At most banks, the absolute control belongs to risk and regulation department. A bank must safeguard their license above all else, and it is very easy for them to loose it if the bank is found doing something it should not (though for the big ones, they sometimes operate in a gray zone, which means they manage to keep their licenses despite relatively steep fines). Even for the simplest ui/ux change, risk department has the final say.
Source: I’ve been working 15+ years in the banking industry.
I’ve been working many years in the banking and Fintech industry. These companies are driven by compliance before profit. Sometimes, compliance will order a country to be blocked because of the risk to service bad actors, and they can get this done bypassing every other department. This is also why it takes forever to get an account opened, the know you customer and know your business processes are long and tedious, use manual and semi automated process to establish a risk score and make a decision wether to service a customer or not. Most of the time, these processes are about ticking boxes and filing required documents to cover the institution.
In the case of the article, servicing a zone at war, with a lot of parties under sanctions is a risk that either BuyMeACoffee and / or a few of their providers were not willing to take.