Customer Life-Cycle Controls and Exit Decisions

Overview
Customer life-cycle controls describe how a financial institution manages financial crime risk from the moment a prospective customer first approaches the institution until the relationship is formally terminated and records are retired. In the ACAMS CAMS syllabus this topic sits within AFC Program Governance and Risk Management, because it is fundamentally about how governance structures, risk appetite, and documented decision-making translate into day-to-day control over who the institution does business with and for how long. The exit decision is the final stage of the life cycle and is one of the most heavily tested judgment areas on the exam.

Why This Topic Is Important
1. It operationalizes the risk-based approach. FATF Recommendation 1 requires institutions to identify, assess, and mitigate money laundering and terrorist financing risk, and Recommendation 10 requires customer due diligence throughout the relationship, not just at onboarding. Life-cycle controls are the mechanism that makes this continuous.
2. Regulators examine the whole chain. Enforcement actions repeatedly cite failures such as onboarding customers outside risk appetite, failing to refresh KYC, ignoring red flags surfaced by monitoring, and keeping high-risk relationships open without documented justification. A weakness at any stage undermines the entire AML/CFT program.
3. Exit decisions carry legal and reputational consequences. Closing an account too hastily can tip off a subject, breach contractual obligations, trigger discrimination or unfair treatment complaints, or contribute to financial exclusion (de-risking). Closing too slowly can expose the institution to continued illicit activity and regulatory criticism.
4. Governance credibility. How an institution handles its most difficult customer decisions demonstrates whether compliance has genuine independence and whether senior management and the board actually own financial crime risk.

What Customer Life-Cycle Controls Are
The life cycle is commonly broken into five connected stages. Each stage has distinct controls, but information must flow between them.

Stage 1: Customer Acceptance and Pre-Onboarding
- The Customer Acceptance Policy (CAP) is approved by senior management or the board and sets out which customer types, geographies, products, and channels the institution will and will not serve.
- The risk appetite statement defines tolerance for residual risk and informs prohibited and restricted categories (for example, shell banks are prohibited; certain cash-intensive or high-risk-jurisdiction customers may be restricted and require senior approval).
- Pre-screening against sanctions lists, internal watch lists, and prior exit records prevents re-onboarding of previously terminated customers through a different channel or entity.

Stage 2: Onboarding (CIP, CDD, EDD)
- Customer Identification Program (CIP): collect and verify identity using documentary and non-documentary methods.
- Customer Due Diligence (CDD): understand the nature and purpose of the relationship, expected activity, source of funds, and identify beneficial owners (typically the 25 percent ownership threshold plus a control prong, though thresholds vary by jurisdiction).
- Enhanced Due Diligence (EDD): required for higher-risk customers such as politically exposed persons (PEPs), correspondent banking relationships, customers from high-risk jurisdictions, and complex ownership structures. EDD includes source of wealth verification, senior management approval, and more frequent review.
- Risk rating: assign an initial customer risk rating using factors including customer type, geography, products and services, delivery channel, and anticipated transaction behavior. The rating drives the intensity of ongoing monitoring and the frequency of periodic review.
- Decision documentation: the rationale for accepting a high-risk customer must be recorded, including who approved it and what mitigating controls were applied.

Stage 3: Ongoing Monitoring and Periodic Review
- Transaction monitoring: automated and manual systems compare actual activity against expected activity and known typologies. Alerts are triaged, investigated, and either closed with rationale or escalated.
- Periodic KYC refresh: high-risk customers are reviewed more frequently (often annually), medium-risk every two to three years, and low-risk every three to five years, though exact cycles are set by institutional policy and local regulation.
- Trigger or event-driven reviews: initiated by material changes such as new beneficial owners, adverse media, a sanctions or PEP hit, a SAR filing, a law enforcement inquiry, unexpected changes in transaction patterns, or a change in the customer's business model or jurisdiction.
- Screening: continuous rescreening of the customer base against updated sanctions, PEP, and adverse media lists.
- Dynamic risk rating: the customer's rating should be updated when new information changes the risk profile; a static rating assigned at onboarding and never revisited is a recognized control weakness.

Stage 4: Remediation and Escalation
- When monitoring or review reveals gaps, the institution may require updated documentation, impose transaction restrictions, apply enhanced monitoring, or escalate to a committee.
- If a customer refuses to provide required information, the institution should consider restricting the account, declining to proceed with transactions, filing a suspicious activity report, and ultimately exiting the relationship.
- Escalation paths should be defined so that front-line staff know when a matter goes to compliance, when it goes to a financial crime risk committee, and when it requires senior management or board visibility.

