Nothing to Disclose: When the Exit File Becomes the Defence

On 31 July 2026, lawyers for Capital One asked a federal court in Florida to dismiss, this time with prejudice, a claim brought by entities connected to the Trump Organization over the closure of roughly 385 accounts in 2021. The motion targeted a second amended complaint filed after an earlier dismissal and a 90-day discovery period. The bank's answer rested on two propositions. The first was contractual, and the account terms said it plainly: Capital One could close any account "at any time, for any or no reason and without notice".

The second proposition was evidential. The bank said the closures followed "months of analysis and a careful review" by a financial crimes team staffed by people with decades of law enforcement experience, and were made for anti-money laundering reasons rather than in retaliation for the events of 6 January 2021, as the plaintiffs allege. Much of the plaintiffs' case is not publicly visible: substantial portions of the July complaint remain sealed, including a section devoted to those events, and the filings indicate the Trump companies were given no opportunity to address any compliance concern before closure. Yet the significance of the filing lies not in who brought the claim. It lies in what a bank has been required to produce.

Exit was once unexamined

Offboarding has long been the least scrutinised decision in financial crime compliance. Onboarding is documented because a regulator will ask; transaction monitoring is calibrated because a supervisor will test it; the decision to end a relationship has historically required no explanation to anyone. The Financial Action Task Force definition of de-risking, quoted by the Financial Conduct Authority (FCA) in its 2023 review of account access and closures, describes institutions terminating or restricting relationships with clients or categories of clients to avoid rather than manage money laundering risk. It has been criticised on those terms since 2014 without ever being made reviewable.

The recorded reason and the operative reason have never been the same document. The US Treasury's 2023 De-risking Strategy found that profitability is the primary factor in de-risking decisions, influenced by the cost of controls commensurate with the risk a customer poses. The FCA's companion research note on international perspectives on de-risking reached a similar view, finding that anti-money laundering concerns might determine which customers are reviewed, but that exit decisions also turn on compliance costs, regulatory fines, individual accountability, reputational risk and client profitability. That asymmetry survived because nobody was entitled to interrogate it.

The file is now discoverable

Three developments have ended that. The first is litigation. In March 2026 Judge Roy Altman granted Capital One's motion to dismiss the first amended complaint without prejudice, ordered 90 days of discovery and directed the plaintiffs to file again by 2 July. Discovery is the point at which an exit rationale stops being a compliance artefact and becomes an exhibit.

The second is prosecutorial. The Wall Street Journal reported in June 2026 that federal prosecutors in Washington had issued subpoenas to JPMorgan, Bank of America and Wells Fargo seeking lists of customers allegedly debanked together with the reasons for each closure; Jeanine Pirro, the US Attorney for the District of Columbia, subsequently confirmed that her office had done so. The third is disclosure to markets. In August 2026 US Bank told investors it was cooperating with pending examinations and investigations into debanking activity, any of which could lead to proceedings, fines or restitution.

There is an awkwardness in the middle of this. Capital One argues both that it had no obligation to explain itself and that federal banking secrecy law would have barred it from disclosing internal anti-money laundering findings even had it wished to; it has separately asked the court to keep one exhibit passage sealed on Bank Secrecy Act grounds. The defence therefore rests on a document that cannot be shown in full. That is not a shield. It makes the quality of the file the whole of the argument, because nothing else will be visible.

Reputation risk has been withdrawn

Meanwhile the vocabulary available for justifying an exit has narrowed. Executive Order 14331, "Guaranteeing Fair Banking for All Americans", signed on 7 August 2025, directed federal banking agencies to ensure institutions do not limit access to services on the basis of reputation risk. The Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation adopted a final rule codifying the elimination of reputation risk from their supervisory programmes, effective 9 June 2026. Michelle Bowman, the Federal Reserve's Vice Chair for Supervision, called it a "vague and inherently subjective standard" when the Board proposed codifying the same removal on 23 February 2026. On 2 June the three agencies jointly stripped references to reputation risk from a set of interagency documents.

The direction was set by supervisory findings. The OCC released preliminary findings in December 2025 from its review of debanking at the nine largest national banks it supervises, naming JPMorgan Chase, Bank of America, Citibank, Wells Fargo, US Bank, Capital One, PNC, TD Bank and BMO. Between 2020 and 2023, it reported, each of the nine maintained policies restricting certain sectors' access or requiring escalated approval, and the basis often extended beyond core financial risk to the effect on the bank's reputation. The sectors ranged from Arctic oil and gas and coal to firearms, private prisons, payday lending, tobacco, adult entertainment, political action committees and digital assets.

One line in that report deserves more attention than it has received. Restrictions on digital asset activities, the OCC recorded, were "often attributed to financial crime considerations". The migration has already happened once, and a regulator has documented it. Yet removing a category from the supervisory lexicon does not remove the underlying commercial decision; it changes the column in which that decision is recorded. Where reputational discomfort can no longer be written down, pressure falls on the one heading that remains defensible, which makes financial crime at once the most attractive and the most exposed reason a firm can give.

