The Two Debanking Camps are Both Missing the Point

Chris Sidler is a Partner at FS Vector, a regulatory advisory firm focused on financial services and fintech. He was previously the co-head of Promontory Financial Group’s financial crime compliance advisory practice in the Americas.

Open Banker is made possible by our sponsors.

Washington is having two debanking conversations at once. Both describe real harm, and each has a theory of the case. Neither gets at the root cause.

On one side, conservatives and crypto founders testify before the House Financial Services Committee about Operation Choke Point 2.0, armed with FDIC “pause letters” and stories of accounts closed without explanation. On the other, advocates for immigrant communities, sex workers, cannabis businesses, and money service operators have raised the same concerns for twenty years, with far less congressional attention to show for it.¹ Crypto founders arrived with capital, lobbyists, and a grievance the President shares personally:  President Trump has said banks cut him off after 2021. Within days of returning to office, he pressed the point directly to the chief executives of Bank of America and JPMorgan at Davos.² The communities that preceded them arrived with the same facts and a fraction of the institutional leverage.

Both groups treat exclusion as something someone chose to do to them. They say hostile regulators weaponized supervision against disfavored industries (crypto, sex work, cannabis) or discriminated against marginalized groups (immigrants, conservatives). Their proposed fixes are slightly different, with crypto and conservatives leaning toward limiting the regulators or their tools, while others advocate for naming, shaming, and mandating access. The more uncomfortable truth is that the Bank Secrecy Act, passed way back in 1970, established a framework that makes blanket exclusion the rational choice, even for institutions that harbor no animus at all. Until the incentives shift, executive orders and congressional hearings will produce noise but not change.

The Mechanism: Reputational Risk as Regulatory Cover

Put yourself in the chair of a bank compliance officer. Missing a suspicious transaction, failing an exam, or appearing in an enforcement action carries severe consequences ranging from regulatory penalties to personal liability, often accompanied by front-page coverage. Filing a Suspicious Activity Report that goes nowhere costs essentially nothing. And the bank almost never learns whether a filing went anywhere: the most recent public estimate of how often law enforcement gives the filer feedback on a SAR dates to 2018, when a bank trade group put it at a median of 4%. Exiting an entire customer category because someone flagged it as “high risk” costs the relationship, but not much else. No metric measures over-exclusion. No regulator grades you on how many legitimate customers you turned away.

Under those conditions, de-risking is the move.

The regulatory concept that enables this is “reputational risk.” Bank examination frameworks have long included reputational risk alongside credit, market, and operational risk as a category institutions must manage. The practical effect:  a compliance team can decline to serve an entire industry (adult entertainment, cannabis, money services, firearms dealers) without performing an individual risk analysis, simply by citing the category’s reputational exposure to the institution. It gets documented, it holds up in exams, and nobody ever has to explain why a specific business was turned away.

This is how “we’re uncomfortable with that customer type” becomes a compliance policy. Once it is embedded in internal guidance and examination expectations, individual underwriting never happens. The decision gets made at the portfolio level and never revisited, and nobody along the way needs to hold any view about the customer at all. The framework makes exclusion free, and in a regulated institution anything free that also reduces exam risk gets consumed at scale.

I have seen this from the inside. I’ve worked with banks facing scrutiny over accounts held by nonresident aliens from higher-risk jurisdictions, many of them students spending a few years in the United States, and I’ve sat in more than one conversation about whether that business was worth maintaining at all. What stays with me is where the burden fell. It was never enough to focus on the few students who might have posed real risk. The compliance obligation attached to the other 99 percent who didn’t. Nobody in the room was hostile to the customers. The question was whether the overhead of the whole category justified keeping it, and under current incentives the honest answer was often no. A twenty-year-old on a student visa loses her checking account not because anyone suspects her of anything, but because the exam-cycle math says her category isn't worth the trouble.

Who Gets Debanked

The Free Speech Coalition’s 2022-23 survey of more than 600 adult industry members found that 63% of those earning income in the industry had lost a bank account or financial tool because of their work, 46% of creators lost a financial services account in the prior year, and 36% of adult businesses lost a bank account outright in the same period. 

Similarly, 2024’s fourth quarter FinCEN SAR filing data indicated that fewer than eight percent of US banks and credit unions served state-licensed cannabis businesses.³ The scarcity of depository institutions leaves dispensaries that pay state taxes and employ local workers running on cash and alternative payment methods. 

