A financial services firm is evaluating a proposal to launch a new online cryptocurrency trading feature. After a risk assessment, the security team determines that the regulatory uncertainty, extreme volatility of the assets, and the high likelihood of sophisticated attacks create a level of residual risk that far exceeds the organization's risk appetite, even after considering all available controls. The board decides not to proceed with launching the feature at all. Which risk treatment strategy does this decision BEST represent?