Banking for Crypto, Fintech & High-Risk Businesses

Why Banking Is the Biggest Challenge for Crypto, Fintech & High-Risk Businesses

Banking is the single hardest infrastructure problem for crypto, fintech, and high-risk businesses: 75% of 160 crypto hedge funds surveyed by AIMA reported issues accessing or growing banking services, in results published in December 2024, and as of May 2026 the cost premium over standard business accounts still runs five to fifteen times on partner-network pricing, with entire high-risk verticals remaining on the permanent margin of the financial system. Licensing has clear regulatory paths; banking does not.

The debanking pattern is well documented: the Alternative Investment Management Association reported in December 2024 that 75% of 160 crypto hedge funds surveyed had issues accessing or growing banking services for their funds, while none of the traditional alternative investment managers surveyed had lost or been denied banking services.^[1]

The Banking-as-a-Service middleware provider Synapse filed for chapter 11 bankruptcy protection on 22 April 2024. Its partner banks held between $60 million and $90 million less for consumers than Synapse’s records showed, according to the Consumer Financial Protection Bureau. Separately, on 12 December 2025 the OCC conditionally approved national trust bank charters for five digital-asset firms: two de novo applications and three conversions from state trust companies. What institutions now ask BaaS-adjacent fintechs to evidence is set out under what banks require.

The structural cause is straightforward: banks classify crypto and high-risk sectors as inherently elevated risk, and regulatory pressure on banks that serve these sectors, including consent orders and enforcement actions on Banking-as-a-Service sponsors, compounds the institutional reluctance. The result is a banking access gap that operates independently of business quality; on partner-network pricing, specialist EMIs accepting crypto businesses typically charge 5–15 times the effective rate of standard business accounts once monthly fees, SEPA and SWIFT charges, card processing, and rolling reserves are combined.

The Markets in Crypto-Assets Regulation (MiCA) created an inflection point but not a solution. MiCA became fully applicable on 30 December 2024; transitional grandfathering ran to 1 July 2026,^[7] and authorised CASPs now have regulatory parity with other regulated financial firms, which should reduce bank hesitancy, but bank risk committees move slowly.

Sector-specific gating mechanisms layer on top, among them FinCEN guidance on cannabis banking, with no federal safe-harbour law enacted; the UK FCA cryptoasset regime is expected to commence on 25 October 2027.

For most operators, the practical consequence is one of three things: they run on EMIs and accept the higher cost, they take suboptimal pricing terms at a traditional bank willing to entertain the relationship, or they relocate to a jurisdiction with more accommodating banking infrastructure. None of those options is ideal, and the placement model exists to find the institutional fit before relocation or suboptimal acceptance becomes the only remaining option. A licence without banking access is a certificate on the wall. Licensing and banking must be planned together; for licensed CASPs, the placement assessment is where that planning happens.

How Jagelski & Partners' Banking Placement Works

Jagelski & Partners matches crypto, fintech, and high-risk businesses with the banking and payment institutions most likely to take them on, before any formal application is submitted, because the model is pre-qualification across the network, not a referral to a single provider. Jagelski & Partners scopes banking options in writing and introduces an independent specialist before any account application is filed.

You contract directly with the specialist; account approval remains the financial institution's decision. The pricing the network secures is the institutional rate, not a marked-up rate.

Unlike a cold application, where an applicant submits documentation without knowing the institution's current appetite, pre-qualification begins with the provider's underwriting criteria; the network has active, current relationships with 90+ banking and payment institutions across EU, UK, Switzerland, MENA, and offshore jurisdictions. The network knows which archetypes will currently accept MiCA-authorised CASPs, which will accept MGA or Isle of Man-licensed gambling operators, which will serve fintechs with a UK EMI authorisation or CySEC-licensed forex brokers, and which have closed their risk appetite entirely. That knowledge is the service.

The engagement runs in four stages.

The record a declined application leaves is what makes the sequence matter: a second application is harder than the first, and by the third the application history itself can be a meaningful obstacle even at institutions that would have taken the business at the outset. Under the placement model the client formally applies only where the institution has already confirmed appetite.

For specific verticals and account types, see High-Risk Business Accounts or Crypto & Fiat Settlement; multi-currency structures are covered in Multi-Currency Accounts & IBANs.

