Three Judgments, One Rule: Why Debanking Risk Now Belongs in Your Fact-Find

1. What the court decided

The Victorian Supreme Court has sided with Bendigo and Adelaide Bank over its decision to close accounts held by Gotham City, a licensed South Melbourne brothel, and associated businesses.

The plaintiffs argued two things: that the bank had discriminated against them because they operate in the lawful sex industry, and that it had failed to properly follow its own AML/CTF procedures before terminating the accounts. The court rejected the discrimination claims, finding that the bank had a rational basis for assessing potential money laundering risk — while also finding no evidence that actual money laundering had occurred.

The court accepted that the plaintiffs’ status in the sex industry was a protected attribute, but concluded it was not “a reason of substance for the Bank making the Exit Decision”.

The reasoning turned on a distinction worth quoting in full, because it is the whole case: “The Bank emphasises the word ‘potential’ here: it is the risk of money laundering, not the actuality of it, that the AML regime requires the Bank to identify, mitigate and manage.” And: “The Bank had a rational basis for the Exit Decision on the basis of potential money laundering.”

Banking Day reports the case as [2026] VSC 513 before Justice Patricia Matthews, and reports that the operator, Francesco Puleo, testified that six banks had previously exited the business, beginning with NAB in 2021. Those details come from a single outlet and could not be independently verified against the primary judgment, which was not publicly accessible at the time of writing.

2. What actually triggered it

The detail matters, because it shows how ordinary the triggers can look.

The bank’s transaction monitoring generated five AML alerts between June and September 2024. The flagged activity included a $6 million bank cheque withdrawal, a $50,000 cash withdrawal in $100 notes for overseas travel, foreign cash debits exceeding $88,000, and 99 electronic payments totalling $945,066 from a business trading as “24Hr Lube”. The bank also raised concerns about private ATMs at the premises, replenished with roughly $50,000 at a time.

Notably, the bank’s own AML/CTF program initially classified brothels as “Prohibited Customers”, and reclassified them in December 2024 to “Prescribed High Risk Customers” — enhanced due diligence rather than outright exclusion. The bank moved toward a more nuanced position, and still exited this customer.

None of the flagged conduct was found to be unlawful. High-value cash movements were analysed as potentially consistent with layering, the second stage of money laundering. That is the point: the pattern was enough.

3. Three cases, one consistent rule

Taken alongside two earlier decisions, a clear position has emerged.

In Merciful Group Incorporated v Norfina Limited [2025] NSWSC 841, Hammerschlag CJ held that the bank’s contractual termination right rested on its “legitimate interests” — defined to include “legitimate business needs, prudential requirements” and protection against “material risk of… financial detriment”. The bank did not need to prove actual wrongdoing; it needed to show it held “a rational honest opinion” that termination was justified. The court found no requirement for the bank to put its concerns to the customer beforehand or allow a response.

In Bano Pty Ltd v Australian Settlements Limited [2026] FCA 932, the Federal Court refused urgent injunctive relief to a fintech trying to stop its payments provider suspending access on AML grounds, holding that a court “ought be reluctant to require… an entity which is obliged to comply with the AML/CTF Act… to continue in a contractual relationship with a counterparty that it has genuinely assessed as posing an unacceptable risk”. The risk factors that justified the exit included incomplete transaction information, cryptocurrency exposure, deficient compliance processes and minimal suspicious matter reporting.

Put the three together and the rule is: a documented, rational risk assessment is close to a complete defence; actual wrongdoing need not be established; and there is generally no procedural obligation to warn the customer first.

There is an irony worth noting for context. In the same week this judgment was reported, APRA imposed licence conditions on Bendigo and Adelaide Bank over weaknesses in its non-financial risk management. The bank successfully defended the rationality of its AML risk process in court while its broader risk governance was being formally criticised by its prudential regulator. Both things can be true, and both point the same way: institutions are being pushed hard toward exiting risk rather than managing it.

4. Why this lands on brokers

It would be easy to file this as a banking law story. It is not, for a simple operational reason: debanking kills deals.

