De-risking is a compliance strategy in which an organization limits, tightens, or ends a relationship that is judged too risky. In banking, that can mean closing an account, refusing a customer segment, or blocking certain payments after sanctions, fraud, or legal exposure reviews. The goal is to reduce regulatory, financial, or reputational risk when the institution cannot confidently manage it.
In cyber security, de-risking appears when defenders restrict remote access, disable high-risk integrations, or cut off third-party connections that could become an entry point for attackers. It can be a sensible control after repeated abuse, weak identity assurance, or uncertain jurisdictional issues. But it also has trade-offs: over-de-risking can interrupt legitimate operations, create shadow IT, or push risky activity elsewhere instead of removing it. Good practice is to pair de-risking with documented analysis, so a security or compliance team can show whether the action was a temporary safeguard, a policy decision, or a legal necessity.