How We're Paid

Jagelski & Partners is paid by the institution, not by the client: the institution that takes the client's business pays a referral or revenue-share fee in exchange for the volume and quality of pre-qualified introductions our network delivers. The pricing the client sees on their account-opening documentation is the institutional rate; there is no markup and no onboarding fee.

1. Why the model works. The economics are scale-driven: through Jagelski & Partners' partner network, businesses placed more than fourteen billion euros in client turnover across banking and EMI relationships in 2025. Institutions that receive that volume of pre-qualified, well-prepared client introductions extend pricing terms they would not extend to an individual applicant, so the volume relationship benefits the client without a markup.

2. Why the model differs. Some introducers and consultancies add their own fee on top of the institutional pricing the client would have received going direct, and that fee is not always prominent: it can sit in an engagement letter or be framed as a "success fee" paid by the client at account opening.

Jagelski & Partners replaces that undisclosed layer with an open relationship between the client and the institution, and with our own role in it stated.

Pricing is on the account-opening documentation: there is no parallel invoice, no separate fee schedule, no surprise at the end of the placement.

3. What this means for the client.

• The pricing on the client's account-opening documentation is the institutional rate, not a marked-up rate.
• There is no onboarding fee.
• Jagelski & Partners' incentive aligns with the client's: a long-term banking relationship that survives compliance reviews and continues to generate revenue share. A failed onboarding or a churned client costs us, too.
• The model makes us selective about which institutions enter the network. An institution that onboards client funds and closes the account six months later does not work for either party.
• Jagelski & Partners never bills the client, including for placement, advisory, regulatory, or document-preparation work. Independent specialists quote their own professional fees separately, and government or statutory charges remain separate.

Risk Appetite Range: From Low-Risk to Complex Profiles

Jagelski & Partners' partner network spans institutions with materially different risk appetites, from low-risk EU fintechs and licensed CASPs to operators with complex jurisdictional or sectoral profiles; pre-qualification matches each business profile against institutions whose risk appetite admits it. The network is broad because no single institution covers the spectrum.

1. Risk appetite is a network feature, not a single position. Banks and EMIs do not all have the same risk appetite: an institution that onboards licensed EU fintechs comfortably will not necessarily onboard a forex broker with offshore licensing; a specialist high-risk EMI that takes regulated gambling will not necessarily take a tokenisation platform. The network spans this spectrum because no single institution can, and pre-qualification matches each business profile against institutions whose risk appetite and jurisdictional capability are an actual fit, sector experience included.

2. The risk appetite spectrum.

3. The placement success rate. In our experience, most well-prepared cases that enter the placement process find a banking home, and the qualifier matters: well-prepared means a complete KYB pack, a credible AML/CFT manual, a documented source-of-funds trail, and a business model that the institution can underwrite. The network is broad; the documentation discipline is what closes the placement.

Cases that cannot be made well-prepared, through documentation work, structural changes, or jurisdictional realignment, are the ones that do not place.

4. What complex looks like in practice.

A licensed crypto exchange operating across multiple jurisdictions, with flow that includes both EU EMI corridors and non-EEA settlement, requires banking that can clear both; the network's specialist correspondent banking partners are built for exactly this profile, not as a workaround, but as their core business.

A regulated gambling operator with licensing in two jurisdictions and customer flow from a third presents three risk dimensions to most banks and one risk dimension to a high-risk specialist, so the network's high-risk EMI tier exists for this profile.

A tokenisation platform carrying bank-issued stablecoin exposure and MiCA EMT compliance obligations, on top of treasury management needs across four currencies, requires both EMI capability and traditional bank settlement: the network's tier-1 EU EMI partners with crypto onboarding handle the first; the network's correspondent banking partners handle the second.

5. The boundary. The network does not facilitate banking for businesses operating in clearly prohibited sectors, for example unlicensed exchange operations in jurisdictions where licensing is required and the operator is unlicensed, businesses subject to sanctions or sanctions-listed individuals, or businesses whose model is fundamentally inconsistent with AML/CFT compliance. We screen at discovery, before the placement process begins.

The Banking Partner Network

The proof is the network. Jagelski & Partners' partner network: 90+ banking and payment institutions, businesses placed more than fourteen billion euros in client turnover across banking and EMI relationships in 2025, banking access in 55 jurisdictions, and worldwide reach.