Consider what a broker relies on to write a commercial or self-employed residential deal. Twelve months of business transaction statements. A trading history the lender can verify. A functioning account for the facility to be drawn to and repaid from. A settlement pathway. Every one of those depends on the client having a bank.

Now consider the sequence the case describes. Monitoring generates alerts across a few months. The institution forms a view. The accounts close. On the authorities above, there may be no warning and no allegation of wrongdoing, and challenging it is expensive and unlikely to succeed.

If that happens to a client mid-application, the deal does not merely slow down. The income evidence becomes historical, the servicing account disappears, and the lender is now looking at an applicant whose banking has just been terminated — which is itself a credit signal, whatever the underlying facts.

This is a live risk in exactly the segment brokers have been encouraged to grow into. Cash-intensive businesses, sole traders with irregular deposits, clients with international payments, businesses in adult, gaming, crypto-adjacent, scrap metal, vehicle trading or remittance sectors — all lawful, all bankable, all capable of producing a monitoring profile that reads badly.

5. What to actually ask, and when

The intervention is early and cheap. It belongs in the fact-find, not in the file review.

Ask directly: has any bank ever closed, declined or restricted an account for this business or its directors? If the answer is yes, you need to know which institution, when, and what reason was given — noting that no reason may have been given at all.

Then ask the questions that predict future alerts rather than describe past ones. Does the business handle significant cash? Are there regular international payments or receipts? Does it operate ATMs, gift cards, prepaid instruments or similar? Are there related entities moving money between them? Are there large, irregular one-off transfers, and is there a documented commercial reason for them?

None of this is an accusation, and it should not be delivered as one. Framed properly, it is protective: you are trying to make sure the client’s banking survives the transaction you are about to put them through.

6. How to handle a client who has already been exited

Some of your clients will already be in this position and will not have volunteered it.

First, establish the facts without editorialising. What was closed, by whom, when, and what was said. Distinguish between an account closure, a declined application, and a restricted facility — they carry different weight.

Second, be honest with the client about what it means for placement. A recent bank exit will be material to most credit assessors, and attempting to present around it is a serious mistake. Disclose it, explain the context, and let the lender assess it.

Third, do not offer advice you are not qualified to give. Whether a particular exit was lawful, whether discrimination legislation applies, and whether there is any prospect of challenge are legal questions. The three decisions above suggest challenges face a steep road, but that is a matter for a lawyer, not for a broker.

Fourth, record what you did. Under the Best Interests Duty, a file showing that you identified a banking risk, asked about it, and reasoned about lender selection accordingly is a far stronger file than one that is silent because nobody asked.

7. The debanking exposure screen

A short screen you can add to your commercial and self-employed fact-find this week.

1. Banking history. Has any institution closed, declined or restricted an account for the business, its related entities or its directors? Record the answer either way.
2. Cash intensity. What proportion of revenue is cash, and how is it banked? High-value or structured-looking cash movements are the single most common alert trigger.
3. Cross-border activity. Are there international payments or receipts, and is the commercial reason for them documented?
4. Related-party flows. Money moving between associated entities without a clear commercial rationale is a recognised risk indicator.
5. Sector exposure. Identify whether the business sits in a category that institutions commonly treat as high risk, and check whether the lender you are considering has a stated position on it.
6. Banking redundancy. Does the business hold accounts with more than one institution? If not, raise it as a resilience issue before you lodge, not after.
7. Documentation. Where transactions look unusual but are legitimate, is there contemporaneous evidence explaining them? That evidence is worth far more before an alert than after one.

8. What to watch next

• Publication of the primary judgment, which will allow the reported citation and reasoning to be verified directly.
• Any appeal, which would test whether the discrimination analysis survives review.
• Further AML/CTF reform affecting how institutions are expected to treat high-risk sectors, and whether enhanced due diligence displaces exit as the default response.
• Lender policy statements on high-risk industries, which shape where these clients can realistically be placed.
• Whether any regulator addresses debanking as a market access issue, as distinct from a risk management one.