A passport can affect a banking relationship without the passport holder being sanctioned, accused of wrongdoing or legally prohibited from holding an account.
That is uncomfortable, but it is important to describe accurately.
Financial institutions assess risk using combinations of identity, residence, geography, business activity, counterparties, source of funds, source of wealth and sanctions exposure. Nationality may appear inside that information set.
The line that matters is between case-by-case risk assessment and blanket exclusion by category.
Key takeaways
- Nationality is not the same as sanctions status. A person can be completely unsanctioned and still face enhanced due diligence because of wider geographic or financial-crime risk factors.
- Modern AML frameworks are supposed to be risk-based. FATF and the EBA explicitly reject the idea that entire categories of customers should automatically be cut off instead of assessed.
- Bankability depends on the whole factual profile. Residence, business activity, counterparties, source of funds and the economic reason for the account can matter as much as the passport itself.
Facts: geography is a recognised risk factor
FATF’s risk-based approach requires financial institutions to identify and understand money-laundering and terrorist-financing risk and apply controls proportionate to that risk.
FATF has also stated explicitly that its standards do not envisage cutting off entire classes of customers.
The European Banking Authority has published guidelines aimed at challenging unwarranted de-risking. Before rejecting or terminating a relationship on AML/CFT grounds, institutions are expected to consider the available risk-management options rather than treat exclusion as the default.
UAE rules provide a practical example of how geographic risk enters an institution’s methodology.
Current Central Bank guidance instructs licensed financial institutions to assess where a customer resides, is incorporated, does business, where counterparties are located and where transactions are expected. It also identifies sanctions, FATF-listed jurisdictions, corruption and other geographic indicators as relevant factors.
The same framework requires identification information that includes nationality.
That does not create a rule that one nationality is automatically “high risk”.
It creates a requirement to understand geography.
Interpretation: the passport is a signal, not a verdict
A bank needs to know who the customer is.
Nationality can help establish identity and can sometimes be relevant to sanctions or country-risk analysis. But a passport alone does not explain the customer’s actual financial activity.
Two people with the same nationality can present completely different risk profiles.
One may be long-term resident in a low-risk jurisdiction with transparent employment income, local tax filings and simple banking needs.
Another may operate companies across several high-risk jurisdictions, move large amounts through unrelated counterparties and provide weak source-of-funds evidence.
Treating those two people as identical because of nationality would not be sophisticated risk management.
The mechanism
The transmission mechanism is:
identity and geographic links → institutional risk model → due-diligence intensity → requests for evidence → onboarding delay, restrictions or exit if risk cannot be managed.
Sanctions create a separate legal layer.
If a person or entity is legally blocked under an applicable regime, the bank may be required to freeze or prohibit activity.
If the customer is not sanctioned, the bank may still decide that the relationship falls outside its risk appetite.
Those two outcomes can feel identical to the customer.
Legally, they are not.
Why Russia and Iran require careful language
Russia and Iran illustrate the importance of separating nationality from legal exposure.
Both are connected with extensive international sanctions regimes, but sanctions usually depend on specific legal criteria: listed persons, ownership and control, sectors, goods, services, territories and relevant jurisdictional nexus.
A Russian or Iranian passport does not by itself prove that a person is sanctioned.
At the same time, banks dealing with customers whose assets, business or counterparties touch sanctioned or higher-risk environments may need more information and may face correspondent-bank constraints of their own.
The practical friction is real.
The legal conclusion must still be specific.
The strongest countercase
Banks are not required to accept every risk.
AML/CFT obligations, prudential duties, fraud prevention, correspondent relationships and reputational considerations all create legitimate reasons to refuse business in some cases.
The EBA’s anti-de-risking guidance does not say that a bank must onboard every customer.
It says the decision should be grounded in a proportionate risk-management process rather than an indiscriminate category exclusion.
That is an important distinction.
Scenarios, not forecasts
Under more granular risk assessment, better data allows institutions to distinguish customers within the same nationality or geographic group more accurately.
Under persistent proxy risk, institutions continue using broad geographic signals because correspondent-bank, sanctions and compliance costs make finer analysis expensive.
Under stronger access safeguards, regulators require more documentation around refusal and termination decisions where financial exclusion becomes systemic.
Observable triggers include FATF and EBA guidance, bank-access rules, sanctions changes and supervisory enforcement.
Practical consequences
A customer cannot change legitimate risk factors by presentation alone.
But unnecessary friction can often be reduced by making the profile easy to understand.
That means clear evidence of residence, tax status, business activity, source of funds, source of wealth, beneficial ownership and expected transactions.
Where a person has links to several jurisdictions, the explanation should be coherent rather than artificially simplified.
Trying to hide a nationality, relationship or transaction is not a solution to de-risking.
It creates a new compliance problem.
The durable objective is not to appear risk-free.
It is to make legitimate risk assessable.
Sources
- FATF, Risk-Based Approach Guidance for the Banking Sector: https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Risk-based-approach-banking-sector.html
- FATF, Case-by-case, not wholesale de-risking: https://www.fatf-gafi.org/en/publications/Fatfgeneral/Rba-and-de-risking.html
- European Banking Authority, Guidelines to challenge unwarranted de-risking, 2023: https://www.eba.europa.eu/publications-and-media/press-releases/eba-issues-guidelines-challenge-unwarranted-de-risking-and
- Central Bank of the UAE, Geographic Information and Assessment of Risks, effective 7 November 2025: https://rulebook.centralbank.ae/en/rulebook/334-geographic-information-and-assessment-risks
- Central Bank of the UAE, CDD/KYC and Record-Keeping Guidance, effective 7 November 2025: https://rulebook.centralbank.ae/en/entiresection/6593
- Central Bank of the UAE, Natural Persons — identity information: https://rulebook.centralbank.ae/en/rulebook/321-natural-persons
Disclaimer
This Insight provides general banking and compliance analysis. It is not sanctions, AML, legal or banking advice. Financial institutions apply their own risk frameworks within applicable law, and sanctions conclusions depend on the specific person, ownership, transaction, jurisdiction and legal nexus.
