De-Risking: Managing Risk, Building Trust

Anti-money laundering and terrorist financing (AML/CFT) requires banks, professionals of the financial sector (PSFs) and insurance professionals to implement frameworks tailored to their activities. In an environment characterised by increasingly complex transactions and the internationalisation of business, these entities must reconcile their regulatory obligations with the sustainable management of their business relationships.

De-risking: managing risk rather than avoiding it

This need for balance raises the issue of de-risking, which involves refusing or terminating certain business relationships because of the risks they present. While such an approach may be justified in certain circumstances, a systematic exclusion policy may result in clients being turned away even where their risks could be managed through appropriate due diligence measures.

In its communication of 16 June 2026, the Luxembourg financial supervisory authority, the Commission de Surveillance du Secteur Financier (CSSF), emphasised that risk management should not be confused with risk avoidance. A high level of risk does not, in itself, justify refusing to establish or maintain a business relationship. Professionals are expected to understand their exposure to AML/CFT risks and implement appropriate internal frameworks to identify and mitigate them. This approach does not, however, prevent an institution from adapting its business model or discontinuing certain services for commercial reasons.

A risk-based approach under Luxembourg law

In Luxembourg, the amended Law of 12 November 2004 is based on a risk-based approach. Professionals are required to identify and assess risks relating, in particular, to their clients, the countries involved, products, services and transactions. The scope of due diligence measures must be proportionate to the risks identified, and professionals must be able to demonstrate that the measures adopted are appropriate. A client profile involving risk factors, such as political exposure, a complex ownership structure or activities across several jurisdictions, therefore calls for a tailored assessment rather than automatic exclusion.

Enhanced Due Diligence

In practice, depending on the circumstances, professionals must apply Enhanced Due Diligence (EDD) measures and conduct more in-depth checks on the identity of the client and its beneficial owners, develop a better understanding of the purpose of the business relationship, obtain information on the source of funds or wealth, and strengthen transaction monitoring. The law provides for enhanced due diligence measures where the level of risk warrants them. The nature and intensity of these measures should be determined in light of the specific circumstances and reassessed whenever new information becomes available.

Client cooperation and supporting documentation

Client cooperation is also essential. Providing accurate information and sufficient supporting documentation enables professionals to better understand the client’s activities and intended transactions. Where standard documents cannot be provided, it may be appropriate to consider whether alternative information or methods can satisfy the applicable requirements. This possibility does not, however, relieve professionals of their own due diligence obligations or the requirement to obtain sufficient information to understand and assess the business relationship.

Documenting decisions on business relationships

The decision to maintain or terminate a business relationship should therefore be based on a documented assessment of the circumstances. It is recommended that professionals retain records of the elements considered, the checks performed, any limitations encountered and the reasons underlying the decision. Such documentation helps demonstrate that the assessment was conducted on an individual basis and that the measures adopted are consistent with the risks identified.

When termination becomes necessary

Terminating a business relationship may become necessary where a professional is unable to fulfil the due diligence obligations imposed by law. This situation must be distinguished from a purely commercial decision, such as one arising from changes to an institution’s strategy or service offering. In all cases, the decision must be made in accordance with the applicable legal and regulatory requirements, taking into account the specific circumstances and any additional obligations.

For banks, PSFs and insurance professionals, the challenge is therefore to establish clear procedures and a consistent decision-making framework that enables them to prevent risks without resorting to unjustified blanket exclusions.

How can CM Law assist?

CM Law supports professionals in assessing their AML/CFT risks, reviewing their internal procedures and analysing complex situations relating to the establishment, maintenance or termination of business relationships. This support aims to ensure sound decision-making, strengthen compliance practices and promote risk management that is rigorous, proportionate and sustainable.