What the network includes:

• Tier-1 EU EMIs with crypto-specific onboarding workflows.
• European neobanks operating under EMD2 / PSD2 with regulated crypto-business onboarding.
• Specialist high-risk EMIs with sector-tier acceptance capacity (gambling and forex, plus regulated cannabis where permitted).
• Crypto-native banking partners in EU and UK jurisdictions.
• Correspondent banking partners for cross-border SWIFT settlement.
• Multi-currency payment institutions with API-driven account opening.
• Offshore banking partners in established offshore jurisdictions for businesses where offshore is the right structural answer.
• Settlement and on/off-ramp providers for crypto-fiat conversion at institutional volumes.

How the network functions. The relationships are active and current, not static: acceptance criteria are reviewed continuously, and what an institution accepted six months ago is not necessarily what it accepts today. Pricing terms are negotiated at the network level, not at the deal level, which is what allows the institutional rate to be passed through to the client. The volume relationship is what makes the institutional pricing possible.

What the network is not. The network is not a static list of "banks that accept crypto"; those lists are out of date the moment they are published, and it is not a directory the client could find on their own. It is the working relationships that allow pre-qualification to function in days rather than weeks, and that make institutional pricing available to network-introduced clients.

For the network's institutional context and brand, see About Jagelski & Partners.

EMI Accounts vs. Traditional Bank Accounts

An electronic money institution (EMI) is a financial services provider licensed under the Electronic Money Directive (EMD2, Directive 2009/110/EC) to issue electronic money and provide payment services. EMI accounts offer SEPA and SWIFT access as well as an IBAN, but are not bank accounts; they operate under a safeguarding regime rather than a deposit guarantee scheme, and most crypto, fintech, and high-risk businesses operate through EMIs because traditional banks refuse them.

The distinction matters for deposit protection and for credit access, and it matters for operational resilience too; the following comparison reflects general market conditions as of May 2026, and specific terms vary by institution.

Deposit protection is the single most consequential difference. The Financial Services Compensation Scheme raised its limit from £85,000 to £120,000 effective 1 December 2025 following Bank of England Policy Statement PS24/25.^[5]

The EU's Deposit Guarantee Scheme Directive maintains €100,000 per depositor per credit institution.^[17]

Neither deposit guarantee applies to EMI balances. EMD2 safeguarding instead permits the nationally selected method: segregation through a separate credit-institution account or qualifying secure, liquid, low-risk assets, or insurance or comparable guarantee from a non-group provider for an equivalent amount. These protect against insolvency but are not deposit insurance.^[6]

In practice, the UK Financial Conduct Authority estimated that across 12 payment firms that became insolvent between Q1 2018 and Q2 2023, the average shortfall in funds owed to clients was 65% (80% for EMIs alone), using total assets as a proxy for safeguarded funds. In the six cases where a distribution had been made, the first took an average of 2.3 years; cases still awaiting a distribution were excluded.^[3] Safeguarding is a structural protection, not a backstop equivalent to deposit insurance.

EMD2 permits an EMI to grant conditional payment-related credit; it does not create general lending or deposit-taking powers. The credit must be ancillary to specified payment services, must meet the applicable repayment constraint for the cross-border route, cannot be funded from received customer funds, and requires appropriate own funds.^[6][16]

Article 12 separately prohibits interest or other benefits tied to how long e-money is held. Whether an EMI offers a qualifying credit product is a product and permissions question, not an automatic capability.^[6][16]

Eligible non-bank EMIs and PIs can also obtain direct payment-system access subject to the system, settlement-account, and provider admission conditions. The Bank of England’s 18 April 2018 announcement records the first implemented UK non-bank route; eligibility does not establish that any particular provider participates directly.^[15]

The practical rule: if the business needs a dedicated IBAN, SEPA and SWIFT access, multi-currency wallets, and an operational account opened in 2–6 weeks, an EMI is often sufficient. General working-capital lending, trade finance, interest-bearing deposits, and deposit-guarantee protection point to a bank. Qualified payment-related credit and direct payment-system access may be available from an eligible EMI, but depend on its permissions, product and admission status.

