Customer Offboarding Decisions and Documentation

Why Customer Offboarding Matters

Customer offboarding (also called customer exit, account termination, or de-marketing) is the final stage of the customer lifecycle in an anti-financial crime (AFC) program. It sits within the CAMS domain of Controls, Investigations and the AFC Organization because it is where the outputs of monitoring, investigations and risk assessment turn into a concrete control decision: does the institution continue to accept the financial crime risk posed by this customer, or not?

Regulators and examiners care about offboarding for several reasons:
- Risk appetite enforcement. A risk-based program is only credible if the institution actually exits customers whose risk exceeds what it is willing to accept. Retaining customers after repeated suspicious activity reports (SARs/STRs) with no documented rationale is a classic examination finding and a recurring theme in enforcement actions.
- Legal exposure. Continuing to service a customer who is laundering money, financing terrorism or evading sanctions can expose the institution and individual employees to civil and criminal liability.
- Avoiding indiscriminate de-risking. FATF, the Basel Committee and national regulators have repeatedly warned that wholesale termination of entire categories of customers (for example, all money service businesses, all charities or all correspondent relationships in a region) is not a risk-based approach. It pushes legitimate activity into unregulated channels and undermines financial inclusion. Institutions are expected to manage risk case by case, and to be able to show that they did.
- Defensibility. Whatever the decision, the institution must be able to demonstrate to regulators, auditors, law enforcement and, in some cases, courts, why it decided as it did, who made the decision, and what evidence supported it. That is the documentation requirement.

What Customer Offboarding Is

Offboarding is the deliberate, governed process of terminating a customer relationship (or declining to continue a product or service) for financial crime, sanctions, reputational or regulatory reasons. It is distinct from routine closures initiated by the customer and from closures for purely commercial reasons, although the same operational steps may be used.

Common triggers for an offboarding review include:
- Inability to complete or refresh customer due diligence (CDD) or enhanced due diligence (EDD): the customer refuses to provide information, provides false or contradictory documents, or beneficial ownership cannot be established.
- Confirmed sanctions matches or ownership/control by sanctioned parties.
- Repeated or escalating suspicious activity, especially multiple SAR/STR filings on the same customer (so-called repeat SAR or continuing activity review).
- Investigation conclusions that the account is being used for money laundering, fraud, terrorist financing, human trafficking, or other predicate offenses.
- Adverse media or law enforcement inquiries, subpoenas, or indictments that materially change the risk profile.
- Politically exposed person (PEP) or high-risk jurisdiction exposure that exceeds the institution's documented risk appetite.
- Shell company characteristics, nested or undisclosed downstream correspondent activity, or use of the account inconsistent with the stated purpose.
- Breaches of account terms, such as a money service business operating without required licensing or registration.

Note that a single trigger does not automatically require exit. The institution must evaluate the trigger in context, weigh mitigating factors, and decide whether the residual risk is acceptable.

How the Offboarding Process Works

1. Identification and escalation. Potential exit cases usually arise from transaction monitoring alerts, investigations, periodic KYC reviews, sanctions screening, or referrals from the relationship team. First-line staff (relationship managers, branch personnel) must escalate to the second line (AML/Financial Crime Compliance). A key control principle: the business should not be able to unilaterally decide to retain a high-risk customer who generates revenue, and compliance should have authority to escalate or veto.

2. Assessment. Compliance (often with the investigations unit) reviews the full customer file: KYC/CDD records, transaction history, prior SARs, screening results, correspondence and the customer's explanations if any were legitimately requested. The reviewer asks whether the risk can be mitigated (for example, through restricting products, enhanced monitoring, or obtaining additional documentation) or whether exit is the only appropriate response.

3. Governance and decision authority. Most institutions route exit recommendations to a defined forum, such as a Client Exit Committee, Reputational Risk Committee, or Financial Crime Risk Committee, with representation from compliance, legal, the business and sometimes operations. Authority levels are typically documented in a policy or procedure: low-risk closures may be approved by a compliance manager, while high-profile or large relationships may require senior management or committee approval. Decisions to retain a customer who was recommended for exit must be approved and documented at least as rigorously as decisions to exit; this is a frequent exam point.

4. Law enforcement considerations. Before closing an account that is subject to an investigation, the institution should consider whether law enforcement has an interest in keeping it open. In some jurisdictions, agencies issue formal keep-open or hold-open letters requesting that the account remain active so that activity can continue to be monitored. If the institution agrees, the request should be in writing, time-limited, periodically renewed, approved at an appropriate level, and the account should remain under enhanced monitoring with continuing SAR filings. The letter itself does not shield the institution from liability indefinitely and does not eliminate its own AML obligations.

5. Tipping off and customer communication. The customer must never be told that a SAR/STR was filed or that they are under investigation. Closure notices should use neutral language (for example, that the institution is exercising its contractual right to close the account) and should follow the notice period required by account agreements and local law. Staff who interact with the customer should be briefed on what they may and may not say.

6. Execution. Operational steps include: identifying all linked accounts, products and related parties (joint holders, beneficial owners, affiliated entities); blocking new transactions where appropriate; returning remaining funds through a documented and lawful method (often by check or wire to an account in the customer's name at another regulated institution, not in cash); handling any legal holds, liens or frozen funds; and adding the customer to an internal do-not-rebank or restricted list to prevent re-onboarding through another channel or branch.

7. Post-exit obligations. Exit does not end the institution's duties. It should file a SAR/STR if the circumstances warrant one (including a final or closing SAR), respond to any subsequent subpoenas or information requests, and retain all records for the legally required period (commonly at least five years after account closure, longer in some jurisdictions or if litigation is anticipated). Monitoring for attempts to re-establish the relationship should continue.

