Every bank remembers fraud risk. That is why most financial professionals, even those far removed from compliance, have encountered some form of a stop list during their careers. Yet the surprising part is how little the financial services industry has standardized the tool it uses to preserve that memory.

Indeed, no regulator has fully defined what a stop list should be, whether an institution calls it an internal watchlist, negative file, prior-exit marker or something else. Nor is there a single legal or regulatory framework prescribing how such lists should be built, reviewed, and applied. While a stop list is a critical tool — it’s basically an official record containing details of payment cards, accounts, or other financial instruments that the institution has prohibited from being used — financial institutions are pretty much free to create and use them as they see fit.

That freedom inevitably has a cost, however. Without disciplined rules for inclusion, review, expiration, and escalation, a stop list can become either ineffective or destructive by failing to stop genuine repeat risk while, conversely, blocking legitimate business on the basis of stale, incomplete or context-free information.

For financial institutions then, the broader question is therefore not whether they should remember risk, but how credible risk information should be preserved and used when the same risk returns through a new account, product, or program.

September’s fraud actions

This past September added two unusually large data points to that debate. On September 14, the U.S. Small Business Administration (SBA) suspended 870,000 borrowers tied to an estimated $39 billion in suspected fraudulent Paycheck Protection Program (PPP) and COVID-19 Economic Injury Disaster Loan (EIDL) activity, making them ineligible for future SBA lending and other SBA programs. Eight days later, the U.S. Centers for Medicare & Medicaid Services (CMS) announced that it had canceled approximately 315,000 unauthorized Marketplace enrollments covering more than 760,000 individuals, with an expected return of roughly $2.2 billion in taxpayer-funded subsidies.

For a bank, however, 870,000 borrowers and 760,000 individuals do not necessarily translate into 1.63 million relationships. The same person may appear as a private customer, entrepreneur, beneficial owner, company officer, or controller across multiple entities and accounts. That creates a more difficult question for financial institutions: When government authorities have already identified credible fraud risk, should those signals become part of a bank’s own risk-memory architecture and, if so, under what safeguards?

The real challenge for banks is that a government risk list identifies who was flagged and not necessarily who was behind the activity. Some listed borrowers may have acted on their own; others may have served as money mules, nominees, or front-end participants for broader organized fraud networks. If institutions preserve only primary identifiers — the name, date of birth, and identity document — they risk remembering the visible participant while forgetting the infrastructure that made the fraud possible.

Banks should preserve the pattern

That is why historical indicators associated with government-program fraud should be re-examined across current customer populations using more than identity data alone. Where legally available, banks should look for recurring device, network, and behavioral signals that connect apparently unrelated customers or programs. For example, IP addresses may be easily replaced through VPNs and proxy services, but more persistent device and account-linkage indicators can be harder and more costly for criminal groups to recreate.

The goal should be not simply to remember the person, but to identify the pattern behind the risk. A weak stop list preserves identities, and a stronger one preserves relationships — the strongest risk-memory systems preserve the pattern itself.

Preserving the pattern, however, is only half the job. The other half is deciding what its reappearance should trigger.

September’s federal actions make that question unusually concrete. The novelty is not another pandemic-fraud scheme, because those have been known for years. What is more significant is the response because SBA’s September action combined suspension from future programs with repayment demands, collection by the U.S. Treasury Department, and potential law-enforcement referral. In other words, identified risk no longer matters only to yesterday’s investigation — it can shape tomorrow’s eligibility.

The danger of going too far

For banks, that is where the analogy becomes useful and dangerous if taken too far. A federal suspension, fraud finding, or adverse program decision may be highly relevant, but that relevance does not automatically mean equivalence. Banks still need to determine how that signal actually maps to their own legal obligations, risk appetite, and customer relationships.

Indeed, the purpose of risk memory is not to outsource judgment, but rather to ensure that credible information is not forgotten when the next decision is made. Treating every match as an automatic no turns risk memory into a blacklist. Conversely, treating every match as merely informational makes the stop list too weak to prevent repeat risk.

Depending on the underlying circumstances, the appropriate response may instead be rejection, enhanced due diligence, escalation, temporary restriction, or simply additional context for a future decision. A stop-list match should therefore not automatically answer the question; instead, it should determine which question must be asked next.

Of course, the hardest question for banks may not be who appears on the list, but who within the bank decides what that appearance means. Governance therefore becomes the decisive layer.

Institutions need clear inclusion standards, periodic review, defined escalation authority, and documented override mechanisms. Without them, a control that’s designed to prevent repeat fraud can gradually become a permanent sanction imposed without formal process.

That’s why the future of stop lists is therefore unlikely to be a larger blacklist. It is more likely to be a smarter form of risk memory — one that preserves context, recognizes relationships, and triggers proportionate action rather than automatic exclusion.

Financial institutions understand that everyone — and every institution — makes mistakes. The real difference is whether institutions learn from them or repeat them. Risk memory exists so that when a known risk returns, the institution does not have to learn the same lesson twice.

You can read more from this author here