De-risking Myths That Cost Payment Firms Money: Debunked

When a bank offboards a licensed payment business, founders often conclude they must have failed compliance. That belief is wrong. The EBA has been explicit that blanket de-risking of a whole customer category is a sign of poor risk management by the bank, not proof of a problem with you.

In this article, we dismantle the four myths that keep regulated firms passive when they should push back, and show what the rules actually give you.

Myth 1: “De-risking Means I Failed KYC”

This is the myth that does the most damage, because it turns a bank’s policy decision into a verdict on your business. The reality sits the other way around. The EBA has stated that de-risking an entire customer category without individual risk assessment can be unwarranted and indicates ineffective money-laundering and terrorist-financing risk management — a shortcoming on the bank’s side, not evidence that you failed KYC.

“De-risking a category” actually means this: the bank did not assess you individually and find a problem; it declined to assess you at all and exited the whole segment. That is the opposite of a targeted compliance finding. Nevertheless, founders internalise the offboarding as personal failure, stop asking questions, and forfeit the standing the guidelines give them. The first step to pushing back is refusing this myth.

Myth 2: “Banks Are Legally Required to Drop High-risk Sectors”

The second myth dresses a commercial choice up as a legal obligation. Banks are required to manage money-laundering risk — they are not required to manage it by refusing whole sectors wholesale. The EBA’s guidelines make exactly this point: risk management means assessing customers individually, and blanket category exits are a failure to do that, not compliance with a rule that demands it.

The distinction matters because it changes the conversation. If offboarding were legally mandatory, there would be nothing to discuss. Because it is a risk-appetite decision the bank chose, you can ask why your individual profile — not your sector’s reputation — led to the exit. Now to the practical point: a bank hiding behind “we have to” is usually making a business decision it would rather not defend on the merits of your actual file.

Myth 3: “There Is Nothing I Can Do Once the Notice Arrives”

The third myth is learned helplessness, and it is the most costly because it stops action at the exact moment action matters. An offboarding notice is the start of a process, not the end of one. The EBA guidelines give you grounds to request an individual risk assessment rather than accept a category-based exit, and to ask the bank for the specific reason behind the decision.

Concretely, there are moves available: request the reason in writing, demand individual assessment, escalate through the bank’s complaints process, and where the bank provides essential services, raise account-access rights with the national regulator. None of these guarantees reversal, but they change your position from passive recipient to active counterparty. Meanwhile, the very fact that correspondent relationships are down roughly 25% since 2011 means banks know the market is tight — a firm that engages seriously is harder to drop than one that disappears quietly.

Myth 4: “PSD3 Will Invalidate the EMI License I Get Now”

The fourth myth is not about banks at all, but it drives the same paralysis — founders delay getting licensed because they fear PSD3 will erase the value of an EMI obtained today. It will not. Under the PSD3 reforms, existing EMI and PI authorisations are grandfathered into the new regime rather than invalidated; an EMI becomes a payment institution authorised to issue e-money, keeping its permissions under a new label.

So the license you obtain in 2026 carries forward, not into a bin. The practical damage of this myth is inaction: firms that wait for a mythical “PSD3-proof” license simply lose market access while the reform’s application date sits realistically in 2028. To sum up, grandfathering rewards acting now, and the belief that PSD3 punishes early movers gets the incentive exactly backwards.

Check these 6 steps to protect your payment firm from de-risking.

What the Rules Give You

Strip away the four myths and a clear entitlement remains. The EBA guidelines position unwarranted, category-wide de-risking as a supervisory concern — which means you are not a supplicant asking a favour, but a customer with grounds to demand individual treatment. You can ask for the specific reason, insist on an assessment of you rather than your sector, and escalate where essential services are at stake.

The structural context supports the same posture. Account loss is often a market trend, not a compliance verdict — correspondent relationships down roughly 25% since 2011 tell you the pressure is systemic. A firm that understands this negotiates from strength: it documents thoroughly, keeps banking diversified, cites the EBA’s position, and treats an offboarding as a problem to manage rather than a sentence to serve.

Check all the benefits of EMI license, what it gives a business and when the companies need this, here.

FAQ

Does a bank closing my account mean I failed compliance?

No. The EBA states that de-risking a whole customer category without individual assessment is unwarranted and indicates poor risk management by the bank. A category exit is not a targeted finding against you — it is the bank declining to assess you individually.

Are banks legally required to offboard high-risk sectors?

No. Banks must manage money-laundering risk, but the EBA guidelines say that means individual assessment, not wholesale category exits. Blanket offboarding is a risk-appetite choice, not a legal obligation.

Can I do anything after receiving an offboarding notice?

Yes. You can request the specific reason in writing, demand an individual risk assessment, use the bank’s complaints process, and raise account-access rights with the regulator where essential services apply. The notice starts a process rather than ending one.

Will PSD3 invalidate an EMI license I get in 2026?

No. Existing EMI and PI authorisations are grandfathered into the new regime. An EMI becomes a payment institution authorised to issue e-money, keeping its permissions, so a license obtained now carries its value forward.

Is losing a bank account always my fault?

No. Correspondent banking relationships are down roughly 25% since 2011, so account loss is frequently a structural market trend rather than a verdict on your compliance. The context matters when you push back.

Conclusion

The four de-risking myths share one effect: they keep licensed payment firms passive and paying for it. De-risking is not proof you failed KYC; banks are not legally forced to drop whole sectors; an offboarding notice is not the end of the conversation; and PSD3 will not invalidate a license you get now. What the rules actually give you is standing — to demand individual assessment, to ask for reasons, to escalate, and to act now on a license that grandfathering carries forward. Refuse the myths, and a de-risking event becomes a problem you manage rather than a fate you accept.

Been offboarded, or worried you will be, and unsure of your rights? Send us the situation — your sector, your bank, and the notice if you have one — on Telegram or WhatsApp, and we will review your de-risking rights and banking options so you push back from a position of strength.