Exit, Offboarding & Escalation

Sometimes the right answer is to exit the customer. Offboarding means ending the relationship and closing the accounts, and it happens for several reasons: the residual risk is simply unacceptable, EDD couldn't resolve the concerns, the customer refuses to provide required information, or you've confirmed something that makes continuing untenable. But exiting isn't as simple as hitting 'close.'

It's a regulated decision with traps around it — especially the rules on suspicious activity reporting and on what you may and may not tell the customer. Get the sequence wrong and you can break the law even while trying to do the right thing.

First, a word of caution about de-risking. De-risking is when an institution exits entire categories of customers — say, all money services businesses, or all customers from a region — simply to avoid the cost of managing their risk, rather than assessing them individually. Regulators including FinCEN and FATF have warned that wholesale de-risking pushes legitimate people and businesses out of the regulated system and into the shadows, which is the opposite of what AML is for.

The professional stance is to manage risk where you reasonably can, and to exit the specific, real risk you actually identified. And whatever you decide, document why — an undocumented mass exit is exactly what examiners and fair-banking regulators question.

Here's a connection people miss: deciding to exit a customer does not cancel your duty to report. If the activity that drove the exit meets the threshold for suspicion, a Suspicious Activity Report — a SAR, filed under 31 CFR 1020.320 — may be legally required.

Closing the account and filing a SAR are two separate decisions, and you may well do both. In fact, suspicious activity can warrant a SAR even after the relationship ends, and patterns sometimes call for continuing-activity SARs. As a KYC analyst you typically don't file the SAR yourself — you escalate to the financial intelligence unit or AML investigations — but you must recognize when your findings cross into reportable territory and route them, rather than quietly closing the file.

Now the cardinal rule of this entire lecture: never tip off the customer. It is illegal to disclose that a SAR has been filed, or even that one is being considered or prepared. In the U.

S. that confidentiality is codified at 31 USC 5318(g)(2), and FATF Recommendation 21 prohibits tipping off across jurisdictions. The reason is obvious: warn a launderer that they're under report and you let them move the money, destroy evidence, and flee.

This shapes how you offboard. You can close an account, but you cannot tell the customer it's because of a suspicious activity report, and you must be careful that the stated reason for closure doesn't effectively reveal one. When in doubt about wording, escalate.

Two things to close. First, escalation. Know your institution's path — typically from you, to a senior analyst, to the financial intelligence unit or AML compliance, up to the money laundering reporting officer or equivalent.

Your job is to surface findings clearly and route them, not to make unilateral calls on whether something is suspicious or whether to report. Second, the audit trail, which ties this whole course together. Every step — the facts you found, your analysis, the decision, who approved it, and when — must be documented so that an examiner, an investigator, or a court can later reconstruct exactly what you knew and why you acted.

In financial crime work, if it isn't written down, it didn't happen. The record is the work.

Let's recap. When a relationship can't continue, you offboard — but for specific, documented risk, not indiscriminate de-risking. Exiting never cancels your duty to report suspicious activity under 31 CFR 1020.

320, and the cardinal rule is that you never tip off the customer about a SAR, because confidentiality is the law under 31 USC 5318(g)(2) and FATF Recommendation 21. You escalate findings through the proper path and you document everything, because the audit trail is what proves the work. You now know the full lifecycle.

In our final lecture, we'll put it together — the analyst's day, quality assurance, common mistakes, and how to prepare for the interview. Get this lecture right and you protect both the institution and yourself, because clean escalation and a complete record are what stand up under scrutiny.