Stage 5: Exit (Offboarding) and Post-Exit
- The exit decision terminates the relationship. It may be driven by financial crime concerns, inability to complete due diligence, breach of risk appetite, regulatory requirement, sanctions designation, or commercial reasons.
- Post-exit controls include retaining records for the required period (commonly at least five years after the relationship ends, longer in some jurisdictions), adding the customer to an internal do-not-rebank list, and ensuring any pending SAR obligations are met.

How Exit Decisions Work in Practice
Common triggers for exit:
- Confirmed or strongly suspected involvement in money laundering, terrorist financing, fraud, or sanctions evasion.
- Multiple SAR filings on the same customer with no legitimate explanation.
- Refusal or inability to provide CDD or EDD information, including beneficial ownership.
- Customer falls into a prohibited category under the CAP (for example, becomes a shell bank or is designated on a sanctions list).
- Risk profile moves outside appetite and no mitigating controls can bring residual risk to an acceptable level.
- Regulatory direction or a court order.

Governance of the exit decision:
- Exit decisions for high-risk or sensitive customers should be made or ratified by a committee (often called a client exit committee, financial crime committee, or reputational risk committee) with representation from compliance, legal, the business, and sometimes risk and operations. This prevents the business from unilaterally overriding compliance and prevents compliance from making decisions without understanding legal and contractual implications.
- Compliance must have independence and, in many frameworks, an effective veto or escalation right. If the business wishes to retain a customer that compliance recommends exiting, the disagreement should be escalated to senior management with full documentation.
- The decision, the rationale, the alternatives considered, the participants, and the date must be documented. Regulators will ask why a relationship was kept open just as readily as why it was closed.
- Consistency matters: similar customers in similar circumstances should be treated similarly. Inconsistent exit decisions suggest the risk-based approach is not genuinely applied and can expose the institution to claims of discriminatory treatment.

Key considerations when executing an exit:
- Tipping off: if a SAR has been filed or is being considered, the closure communication must not reveal that. The customer is typically given a neutral reason (such as a commercial decision or the institution's policy) consistent with the account agreement, and staff must never disclose the existence of a SAR.
- Timing and sequencing: file the SAR where required; consider whether closure should occur before, during, or after the investigation. Some institutions allow a short notice period so that the customer can relocate legitimate activity, which also reduces the risk of appearing to tip off.
- Law enforcement requests: in some jurisdictions law enforcement may ask the institution to keep an account open to facilitate an investigation (sometimes called a keep-open request or letter). Such requests should be in writing, time-limited, reviewed by compliance and legal, and the institution should continue to monitor and file SARs on the activity. The institution is not obliged to agree but should document its decision.
- Return of funds: funds in a closed account are returned to the customer by an appropriate method unless they are frozen under sanctions, subject to a court order, or there is a legal basis to hold them. Returning funds that are suspected proceeds of crime may itself require a SAR and careful legal review.
- Contractual and legal obligations: account agreements, notice periods, consumer protection rules, and local banking laws may constrain how quickly closure can occur.
- Communication and record keeping: the closure letter, internal rationale, committee minutes, SAR references, and any correspondence must be retained for the regulatory retention period.
- Internal flagging: the exited customer and connected parties should be recorded so they are not re-onboarded by another business line or branch without compliance review.

De-Risking versus Risk-Based Exit
A critical distinction the exam expects you to understand:
- De-risking refers to terminating or restricting relationships with entire categories of customers (for example, all money services businesses, all charities, all correspondent banks in a region) to avoid rather than manage risk.
- FATF and many regulators have stated that wholesale de-risking is not consistent with the risk-based approach, drives activity into less transparent channels, and undermines financial inclusion.
- The expected approach is case-by-case assessment: understand the specific customer's controls and risk profile, apply EDD and mitigants, and exit only when residual risk genuinely cannot be managed or the customer refuses to cooperate.
- Institutions are, however, entitled to make legitimate commercial decisions about which markets to serve, provided those decisions are not disguised blanket responses to AML concerns and are consistently governed.

Correspondent Banking Exits
Exiting a respondent bank has systemic implications. Institutions are expected to engage with the respondent, understand the respondent's own AML controls, consider restricting products rather than terminating entirely, communicate with sufficient notice, and document the rationale. The Wolfsberg Group and FATF guidance on correspondent banking are relevant reference points.