PSD2 Article 36 already requires access to credit institutions’ payment-account services on an objective, non-discriminatory and proportionate basis. A bank must give its competent authority duly motivated reasons for a rejection. A payment institution can challenge a blanket refusal under current rules; this is not a guarantee that every bank must accept its particular risk profile.^[30]

Looking forward: PSD3 and the accompanying Payment Services Regulation (PSR) reached provisional political agreement on 27 November 2025 but had not been formally adopted by September 2026; under the agreed PSR text, general application would begin 21 months after entry into force.^[13] If adopted as agreed, PSD3 would bring e-money institutions into the payment-institution framework, and Article 32 of the PSR would let a bank refuse or close a payment institution’s account only on listed grounds, with specific reasons the institution can appeal to a competent authority.^[28] The honest forward-look is that the package would improve EMI market access without making EMIs functionally equivalent to banks; businesses that need general credit facilities or deposit protection will still need both, and mid-2028 is the earliest prudent planning horizon for material change.

What We Cover

Jagelski & Partners’ banking service covers three capabilities, each with a dedicated page, plus written licensing scoping before specialist introduction, which runs across the banking and licensing services rather than sitting on a banking page of its own. Most engagements combine two or more, and in practice the sequencing matters: banking decisions made before licensing jurisdiction is set, or settlement choices made before multi-currency architecture is planned, create avoidable rework.

High-Risk Business Accounts

A high-risk business account is an operational bank or EMI account opened for a business in a sector that acquirers and banks classify as high-risk: categories include licensed gambling, forex and CFD brokers, adult entertainment, CBD and hemp-derived products, nutraceuticals, pharmaceuticals, travel operators, debt collection, and regulated crypto businesses.

Banking for these sectors is available but narrow, and the institutions that serve them apply card network registration and rolling reserves, plus chargeback monitoring that standard merchants do not face. See High-Risk Business Accounts for detail on merchant category codes, card network programmes, rolling reserve structures, and rejection mitigation by vertical.

Crypto & Fiat Settlement

Crypto-fiat settlement is the infrastructure that moves value between blockchain networks and traditional payment rails; exchanges, over-the-counter desks, on-ramp and off-ramp platforms, and crypto-native fintechs need reliable access to SEPA, SEPA Instant, SWIFT, Faster Payments, and euro-denominated stablecoin rails. Settlement infrastructure sits downstream of banking: a partner must accept the business before settlement volumes flow. See Crypto & Fiat Settlement for the settlement model comparison and payment rail analysis, together with MiCA-compliant stablecoin settlement options.

Multi-Currency Accounts & IBANs

A multi-currency account holds balances in multiple currencies under a single relationship, typically with dedicated or virtual IBANs per currency. IBAN discrimination, where counterparties refuse payments based on IBAN country code despite SEPA Regulation Article 9 prohibiting this, is widespread across the EU, with Lithuanian, Belgian, and German IBANs accounting for the most refused-IBAN complaints (ECC-Net, 2025). See Multi-Currency Accounts & IBANs for IBAN discrimination data by jurisdiction, plus a vIBAN vs dedicated IBAN comparison and MiCA client fund segregation requirements.

Crypto & Fintech Licensing Support

Jagelski & Partners scopes banking and licensing requirements together, because banking approval is frequently conditional on licence status; licence applications routinely require proof of an operational bank account. The written brief records the sequence before specialist introduction to avoid the circular dependency that strands unlicensed applicants outside the banking system and unbanked applicants outside the licensing system.

Banking by Business Type

The three capabilities above describe what a banking stack is made of. Which of them an operator needs, and which institutions will underwrite them, depends on the business itself: a licensed gambling operator and a forex broker both count as high-risk and have almost nothing in common at the institution’s underwriting desk. These pages cover the placement question by business type.

