A bank can set up a securitization transaction in order to obtain regulatory capital release with respect to a specific loan portfolio. As a prerequisite for releasing regulatory capital, the regulatory authorities require the bank to fulfill a certain set of requirements which shall ensure that a significant portion of the securitized credit risk was effectively transferred to the capital market. The following paper concentrates on the concept of non-compliance, which is not explicitly addressed by the requirements for effective risk transfer. However, this concept is often provided for in a securitization transaction and allows the securitizing bank to remove particular loans from the securitized portfolio over the term of the transaction. The risks associated with the removed loans are retransferred to the bank. In case a large aggregate amount and/or especially low-quality loans are removed from the securitized portfolio, the initially presumed risk transfer and thus the basis for regulatory capital release could be significantly undermined. In the following it is argued that the removal of loans may potentially serve two different objectives of the securitizing bank, i. e. cost minimization or reputation maintenance. Based on a unique data it is tested and confirmed that a bank has the potential to remove loans in line with these objectives. As a result, it is derived that the regulatory requirements for effective risk transfer clearly underestimate the potential impact of the non-compliance concept. It is discussed how the regulatory treatment of this concept could be improved.