Three Lines of Defense Applied to the Life Cycle
- First line (business and relationship managers): collect KYC, know the customer, identify unusual activity, initiate reviews, and own the relationship including recommending or implementing exits.
- Second line (compliance and risk): set policy, perform or oversee EDD and investigations, run monitoring, challenge the business, and advise on exit decisions.
- Third line (internal audit): independently test whether life-cycle controls operate as designed, including sampling onboarding files, review completion rates, alert handling, and exit documentation.

Common Control Weaknesses Examiners Look For
- KYC refresh backlogs, especially for high-risk customers.
- Risk ratings that never change after onboarding.
- Alerts closed without documented rationale.
- High-risk customers approved without the required senior sign-off.
- Exit recommendations from compliance overridden by the business without escalation.
- Exited customers re-onboarded in another part of the group.
- Closure letters that reference suspicion or investigations.
- Records destroyed before the retention period expires.

Exam Tips: Answering Questions on Customer Life-Cycle Controls and Exit Decisions
1. Default to the risk-based approach. When an answer choice proposes closing all accounts of a certain type or refusing an entire category of customer, it is almost always a distractor. The correct answer will involve assessing the individual customer, applying EDD, or escalating.
2. Never tip off. Any answer in which staff tell the customer that a SAR was filed, that the account is under investigation, or that compliance has concerns is wrong. Closure communications should be neutral and consistent with policy.
3. Escalate and document. If the scenario describes a conflict between a relationship manager and compliance, the best answer typically involves escalating to a committee or senior management with documented rationale, not the business overriding compliance and not compliance acting alone without governance.
4. File the SAR, then consider the exit. Exam scenarios often test whether you recognize that closing an account does not remove the reporting obligation. If suspicious activity is identified, the SAR consideration comes first or in parallel; closure is a separate decision.
5. Refusal to provide information is a red flag and a valid basis for exit. If a customer will not identify beneficial owners or explain source of funds, the expected response is to restrict or decline the relationship and consider filing a SAR, not to proceed because the customer is profitable.
6. Keep-open requests must be in writing and time-limited. If law enforcement asks the institution to keep an account open, the best answer involves obtaining the request in writing, involving legal and compliance, setting a review date, and continuing to monitor and report.
7. Recognize the stages. Questions may describe a situation and ask which control failed. Map the scenario to onboarding, ongoing monitoring, periodic review, trigger review, or exit, and identify the control expected at that stage.
8. Watch for words like 'most appropriate', 'best', 'first', and 'next'. CAMS questions frequently have more than one plausible action; choose the one that is proportionate, follows governance, and is sequenced correctly. For example, the first step on discovering a sanctions match is usually to verify whether it is a true match and freeze if confirmed, not to immediately close the account.
9. Senior management and board accountability. If a question asks who approves the customer acceptance policy, risk appetite, or onboarding of a PEP, the answer points to senior management or the board, not the relationship manager.
10. Records must be retained after exit. Any option suggesting that customer files can be deleted upon closure is incorrect; retention periods run from the end of the relationship.
11. Consistency and fairness. If a scenario hints that similar customers are treated differently or that an exit is driven by an unrelated characteristic rather than risk, recognize this as a governance failure and potential discrimination issue.
12. Correspondent banking requires extra care. For respondent bank exits, favor answers involving engagement, understanding the respondent's controls, product restriction as an alternative, and adequate notice.
13. Eliminate extremes. Answers that are absolute ('always close', 'never onboard', 'immediately terminate without review') are rarely correct unless the scenario involves a clearly prohibited relationship such as a shell bank or a confirmed sanctions designation.
14. Think like a regulator. Ask yourself what an examiner would want to see in the file afterward: a clear rationale, the right approvers, evidence of monitoring, the SAR decision, and a closure that did not compromise an investigation. The answer choice that produces that file is usually the correct one.

Quick Revision Summary
- Life-cycle stages: acceptance, onboarding, ongoing monitoring, remediation, exit and post-exit.
- Controls at each stage are tied together by the customer risk rating, which must be dynamic.
- Exit decisions are governance decisions: committee-based, documented, consistent, and informed by compliance with escalation rights.
- Consider SAR filing independently of the exit decision; never tip off.
- Avoid wholesale de-risking; exit only when residual risk cannot be managed or the customer refuses cooperation.
- Retain records for the full regulatory period after closure and flag exited customers to prevent re-onboarding.
- Law enforcement keep-open requests should be written, time-limited, and reviewed by compliance and legal.