Documentation Requirements

Documentation is what converts a judgment call into a defensible control. A complete offboarding file typically includes:
- The trigger evidence: alert details, investigation case notes, screening results, adverse media, CDD deficiencies, and SAR/STR references (with care taken to restrict access to SAR information in line with confidentiality rules).
- A decision memorandum or recommendation prepared by compliance or investigations summarizing the facts, the risks identified, alternatives considered, mitigating factors and the recommended action.
- Committee minutes or approval records showing who attended, what was decided, dissenting views, and the rationale, especially for decisions to retain despite a recommendation to exit.
- Law enforcement correspondence, including keep-open letters, their expiry dates and renewal approvals.
- Legal review where required, covering contractual notice periods, consumer protection, data privacy and any litigation risk.
- Customer communications (closure letters) and evidence of how funds were returned.
- Operational confirmation that all linked accounts were closed, the internal restricted list was updated, and downstream systems were informed.
- Record retention metadata showing the retention period and destruction date.

Good documentation is contemporaneous, factual, consistent with the risk assessment and policy, free of speculation or discriminatory language, and clearly distinguishes between facts, analysis and conclusions. A reviewer who was not involved should be able to reconstruct the reasoning from the file alone.

Key Principles to Remember
- Offboarding is a risk-based decision, not an automatic consequence of any single red flag, and not a substitute for proper due diligence.
- Wholesale de-risking of customer categories is discouraged by FATF; decisions should be case by case.
- Compliance must have genuine authority; revenue considerations cannot override financial crime risk without senior, documented acceptance.
- Never tip off the customer.
- Consider law enforcement interests before closing, and document any keep-open arrangement.
- Exit does not end obligations: file SARs as appropriate, retain records, and prevent re-onboarding.
- Decisions to retain high-risk customers need as much documentation as decisions to exit.

Exam Tips: Answering Questions on Customer Offboarding Decisions and Documentation

Tip 1: Look for the governed, escalated answer. When a scenario describes a relationship manager, teller or analyst who discovers serious red flags, the correct response almost always involves escalating to the AML/compliance function or an exit committee rather than acting alone. Distractors often have the front-line employee closing the account immediately, confronting the customer, or ignoring the issue because the customer is profitable.

Tip 2: Reject tipping off in any form. Any answer in which the institution tells the customer that a SAR was filed, that law enforcement is interested, or that the closure is due to suspicion of money laundering is wrong. Correct answers describe neutral closure language and restricted internal knowledge of SAR filings.

Tip 3: Distinguish risk-based exit from de-risking. If an option proposes closing all accounts of a whole customer type (all charities, all MSBs, all customers from a country), CAMS expects you to identify that as inconsistent with FATF guidance. The better option evaluates each customer individually and documents the risk assessment.

Tip 4: Remember the law enforcement angle. If the scenario mentions an active investigation, subpoena or inquiry, the best answer often involves consulting with law enforcement (or honoring a written keep-open request) before closing, while continuing enhanced monitoring and SAR filing. Closing immediately without considering this is usually the distractor.

Tip 5: Documentation is the answer to how do you defend the decision. Questions that ask what the institution should do after deciding to exit, or what an examiner will look for, are pointing toward a documented rationale, approval records, committee minutes, evidence of consistency with policy, and record retention. Choose answers that emphasize written, contemporaneous, retained documentation over verbal agreements or informal emails.

Tip 6: Retention decisions need documentation too. If a scenario says compliance recommended exit but senior management chose to keep the customer, the correct answer requires that the override be approved by an appropriate authority, the rationale and mitigating controls be documented, and enhanced monitoring be applied. Simply deferring to management, or treating compliance as the sole decision-maker without governance, is incorrect.

Tip 7: Inability to complete CDD is a strong indicator. Where a customer refuses to provide required information or beneficial ownership cannot be determined, CAMS expects the institution to decline or terminate the relationship and consider whether a SAR is warranted. The wrong answers typically allow the account to remain open pending indefinite follow-up.

Tip 8: Exit does not end obligations. Watch for answers stating that once an account is closed no SAR is needed or records can be discarded. The correct view is that a closing SAR may be required, records must be retained for the statutory period, and the customer should be placed on an internal restricted list.

Tip 9: Handle funds lawfully. If asked how remaining balances should be returned, prefer traceable methods to an account in the customer's own name at a regulated institution, after confirming there are no legal holds, freezes or sanctions restrictions. Avoid answers involving cash disbursement to third parties or ignoring frozen status.

Tip 10: Apply the three-lines model. First line identifies and escalates, second line (compliance) assesses and recommends or approves within its authority, and senior management or a committee owns the risk appetite decision. Internal audit later tests whether the process was followed. Answers that blur these roles are usually incorrect.

Practice Scenario

A bank has filed three SARs over nine months on a wholesale import business. The relationship manager notes the customer generates significant fee income and argues the activity has innocent explanations. What is the most appropriate next step?

The best answer: refer the relationship to the bank's client exit or financial crime risk committee for a documented decision on whether to retain, restrict or exit the customer, considering whether law enforcement has an interest in the account, and ensuring any decision to retain includes enhanced monitoring and senior-level approval. Weaker options include closing immediately without governance, keeping the account open based solely on revenue, or informing the customer about the SARs.

Summary

Customer offboarding is where an AFC program proves it has teeth. The CAMS exam tests whether you understand that exit is a risk-based, escalated, governed decision; that compliance must have real authority; that de-risking entire categories is discouraged; that tipping off is prohibited; that law enforcement interests should be considered; and above all that every step, whether the customer is exited or retained, must be thoroughly documented and retained so the institution can defend its reasoning to regulators and auditors.