Money service businesses providing remittance services to immigrant communities have been losing banking relationships for over a decade, and not only in the United States. In 2013, months after HSBC’s $1.9 billion AML settlement, Barclays moved to exit the money transfer category wholesale, closing accounts for roughly 250 operators, including Dahabshiil, the last Somali remittance firm banked by a major UK institution. For a sense of scale, the Somali diaspora was sending home about $1.3 billion a year, more than all humanitarian and development aid to the country combined and as much as 40 percent of its economy. Barclays wasn’t responding to any misconduct of its own; it looked at what had just happened to HSBC and priced the category accordingly. It took a High Court injunction to keep the corridor open.

The FDIC documented the pattern in the United States in 2015 and issued guidance acknowledging that wholesale MSB de-risking was a systemic problem, with limited effect on the underlying incentives. The pattern persists because the underlying arithmetic hasn’t changed and the downside of getting MSB services wrong is an enforcement action while the downside of turning them away is… nothing.

Crypto belongs on this list too. The House committee’s report documented at least 30 digital asset firms and individuals losing access to financial services, and the FDIC’s pause letters show regulators leaning on the scale. But notice what made that pressure so effective:  nobody had to order a single account closed. A nudge sufficed, because the framework had already made exit the cheap answer. 

The incentive structure is identical across all of them. So is the outcome, across industries, coalitions, and decades.

The SAR Volume Problem

I could almost defend the current system, if it worked.

Under Secretary for Terrorism and Financial Intelligence John K. Hurley told the ACAMS Assembly in September 2025 that AML programs, “should deliver better outcomes by providing [law enforcement and the national security establishment] with the most useful information, not by overwhelming the system with noise,” and criticized the proliferation of “not-so-useful” filings. Financial institutions filed a record 4.1 million SARs in 2025, up roughly 8 percent from the year before, and the record was set the same year that Treasury was asking for less noise. The utility of those filings goes largely untracked, and what measurement exists runs in one direction:  agencies report how often they search the database, not which filings were worth making. Banks have no feedback loop. They don’t know which SARs led to investigations, prosecutions, or asset seizures. And the global scorecard is grim:  one widely cited academic estimate from 2020 puts the share of criminal proceeds actually intercepted by the entire AML regime at well under 1%.

The result is a framework that generates enormous compliance burden, produces questionable law enforcement output, and systematically excludes entire economic sectors from the banking system.

The EO Gets One Thing Concretely Right

President Trump’s August 2025 Guaranteeing Fair Banking For All Americans executive order frames its argument around political and religious discrimination, limiting its policy reach. Buried in its provisions is something more structurally significant:  a directive for federal banking regulators to eliminate “the use of ‘reputation risk or equivalent concepts’ as a factor in banking decisions” and to scrub related references from supervisory materials, guidance documents, and examination manuals.

The OCC moved first, announcing in March 2025 that it would cease examining banks for reputation risk. The OCC and FDIC then finalized a rule in April 2026 codifying that prohibition, effective June 9, with the Federal Reserve following a parallel path. Removing reputational risk as a freestanding supervisory category strips away the cover that categorical exclusions have relied on for decades. If a bank can no longer cite “reputational exposure” as the basis for exiting an industry, it has to articulate an actual risk basis, and that is a real change.

But removing reputational risk doesn’t fix the underlying incentive problem. A bank that can no longer cite reputational risk can still cite BSA exposure, exam findings, or operational risk, and reach the same conclusion. The incentive asymmetry remains:  no cost for turning customers away, significant cost for serving them and getting it wrong.

FinCEN’s Proposed Rule is a Start, But Stops Short

The FinCEN proposed rule on AML/CFT programs, published in April, is the most consequential reform attempt in years. It proposes to move the compliance standard away from process and volume toward documented outcomes and effectiveness. Institutions would be expected to demonstrate that their AML programs are “reasonably designed” to generate information that is actually useful to law enforcement, not merely that they filed the required number of reports and checked the required boxes. If finalized, this would make grading programs on outcomes, not process, possible.