• High-Risk Merchant Accounts: card acquiring as a separate product from banking. Merchant category codes, Visa and Mastercard high-risk registration, rolling reserves, and the card-scheme monitoring thresholds, including Visa’s regional merchant fraud-and-dispute ratios and the applicable monthly-count and acquirer-status conditions.^[19]
• iGaming and Sports Betting: the vertical where the licence decides the banking market. UKGC, MGA, and Isle of Man licensees have options a Curaçao licensee does not, plus segregated player-fund structures and the deposit and payout rail split.
• Crypto Exchanges and Trading Venues: two banking problems rather than one. MiCA Article 70 places client fiat with a credit institution or central bank, subject to the exemption for CASPs that are themselves credit institutions, EMIs, or payment institutions; correspondent USD access is the constraint that binds at scale.
• Forex and CFD Brokers: client money is the structural constraint, and most regimes require it at a credit institution rather than an EMI. Also covers MCC 6211 acquiring and what happens when unlicensed activity is reclassified.
• EMIs and Payment Institutions: among the lower-rejection profiles in our partner-network experience, because the authorisation is itself a credential. The constraint is the safeguarding account, not appetite.
• Custody and Wallet Providers: passive balance management with a perimeter banks recognise. The trap is activity creep: a bank underwrites the riskiest activity in the entity.
• Stablecoin Issuers: the reserve is the product. MiCA puts a minimum proportion in credit-institution deposits, so reserve capacity constrains how large the token can get.
• OTC Desks: large OTC payments may require manual source-of-funds and counterparty review alongside transaction monitoring. The monitoring method depends on the institution and risk. Correspondent USD sets the ceiling.
• Tokenisation Platforms: usually a securities product outside MiCA entirely, so the counterparty needed is a securities-capable bank rather than a crypto-friendly one.
• Crypto Lending: the clearest regulatory gap in the sector. An unregulated activity is a harder banking case, not an easier one.
• Crypto Payment Gateways: a payments business first: it holds merchant money in transit, which moves the file to the payment-institution list.
• High-Risk E-commerce: the product and its legality, subscription billing, delivery lag, and health or income claims can each affect risk, and they compound.
• Adult: the most tightly governed merchant category in card acceptance. Scheme registration is mandatory and the compliance evidence is the application.
• Web3 Gaming: the least settled profile here. Token status, chance mechanics per market, and cash-out decide whether it is bankable at all.

Where a business does not fit any of these, the high-risk business accounts page covers the general case, and the placement assessment is the faster route to an answer.

Banking Access by Jurisdiction

Banking availability differs dramatically across jurisdictions even for identical business models, and the following comparison uses Jagelski & Partners’ editorial Banking Friendliness rating on a 1–10 scale, based on partner network data and current acceptance patterns. This is not an external rating, and it describes the unassisted market: every jurisdiction the firm services has a confirmed account-opening route through the network.

Read the score together with the Rated For column: each jurisdiction is scored for the client profile it is actually chosen for, so Malta’s 7 describes a licensed iGaming operator and Switzerland’s 9 a licensed crypto business. The scores are not comparable across different profiles, and a jurisdiction that scores well for one can be closed to another.

Compare banking access across all 55 jurisdictions side by side →

Reading the table: each score is the leader within its own Rated For profile rather than a position on one shared scale: Switzerland (9) for licensed crypto and VASP businesses, Germany (8) for licensed crypto and fintech, the Isle of Man (8) for licensed iGaming, and the UAE (8) for VARA or ADGM-authorised VASPs.

What those four have in common is mainstream institutional acceptance paired with an established regulatory framework. Lithuania has a dense EMI sector, with 70 fully licensed EMIs on the Bank of Lithuania list, but its country-code IBANs face counterparty discrimination. Malta and Isle of Man are included because they are leading gambling-licence jurisdictions and their banking access is effectively gated by those regimes; an MGA or IoM licensee has banking options that a Curaçao licensee does not, regardless of business quality.

Gibraltar’s Gambling Act 2025 (Act No. 2026-04), in force since 1 April 2026 apart from sections 55–77 on regulated functions and regulated individuals, replaced the 2005 Act; Gibraltar is not scored in this table.

Jurisdictions excluded by design. Curaçao is a major online gambling licensing jurisdiction, but its operators face severe banking restriction; most are pushed toward specialist processors charging 8–12% (an indicative partner-network range), not mainstream banking. BVI was added to the FATF grey list in June 2025, and to the EU list of high-risk third countries from 29 January 2026, so EU banks must apply enhanced due diligence to BVI-incorporated entities.^[23]

Experienced applicants treat jurisdiction of incorporation and jurisdiction of banking as separate decisions; an offshore holding structure is workable, but offshore banking for an operational business rarely is.

A licensing decision optimises for regulatory fit; a banking-jurisdiction decision optimises for corridor coverage and counterparty acceptance, which is why the two rarely resolve to the same country.

Why Banks Reject Crypto Businesses

Banks reject crypto, fintech, and high-risk business applications for a short list of recurring reasons, and most are structural rather than applicant-specific, which means they can be predicted and often mitigated, but not always overcome. The common mistake is treating rejection as a documentation problem; for most applicants the gating factors are structural. Better documentation improves the odds at well-matched institutions, but does not open doors that the institution’s risk appetite has closed.

