De-Banking Response Playbook for CASPs (2026)

The de-banking notice arrives in plain language: '90 days' or '60 days' or, in the worst cases, '30 days'. The bank thanks you for your business, regrets the change in commercial appetite, and gives you a calendar deadline by which the account will be closed. There is no negotiation in the letter and there is rarely a reason. From the moment you read it, the clock that determines whether your CASP keeps operating is running.

Every regulated crypto firm in the EEA should plan as if a termination notice is a question of when, not whether. The EBA Opinion on de-risking documents that banks close accounts of entire customer categories without case-by-case review, and the EBA Guidelines on money-laundering risk treat crypto exposure as elevated risk by default. A single supervisory inspection, a US correspondent bank withdrawing a nostro line, or a sister-bank failure can flip a relationship from 'core client' to 'exiting' in 14 days.¹^[1]²^[2]

This guide is the response playbook. It covers the first 24 hours, the 14-day plan, the formal options under EU payments and AML regulation, the communications discipline that prevents a notice from becoming an operational shutdown, and the architectural decisions that make the next notice survivable. Read it before you need it. The cost of preparation is small. The cost of improvising in week one of a 30-day notice is the business.

The day the notice arrives is the most decisive day in the entire process. Three things must happen before close of business.

• Acknowledge in writing — but do not negotiate. A formal acknowledgement preserves your right to reply substantively; an emotional reply (challenge, accusation, plea) often forecloses options.

• Convene the response team. CEO, MLRO, CFO, head of compliance, external counsel, head of operations. Two-hour standing call every working day for the duration of the notice.

• Activate backup banking. Notify your backup operating bank and prepare the migration plan. If you do not have a backup operating bank live and funded, that is now the most important task in the company.

Banks rarely give the real reason in writing. Five patterns drive the majority of CASP de-bankings.

• Generic policy change. The bank's portfolio review identified crypto exposure as inconsistent with new risk appetite. No specific issue with you. Hardest to recover from.

• Correspondent bank withdrawal. A US correspondent terminated the nostro line. Your bank now drops every crypto client. Almost impossible to recover.

• Specific compliance hit. A sanctioned-counterparty hit, a high-risk wallet attribution, or an AML alert was escalated to the bank and could not be resolved. Recoverable if remediation is credible.

• Concentration risk. Your CASP grew to where the bank's exposure to a single regulated-crypto client became uncomfortable on capital or limit grounds. Often softens to a volume cap rather than full closure.

• Relationship-manager change. The original sponsor at the bank left; the replacement does not have appetite for crypto. Sometimes recoverable through internal escalation; often not.

The diagnosis matters because it shapes the response. Generic-policy de-bankings are not negotiable; correspondent-driven closures are not survivable inside the existing relationship; specific-compliance de-bankings can sometimes be reversed with a credible remediation plan delivered in 14 days. The first conversation with your relationship manager — politely, on day 2 or 3 — is to identify which pattern applies.

Even a 90-day notice should be executed against a 14-day plan. Each day matters; later weeks are buffer.

EU regulation gives a de-banked obliged entity several formal channels. None of them are fast. None of them save you from the migration deadline. But they preserve the audit trail and they put pressure on the bank to give a substantive reason in writing — useful for the next bank's diligence file.

• Request reasons in writing. Under the Payment Accounts Directive, a payment service provider must give specific written reasons for refusing or terminating a basic payment account. Banks distinguish basic accounts from corporate operating accounts, but the request still puts the bank on the record.⁴^[3]

• EBA Opinion on de-risking referral. The Opinion criticised mass de-risking and asked NCAs to investigate cases where the closure was generic rather than case-specific. Filing a complaint with your home NCA's banking-supervision unit creates a regulatory record.

• Payment Services Directive Article 55 — minimum termination notice. Banks must respect the contractual notice period (typically 60 days for SEPA accounts). If the bank tries to compress the notice, this is your immediate legal lever.³^[4]

• Litigation as last resort. Wrongful termination claims under national contract law can succeed but take 12–36 months. Useful for damages if you survive the operational disruption; rarely useful in real time.

