Offboarding

Offboarding is the process by which a bank, payment institution, card acquirer or other financial firm ends its relationship with a customer, closes the accounts or merchant facility, and settles any remaining balances. In compliance language it is also called customer exit, account closure or, in popular use, "debanking".

Offboarding can follow a customer's own request, but the term is used most often for exits the firm initiates because of financial-crime risk, commercial reasons or a change in the customer's licence status. It is the opposite of onboarding and the last stage of customer due diligence (CDD). When firms exit whole categories of customers at once, the practice is known as de-risking.

Think of a landlord ending a tenancy. The landlord may decide the tenant is too risky, the building is changing use, or the rent no longer covers the trouble. There is a notice period, keys to hand back, a deposit to return and sometimes a dispute about damage. Some landlords give reasons; many are not obliged to.

Offboarding is a financial firm doing the same with a customer account. It sends notice, stops new activity, pays back what it owes, keeps records and moves on. For the customer, the hard part is often finding a new "landlord" willing to take them, especially if the reason for leaving makes other firms nervous too.

Common triggers for a firm-initiated exit include:

• Financial-crime risk. Unexplained transactions flagged by transaction monitoring, a filed suspicious activity report (SAR) or a hit in sanctions screening.
• Ownership problems. The customer cannot or will not show its real owners, for example where a nominee owner masks control or the true beneficial owner emerges later.
• Licence and perimeter issues. A merchant's licence lapses or is withdrawn, or the firm decides the customer is operating outside the payments perimeter without the permission it needs.
• Risk appetite changes. The firm stops serving a whole sector, country or licence class, such as gambling operators licensed by a license mill or certain money services businesses (MSBs).
• Commercial reasons. The account is unprofitable once compliance costs are counted, or the firm's own banking partner objects.

Pressure often comes from upstream. A payment firm's correspondent banking relationship (CBR) or sponsor bank may tell it to drop certain clients, so a single decision at the top of the chain can cascade into many exits below.

A typical exit follows a recognisable sequence:

1. The firm makes and documents a decision, usually through a risk committee, recording the reasons for audit and regulators.
2. It gives notice under the contract and applicable law. In the EU, the second Payment Services Directive (PSD2) requires at least two months' notice to end an open-ended framework contract with a payment service user, unless agreed otherwise for business clients; immediate closure is possible where the law requires it.
3. It restricts activity, often stopping new deposits first while allowing withdrawals.
4. It returns remaining funds to an account in the customer's name, and settles any card-scheme or chargeback liabilities.
5. It keeps records for the period required by anti-money laundering law and, where suspicion exists, avoids "tipping off" the customer about any report filed.

In card acquiring, offboarding a merchant has extra steps. An acquirer may hold back part of the final settlements in a reserve account to cover refunds and disputes that arrive after closure. A merchant terminated for fraud or excessive chargebacks can be added to Mastercard's MATCH list, which other acquirers consult before boarding new merchants, making it hard to find a replacement. This is why high-risk merchant businesses often work with a specialist high-risk acquirer.

Offboarding is especially common in gaming payments, crypto, remittances and adult services. When a country closes or restricts a market, banks and payment service providers (PSPs) may be told to stop processing payments for unlicensed operators, and they offboard quickly to avoid supervisory penalties. When a licence is withdrawn, the exit of the business's own customers is managed through a wind-down plan that sets out how balances are returned.

Customers who lose access to regulated providers often move to cash, crypto peer-to-peer markets or unlicensed agents. Supervisors and the FATF have warned that indiscriminate exits push activity into the grey economy, where it is harder to monitor.

Standard-setters encourage a risk-based approach: firms should manage individual customers' risk rather than exit whole groups by default. The FATF has said repeatedly that wholesale de-risking is not what its standards require, and that it harms financial inclusion, remittance flows and humanitarian work.

Legal protections vary. The EU Payment Accounts Directive gives consumers legally resident in the Union a right to a basic payment account, limiting when banks can refuse or close one. In the United States, federal banking agencies said in 2025 that they would stop using reputational risk in bank supervision, and a presidential executive order in August 2025 addressed what it called politicised debanking. Businesses generally have weaker protections than consumers, and firms in high-risk sectors still face exit at short notice.

• Directive (EU) 2015/2366 on payment services (PSD2)