Regulatory uncertainty. A business operating without a licence in a jurisdiction where one is required is effectively unbankable at tier-1 institutions: as at 1 September 2026, the UK Financial Conduct Authority had registered 68 of the 417 cryptoasset firms that applied since January 2020, 17% of the 391 applications it had decided.^[22] Mitigation: secure a recognised licence before application.

Sector-wide de-risking. Banks exit entire sectors rather than assess individual applicants when compliance cost exceeds expected revenue; the Financial Action Task Force has stated repeatedly that wholesale de-risking is not in line with its recommendations, but the economics continue to favour it.^[2] The UK’s July 2025 National Risk Assessment upgraded the EMI and PSP sector from medium to high risk, reporting a 231% increase in FCA MLR-related supervisory activity for EMIs and PSPs between 2020 and 2024.^[10] Mitigation: target institutions that have deliberately entered the sector rather than those that tolerate it. Article 32 of the agreed Payment Services Regulation text would narrow the grounds on which banks can refuse payment institutions, but it has not been adopted and would apply only 21 months after entry into force.^[28]

Correspondent banking pressure. Non-US banks serving crypto or high-risk clients risk losing US dollar clearing access: active correspondent banking relationships fell by roughly 30% between 2011 and 2022, the latest year of the data published by the BIS Committee on Payments and Market Infrastructures.^[11] Mitigation: diversify into EUR and local-currency flows where correspondent pressure is lower.

Chargeback and fraud exposure. Card networks operate tiered monitoring programmes for merchant chargeback and fraud ratios, with Visa’s merchant Excessive ratio lowered to 1.5% in the AP, Canada, EU and US regions from 1 April 2026.^[19]

A merchant whose acquirer terminates it for a listed MATCH condition, such as excessive chargebacks, can be listed in Mastercard’s MATCH Pro system, which keeps records for five years.^[20]

Forex brokers face structural exposure: ESMA found that 74–89% of retail CFD accounts lose money, a pattern confirmed by the FCA, which put the share at approximately 80% in December 2022, and ASIC, which found 68% of retail CFD investors lost money in FY2024.^[12] Mitigation: robust chargeback prevention and 3D-Secure implementation, with pre-application risk scoring. See High-Risk Business Accounts for card network programme detail.

Unclear ultimate beneficial ownership. The EU’s Anti-Money Laundering Regulation, applicable from 10 July 2027, sets the beneficial-ownership threshold at 25%, subject to lower thresholds adopted by the Commission for higher-risk categories of corporate entities; AMLR also lowers the occasional-transaction customer due diligence threshold from €15,000 to €10,000 (Article 19(1)(b)) and bans anonymous crypto accounts entirely (Article 79).^[8] Mitigation: transparent ownership chains; documenting owners from 10% is a conservative documentation choice, not the AMLR ownership threshold.

Under Article 52(2), the Commission must assess higher-risk corporate categories by 10 July 2029 and adopt delegated acts where a lower threshold is appropriate. The lower threshold must normally be at most 15%; a justified higher threshold is permitted, but it must remain below 25%.^[8]

Insufficient compliance infrastructure. Crypto businesses that lack blockchain analytics integration are routinely declined, as are those without documented Travel Rule processes (the FATF reported in July 2026 that 91 of 109 surveyed jurisdictions had passed Travel Rule legislation and 11 more were in the process) or transaction monitoring systems.^[27] Mitigation: implement the infrastructure before applying. Institutions read this as a credibility signal, not a nice-to-have.

Sector-specific regulatory gating. Entire verticals sit behind their own regulatory gates. US cannabis banking operates under FinCEN Guidance FIN-2014-G001.^[14] FinCEN estimated that about 1,000 banks and credit unions, some 11% of the roughly 9,000 insured depository institutions, filed marijuana-related suspicious activity reports in 2024, and no federal safe-harbour law has been enacted: the most recent proposal, the SAFER Banking Act of 2023, did not become law. In April 2026 the Department of Justice moved FDA-approved marijuana products and marijuana held under a state medical licence to Schedule III.^[24]

Unlicensed forex activity is reclassified by Visa to the gambling merchant category, while debt collection was flagged by the OCC in December 2025 as a sector subject to inappropriate banking restrictions.^[25] Each vertical has its own gating mechanism.