The single biggest determinant of whether a de-banking event becomes an existential incident is customer communication. Done early without a plan, it triggers a withdrawal run. Done late, it triggers complaints to the NCA and reputational damage. Done with discipline at week 2 with a concrete migration plan, it is operationally manageable.

• Send a single email and a single in-app notification. Specific dates. New IBAN published. Action required from the customer (none, ideally — old IBAN remains active until cutover).

• Train customer support to handle every variant of 'is my money safe?'. The answer: yes, client funds are safeguarded at a separate bank under MiCA Article 75 and the change is to operating banking only.

• Update FAQ + help centre with the new IBAN, the timeline, and the safeguarding architecture. Link the FAQ in every email.

• Pre-brief major counterparties — institutional clients, market makers, OTC desks — 48 hours before public communication. They will appreciate the courtesy and reduce the gossip surface.

If you survived this de-banking event, the right next move is to ensure the next one is uneventful. The architecture below is the standard for serious CASPs in 2026.

• Don't litigate first. Litigation is for damages after survival, not for keeping the account open during the notice period.

• Don't go public. Press coverage of de-banking accelerates correspondent-bank flight and makes the next bank's diligence harder.

• Don't bypass the MLRO. The MLRO must own the AML-related diagnostic; bypassing them creates governance gaps the next bank will spot.

• Don't move client safeguarding through the operating account during migration. Ring-fence integrity is the single most important property to preserve.

• Don't accept a verbal account-closure decision. Always require a written termination letter with the contractual notice period.

Confirm the notice in writing, request the formal termination letter, and convene the response team within 4 hours. Then activate the backup operating bank. Do not tell customers, do not announce publicly, do not litigate. The first 24 hours determine whether the next 90 days are survivable.

Yes, generally. The Payment Services Directive Article 55 and most EEA national framework contracts permit termination on a contractual notice period — typically 60 days for SEPA-registered accounts and 30 days for some commercial accounts. The minimum notice is contractual, not statutory in most cases. Check the framework contract before assuming the bank has overstepped.

Probably not in your specific case. The EBA Opinion on de-risking creates supervisory expectations on banks to assess crypto firms case-by-case rather than as a blanket category, but enforcement is patchy. The value of the complaint is preserving the audit trail — not the immediate remedy. The next bank you apply to will read your filing record favourably; banks asking 'why did the previous bank close?' are easier to answer when you have a documented EBA / NCA complaint than when you have nothing.

Only if you do it badly. MiCA Article 75 requires safeguarded client assets to remain segregated and identifiable at all times. Moving the safeguarding account to a different credit institution during a de-banking event is permitted but requires NCA pre-notification, daily reconciliation evidence during the migration, and external attestation that no client asset shortfall occurred. Done with the MLRO, head of operations, and external counsel coordinating, the migration is supervisable. Done in a panic, it is licence-threatening.

No. Operating accounts are not strictly required by MiCA, but practical operations, supplier payment, payroll, tax, and client safeguarding all assume access to credit-institution rails. A CASP that loses all banking simultaneously must surrender the licence or pause operations. The system is designed to make banking de-risking expensive but recoverable — the second bank, the third bank, and EMI rails together provide the redundancy that makes single-bank loss survivable.

No. Public threats accelerate correspondent-bank flight from your other relationships, make the next bank's diligence harder, and rarely change the closing bank's decision. Privately preserve litigation rights through written correspondence and let your lawyer manage the legal posture; publicly maintain operational discipline. Most de-banking lawsuits that succeed do so 18–36 months later — survival of the next 90 days is a separate problem from the litigation timeline.

• How to Get a Bank Account for a VASP or CASP: The 2026 banking playbook for regulated crypto firms

• MiCA Compliance Guide for CASPs: Authorisation walkthrough — capital, governance, supplier stack

• AML Compliance for Crypto Firms: What the 6AMLD requires from CASPs and VASPs

• EMI vs PSP vs VASP vs CASP: Which financial licence do you actually need?

De-banking is not a question of whether for a regulated crypto firm in the EEA — it is a question of when and how often. The CASPs that survive long-term are the ones that ran the response playbook before they needed it: backup banking live and funded, safeguarding ring-fenced from operating, customer communication scripts pre-approved, and an annual drill that exposes the gaps. Build the architecture in the calm. Run the playbook in the storm. The notice will come.