, consignee or intermediary turns up on a restricted party list, you have an immediate problem with shipments already in motion. Work through it in this order.

Stop new order acceptance for that party on the day the match is confirmed.
Identify every open order, booking, and shipment in transit. Include goods sitting in a bonded warehouse or with a forwarder.
Check whether the list placement prohibits the transaction outright or requires a licence. The distinction between restricted and denied parties changes what you may lawfully do next.
Instruct your forwarder in writing. Verbal holds do not survive a shift change. Screening obligations run through the logistics chain too, which is why screening your freight forwarders matters.
Assess whether a past shipment may already have breached a prohibition. If so, take advice on voluntary disclosure before you contact the customer.
Terminate the distribution or supply agreement using the compliance clause, not the convenience clause, where one exists.

One more thing. Cancelling an order with a party who has just been designated is not the same as cancelling for commercial reasons. Any refund, credit note or returned deposit is itself a transaction with that party. Check the position before you pay anything back.

Records: what to keep and for how long

Retention periods are set by each jurisdiction. Five years from the end of the business relationship is the most common baseline, with some regimes requiring longer where an investigation is open or a regulator directs it. Check your own rule rather than assuming.

Keep the following as one bundle, not scattered across systems.

The original and most recent CDD file, including identification documents and ownership records.
The trigger record: what was found, when, and by whom.
Screening outputs with dates, including the hits you discounted and why.
The risk assessment that supported the exit, and the risk appetite statement in force at the time.
The approval, naming the approver and the date.
Copies of every communication with the customer, including call notes.
Any report reference number, held under restricted access.
Evidence of what happened to the balance and to open instruments.

Restrict access to the reporting element specifically. Wide internal visibility of a report increases tipping off risk. The principles in our note on building a defensible audit trail apply here, and record keeping for denied party screening covers how to store screening evidence so it is retrievable years later.

After the exit

Three things people forget.

Block re-onboarding. Add the party to an internal do not onboard list with the reason code and the review date. Without this, the same customer returns through a different channel under a slightly different entity name six months later.

Look sideways. Ask whether connected parties should also be reviewed: the same directors, the same address, the same beneficial owner, a sister company you also serve. One exit often implies several.

Feed it back. If a customer reached the exit point, something in onboarding or in monitoring missed it earlier. Record what the earliest available signal was and whether your controls could have caught it. That is how an exit becomes a control improvement rather than a write off.

Key takeaways

The decision to exit a customer and the decision to file a suspicious activity report are separate. Doing one does not discharge the other.
Where a sanctions designation is confirmed, funds are frozen and reported rather than returned, and normal notice periods do not apply.
Tipping off prohibits linking a closure to a report or investigation. It does not prohibit closing the account or saying that it is closing.
FATF has stated that wholesale de-risking of entire customer categories is inconsistent with the risk based approach, so each exit needs its own documented assessment.
Letters of credit, guarantees and other trade instruments survive the closure of the account, because they are independent undertakings to the beneficiary.
Five years from the end of the relationship is the most common record retention baseline, but the exact period is set by each jurisdiction.
Every exit should produce an internal do not onboard entry, a review of connected parties, and a note on what the earliest missed signal was.

Frequently asked questions

Do I have to tell a customer why their account is closing?

Generally no, and often you must not. Where a suspicious activity report has been made, explaining the reason risks a tipping off offence. Most terms and conditions allow closure on notice without stated reasons. Say that the relationship is ending, give the date, and decline to elaborate. Keep the internal reason fully documented.

Can I exit a customer immediately?

Only where the law or your contract permits it. A confirmed sanctions designation requires immediate freezing, which overrides any notice period. Suspected fraud or a serious contractual breach may allow immediate termination under your terms. For risk appetite and cost driven exits, give the contractual notice. Immediate closure without a legal basis invites a complaint or a claim.

What is the difference between de-risking and offboarding?

Offboarding is the process of ending one customer relationship. De-risking is the practice of avoiding whole categories of customer to sidestep the cost of managing their risk. De-risking uses offboarding as its tool, but the decision is made at category level. Regulators expect customer level assessment, so category level exits need individual files behind them.

Should I file a report every time I exit a customer?

No. The reporting test is whether you know, suspect, or have reasonable grounds to suspect money laundering or terrorist financing. Many exits fail that test. A customer who simply will not send a certified passport copy is a CDD failure, not automatically a suspicion. Record the reasoning either way, because the absence of a report is a decision you may be asked to justify.

Who should sign off a compliance exit?

The money laundering reporting officer or an equivalent senior compliance role. Many firms route exits through a committee including legal, operations and the business unit, with the compliance officer holding the final vote. The point is that the business relationship owner cannot both propose and approve. Name the approver in the record.

Can an offboarded customer come back later?

Sometimes. A customer exited for incomplete CDD may reapply once they can provide what was missing. A customer exited for suspected criminality normally should not be readmitted. Set a reason code and a review date on the internal block list so the answer is decided in advance rather than by whoever handles the new application.

Check before you decide

An exit decision built on a screening result from last year is not defensible. Re-screen the customer, its owners and its counterparties on the day you decide, and keep the dated output in the file. You can run a denied party screening check in a few minutes using Globalior’s free screening tool. If you want help drafting an exit policy that holds up under examination, talk to our team.