Documentation failures. The most common applicant-side causes of decline are template AML policies and missing source-of-funds evidence, along with unclear business-model descriptions. Mitigation: jurisdiction-specific, business-specific documentation. Pre-qualification identifies gaps before they reach the institution.

Rejection rates vary dramatically by business type, and the following hierarchy reflects partner network data as of April 2026, ordered from lowest to highest rejection rate.

For rejection-mitigation detail by vertical, see High-Risk Business Accounts.

What Banks Require: Documentation and Process

Bank and EMI onboarding for crypto, fintech, and high-risk businesses uses standard Know Your Business documentation plus sector-specific additions. Documentation quality, not volume, determines outcome.

Standard KYB Documentation

Certificate of incorporation, articles of association, certificate of good standing, shareholder and director register, UBO declarations covering every beneficial owner, including additional owners where the institution requires documentation below the legal ownership threshold, proof of registered address, and certified passport copies plus proof of address for every director and UBO. Financial statements (audited where available; management accounts where not) for the past two years plus year-to-date; business plan with 12-month forecasts covering revenue, transaction volumes, geographic flows, and counterparty categories.

Licensing and Regulatory Documentation

Every relevant licence certificate including jurisdiction, licence number, scope, issue date, and current status; regulator correspondence covering the past 12 months. AML and CTF policies covering customer due diligence, transaction monitoring, sanctions screening, Travel Rule compliance (for crypto businesses; the EU imposes a zero threshold for CASP-to-CASP transfers), suspicious activity reporting, and record keeping. Documented compliance officer appointment with CV and relevant certifications. SOC 2 Type II and ISO 27001 are de facto expected for institutional-grade banking relationships.

Crypto-Specific Additions

Chain analytics provider contract (institutional-grade blockchain analytics service, or equivalent). Wallet architecture documentation covering segmentation across hot, warm, and cold wallets, as well as multi-signature arrangements and key management. Travel Rule implementation details; source-of-funds policy specifically addressing on-chain fund origination; stablecoin handling policy distinguishing MiCA-compliant from non-compliant issuers.

Fintech and High-Risk Additions

For BaaS-adjacent fintechs, documentation of sponsor bank relationship including the sponsor’s own enforcement status; since the April 2024 Synapse collapse institutions routinely require evidence of direct ledger reconciliation. For card-dependent high-risk merchants, card network registration documentation and a chargeback management plan with historical ratio data, alongside PCI DSS compliance at the applicable merchant level.

Licensed gambling operators require MGA, UKGC, or Isle of Man credentials; forex brokers require CySEC, FCA, or ASIC authorisation with client fund segregation evidence; US cannabis businesses need the licensing and operating records a bank collects under FinCEN FIN-2014-G001, which also sets the bank’s three marijuana SAR categories (limited, priority, termination).

What the published onboarding guidance does not cover is how institutions weight consistency across documents: a clean AML policy that contradicts the business plan reads worse than an imperfect AML policy that reconciles with every other document in the pack; compliance officers are trained to spot the inconsistency, not to grade the individual document.

Onboarding timelines vary systematically between institution types.

The EMI timeline advantage is structural: EMIs operate under lighter supervisory regimes and purpose-built compliance systems for fintech and crypto clients, while banks apply the same onboarding process to a crypto CASP as to a large corporate treasury client, which is slower but produces a more durable relationship. Unlike the EMI route, where pricing and feature set can change at the institution’s discretion with relatively short notice, traditional bank relationships tend to be more stable once established.

Regulatory trajectory affecting documentation. The EU Anti-Money Laundering Authority (AMLA) commenced operations in Frankfurt on 1 July 2025 and expects its first direct-supervision cycle in 2028. Article 13(4) links the transfer to six months after publication of the selected list; Article 106 limits the first selection to 40 when more entities qualify,^[9] while AMLR, applicable from 10 July 2027, harmonises CDD requirements across all member states.

In the United States, the OCC (20 March 2025) and the Federal Reserve (23 June 2025) stopped examining banks for reputation risk. On 7 April 2026 the OCC and the FDIC issued a final rule, effective 9 June 2026, that bars both agencies from using reputation risk in supervision, responding to concern that it can be a pretext for restricting lawful businesses’ access to banking.^[26] None of these changes eliminate documentation requirements; they shift who enforces them and on what basis.

Frequently Asked Questions

References