Sadly, not only is it legal, but it is incentivized. Financial service providers have enormous civil and criminal liability by tech company standards, and some regulations require them to use "risk-based" approaches to decline service to clients. The legal consequences of shutting out innocent small businesses are essentially nothing compared to the consequences of allowing a single criminal or terrorist to use their service.