You may consider designating both prohibited industries and industries that require BSA (or management, however you choose to do it) approval. I would suspect the Board would be interested in having input in the prohibited businesses and would like that to be part of policy. I have not heard of prohibiting businesses because they're too big, but an extremely complex business may be banking with you to take advantage of less sophisticated AML controls, so questioning why some businesses are with you is wise.
Finally, regulators may verbally discourage you from de-risking and saying you won't bank certain high-risk customers, like POATMs or MSBs, but those same regulators may heavily scrutinize those accounts and make the cost of banking them too high. Regulation doesn't require you to open accounts for those customers. If you just want to avoid prohibiting them, you could add them to the approval-required list and set your criteria for accepting them appropriately high so that you aren't taking on more than you can handle.