But FinCEN can – and should – go farther. The proposed rule doesn’t directly address de-risking. It offers no safe harbor for banks that conduct documented, individualized risk assessments and choose to serve higher-risk customers responsibly. No requirement exists to measure financial exclusion as an outcome. No feedback mechanism lets banks learn whether specific SAR filings produced investigative value. And no supervisory signal treats blanket categorical exclusion as a compliance failure worth examining.

Without those elements, a better-designed outcomes framework still has no cost for de-risking. It will produce better paperwork and the same debanking.

What Else Would Move the Needle

Three additions to the final rule and the surrounding supervisory posture would make a material difference.

First, safe harbor protection for risk-based programs. Banks that conduct and document individualized risk assessments, rather than applying categorical exclusions, should have protection from enforcement action when they serve higher-risk customers and something goes wrong. The obvious objection is that a documentation-keyed safe harbor becomes a paperwork shield. So don’t key the protection to paperwork. Condition it on demonstrated outcomes, such as periodic sample testing showing the institution maintains accounts in the categories it claims to assess individually, rather than on the existence of a risk memo.

Second, SAR feedback loops. FinCEN should report regularly to filers on the downstream utility of their submissions:  which SARs generated investigative interest, what types of filings are adding value, what patterns law enforcement finds useful. Law enforcement will resist, with some reason, since granular feedback can telegraph investigative priorities. Aggregated and lagged reporting solves most of that problem, and it would still be more signal than banks get today. This is also nontrivial work. Tracing utility across millions of filings and dozens of law enforcement agencies takes data infrastructure and analysts that FinCEN, chronically stretched, does not currently have. Congress already gestured at this in the Anti-Money Laundering Act of 2020, which requires annual reporting on whether BSA data produces arrests and convictions and directs FinCEN to publish threat patterns and trends. Neither provision sends utility signals back to the institutions doing the filing, and neither provides the budget to do so. If lawmakers want an effectiveness-based regime, they have to fund the agency that measures effectiveness. 

Third, de-risking as a tracked supervisory concern. If examiners can assess the quality of a bank's SAR program, they can also assess the breadth of its exclusions. An institution that has effectively exited entire legal industries without documented risk analysis should face supervisory questions, not silence. The objection is that this looks like Operation Choke Point pointed the other way. But Choke Point pressured banks toward outcomes regulators preferred; this requires only that a category-wide exit be explained like any other portfolio decision. Nobody is forced to serve anyone; the cost of blanket exclusion simply becomes visible.

None of this restores the accounts already lost; better compliance design is not redress, but would be progress.

A Rare Moment of Alignment

Debanking has political salience across the spectrum for the first time in memory. Adult entertainers, crypto founders, cannabis operators, firearms dealers, and immigrant-owned MSBs all describe the same structural failure from different vantage points. The Trump EO created a policy opening, the reputational risk rule turned it into binding change, and the FinCEN proposal is the vehicle for the rest. With comments now in, the shape of the final rule is the live question. That kind of alignment doesn’t happen often, and it won’t last. It exists because the debanking of crypto founders and politically conservative customers added institutional weight to a grievance that marginalized communities had been raising for two decades without comparable effect. Anyone serious about fixing the underlying problem should understand what it took to get here.

The question is whether FinCEN's final rule addresses the incentive structure, or whether Washington declares victory on reputational risk removal and moves on.

The opinions shared in this article are the author’s own and do not reflect the views of any organization they are affiliated with.

^[1]  By contrast, cannabis banking did receive Senate Banking Committee attention in February 2025 in connection with the SAFER Banking Act. But that attention had much lower magnitude and formality. The crypto debanking complaints produced a multi-year House investigation, roughly two dozen FDIC “pause letters,” and a committee report. The MSB, adult entertainment, and cannabis debanking problems have been raised largely through advocacy channels and FDIC guidance, without equivalent formal Congressional investigation.

^[2]  Bank of America and JPMorgan deny closing accounts for political reasons.

^[3]  As a proxy for banks or credit unions that served MRBs, in that period, 507 banks and 182 credit unions filed marijuana-related SARs, measured against roughly 8,900 federally insured banks and credit unions nationwide.

Open Banker curates and shares policy perspectives in the evolving landscape of financial services for free.

If an idea matters, you’ll find it here. If you find an idea here, it matters. 

Interested in contributing to Open Banker? Send us an email at [email protected].