The UK has drawn the same line

The UK reached the same position by statute. From 28 April 2026, regulation 51B of the Payment Services Regulations 2017, inserted by the Payment Services and Payment Accounts (Contract Termination) (Amendment) Regulations 2025, requires a provider terminating an indefinite framework contract entered into on or after that date to give at least 90 days' notice. That notice must explain the reasons in terms that are "sufficiently detailed and specific" to enable the customer to understand why, and must set out how to complain and any right to go to the ombudsman scheme.

The exceptions are where the argument sits. Regulation 51B(4) provides that where those requirements conflict with another legal requirement, the other requirement prevails to the extent of the conflict. Regulation 51C removes the notice obligation altogether in five defined situations, two of which are squarely financial crime: where the provider is required to apply customer due diligence and is unable to, and where it has reasonable grounds to suspect that a payment service has been, is being or will be used in connection with a serious crime. The remaining three cover immigration closures, terminations directed by the authorities, and customer conduct towards a third party reasonably believed to involve an offence. Britain has written the American position into legislation, and has drawn the exception more precisely than any US court has yet had to.

An exemption invoked is not an exemption unexamined. Silence under regulation 51C is a positive assertion that a defined statutory condition was met on a particular date, and a firm relying on it will be asked which condition, on what evidence, decided by whom. Older contracts remain on the two-month regime, so firms will run parallel populations for years.

Firms recorded reasons, not evidence

Yet the records that must now carry this weight were not built to. The FCA gathered data from 34 firms covering July 2022 to June 2023 and could not reliably aggregate it, because some firms reported at account level and others at customer level. Several firms gave "Other" as the primary reason for more than half of their personal account suspensions, and the regulator excluded some submissions entirely where the reported reasons did not sum to a plausible total.

Financial crime suspicion and due diligence concerns, alongside dormancy, were overwhelmingly the most common primary reasons recorded, and the FCA observed a significant increase in accounts closed on financial crime grounds. Four cases citing expression of political or other opinions were reported; on follow-up, the primary reason in the majority proved to be customer behaviour. Reputational risk closures were reported inconsistently and came predominantly from payments firms. A file adequate for an internal exit committee is not a file adequate for discovery, and the distinction between a due diligence failure and an actual suspicion, which many systems record identically, is precisely the distinction a court will press.

Effectiveness raises the evidential bar

The supervisory standard is moving the same way. On 10 April 2026 the Financial Crimes Enforcement Network (FinCEN) published a proposed rule to reform anti-money laundering and countering the financing of terrorism programme requirements, with comments closing on 9 June. Its architecture matters more than its language. It separates deficiencies in a programme's design, which it calls establishment, from failures in its operation, which it calls maintenance; for banks, FinCEN indicates it would generally not bring enforcement action where a programme has been established, and that significant supervisory action would generally follow only a significant or systemic failure to maintain it.

An exit decision is a maintenance question. It is the programme executed in practice, on one customer, on one day, and it is now the part most likely to be read by someone hostile. FinCEN must also weigh statutory factors from the Anti-Money Laundering Act of 2020, among them extending financial services to the underbanked and directing resources towards higher-risk customers rather than lower-risk ones. Those two propositions are difficult to reconcile with a categorical exit. The Federal Reserve issued its own aligned proposal on 7 July 2026.

Three things follow for firms. Exit rationales should be written as contemporaneous evidence rather than as case-closure notes, naming the decision-maker, the specific risk identified and the material relied upon. The suspicion narrative should be structurally separated from the commercial and operational rationale, so that the disclosable part can be disclosed without touching the protected part. And retention should be set against limitation and litigation horizons rather than policy defaults, because a decision taken in 2021 is being litigated in 2026.

The file is the decision

For a decade, de-risking has been framed as a policy problem: too many customers exited too bluntly, with too little regard for financial inclusion. That framing has been overtaken. De-risking is now an evidential problem, and the evidence is the file nobody expected to be read. The phrase 'nothing to disclose' was once a complete answer to a departing customer; it has become a position that must be defended, years after the analyst who wrote the closure note has left the firm.

Regulators on both sides of the Atlantic have removed reputation risk from the vocabulary and preserved financial crime as the one reason that need not be explained. That is a narrow gate, and traffic through it will rise. Firms that treat it as an exemption will discover it is a burden of proof; firms that treated exit as the end of a relationship will find it is the beginning of a record.

Does your firm's exit file say anything a hostile reader could not take apart?

If not, we can establish the position and strengthen it before someone else does; contact us.

At OpusDatum we read offboarding files the way an opponent will read them, months or years after the relationship ended. Our work separates due diligence failure from genuine suspicion, distinguishes protected reporting material from disclosable rationale, and establishes whether the reason recorded on the file is the reason the decision was taken.