High-Risk Business Banking: Accounts for Crypto, Fintech & Regulated Industries

What Makes a Business “High-Risk” for Banking?

“High-risk” is a banking classification, not a verdict on a business’s legitimacy. Visa’s Merchant Data Standards Manual (April 2026) lists 13 merchant category codes as high integrity risk for all or certain card-absent transactions, covering gambling, pharmaceuticals, crypto, financial trading platforms including forex, dating, adult content (MCC 5967), and outbound telemarketing (MCC 5966).^[1] The label reflects risk modelling: chargeback exposure, regulatory complexity, fraud patterns, reputational sensitivity, and the monitoring burden the institution must carry.

The five risk dimensions are interlocking. Chargeback potential measures dispute rates against scheme thresholds. Visa’s Acquirer Monitoring Programme (VAMP), which replaced VDMP and VFMP in 2025, sets the merchant Excessive threshold at 1.5% (150 basis points) from 1 April 2026 for the US, Canada, EU, and AP regions (1.5% in LAC; 2.2% in CEMEA), with acquirer thresholds at 0.50% Above Standard and 0.70% Excessive.^[2] These Visa merchant thresholds apply where the acquirer is neither Above Standard nor Excessive; Visa’s public fact sheet excludes Brazil, Chile, and India; their programmes are announced separately. Monthly floors are 1,500 fraud-and-dispute events, or in CEMEA at least 150 events and USD 75,000.

Mastercard’s Excessive Chargeback Programme flags a merchant once a month’s chargebacks reach both 100 and 1.5% of the previous month’s sales, with a High Excessive tier at 300 and 3%; the thresholds sit in a separate Mastercard monitoring manual, so these are the figures as an acquirer publishes them.^[3][6] Operators in 2026 plan to these 1.5% lines, not the retired monitoring levels of 0.9% or 1.0% that still circulate online.

Regulatory complexity measures the layering of authorisations the institution has to assess and re-assess. A licensed CASP under MiCA, a CySEC-regulated CFD broker, a UKGC-licensed iGaming operator, and a VARA-authorised crypto exchange each present a different regulatory perimeter, and the institution carries the cost of staying current on every one of them. Fraud exposure is measured through TC40 reports for cards and equivalent operational fraud metrics for bank rails.

Reputational risk is typically escalated to senior management, and correspondent banks screen respondent banks with the Wolfsberg Group’s Correspondent Banking Due Diligence Questionnaire (CBDDQ v1.4, 2023), which asks whether the bank serves virtual asset service providers or offers virtual assets.^[24] Transaction-monitoring burden is the practical workload: rule-based monitoring plus behavioural analytics plus on-chain analytics for crypto plus sanctions screening across multiple lists, refreshed daily.

How banks classify internally tracks closely to scheme tiering. A common internal taxonomy runs Standard, Enhanced, Restricted, and Prohibited: Standard for low-risk SMEs; Enhanced for moderate risk under uplifted enhanced due diligence; Restricted for the high-risk verticals (gambling, adult, crypto, money service businesses, payment service providers) requiring senior approval, enhanced reserves, and continuous monitoring; and Prohibited for sanctioned jurisdictions, shell banks, and unlicensed money service businesses. The MCC code attached to a merchant’s card acceptance feeds directly into this tiering.

For card-absent sales, Visa’s list includes MCCs 7995 (gambling), 5912 (pharmacies), 5967 (adult content and services), and 7273 (dating and escort services), with 6211 (high-integrity-risk financial trading platforms) and 6051 or 6012 (crypto exchanges, wallet providers, and on-ramps) listed for certain card-absent transactions.^[1]

The classification is structural. Even a fully compliant, well-capitalised operator triggers it if the activity is in a flagged sector. FATF’s October 2014 statement on de-risking holds that the wholesale cutting loose of entire classes of customer is not in line with the FATF standards, and that the Recommendations require customer relationships to be terminated only case by case, where the money-laundering and terrorist-financing risks cannot be mitigated; the changes to Recommendation 1 agreed at the February 2025 plenary were made to better support that risk-based approach and financial inclusion.^[4]

In practice, the label is more punitive than the underlying risk often justifies, but it is the operating reality every applicant has to plan around. The institution is not making a moral judgement; it is pricing the cost of monitoring an applicant across its compliance, financial-crime, and operational risk functions.

Unlike a standard e-commerce business, a crypto exchange triggers multiple risk flags simultaneously: regulatory uncertainty across jurisdictions, cross-border counterparty complexity, and pseudonymous transaction counterparties on chain. A licensed gambling operator triggers chargeback-rate exposure and Mastercard SPME §9.4.2 registration. An adult-content platform triggers Mastercard SPME §9.4.1 registration with age-verification and takedown procedures, as tightened in 2021. The aggregation of flags, not any one flag, is what reclassifies the relationship as high-risk and changes the pricing, the documentation requirements, and the reserve profile.

Who Needs a High-Risk Business Account?

High-risk banking is not a crypto-only conversation. Eleven verticals carry the classification in 2026: crypto exchanges and CASPs, OTC desks, licensed gambling and iGaming, forex and CFD broking, CBD and legal cannabis, adult entertainment, stablecoin issuance, prediction markets and event contracts, DeFi infrastructure and custodial wallets, travel and ticketing, and regulated pharmaceuticals and nutraceuticals. Which one applies, and why, determines whether the right placement target is a traditional bank, an EMI, a specialist acquirer, or a multi-provider structure.

Each vertical has its own banking ecosystem. Operators building crypto exchanges, stablecoin issuance, gambling, or regulated forex find that the right placement target shifts with the licence held: see crypto exchanges, stablecoin issuers, gambling licensing, and forex licensing for the licence-side path that pairs with this banking outlook.

Banking Options for High-Risk Businesses

The EMI account is the primary route: in practice, a crypto business bank account usually means an EMI account. A traditional bank account is achievable, but effectively only with a regulatory licence already in place. Offshore banking fits offshore-incorporated holding entities and non-EU operating companies where EU or UK IBAN issuance is not commercially material. A multi-provider structure layers two or three of those so that no single sponsor chain can stop the business.

Traditional Bank Accounts

Traditional bank accounts are achievable for high-risk operators where the institution can underwrite the regulatory perimeter. Three archetypes carry the market in 2026:

• FINMA-supervised digital-asset banks in Switzerland. Typical minimum relationship CHF 100,000–500,000, onboarding 3–12 weeks (longer for complex crypto files).
• BaFin-licensed German commercial banks with crypto desks. Minimum relationship from about €25,000, onboarding 6–12 weeks.
• UAE banks with VARA, ADGM, or DFSA-aligned VASP desks. Minimum relationship AED 25,000–200,000, onboarding about 3–6 months for a licensed crypto business (planning estimate); the Central Bank of the UAE granted its first VASP Stored Value Facility licence on 11 May 2026.

Traditional banks accept MiCA-authorised CASPs more readily than unregulated entities and apply higher minimum-relationship size thresholds than EMIs. Experienced applicants budget the operating-balance floor as a structural prerequisite rather than a negotiable opening: the same relationship minimum that funds onboarding is what unlocks the relationship terms (FX margins, SWIFT routing, custody-pricing waivers) that make the account commercially viable.

EMI Accounts

Unlike retail banks, which apply a single risk appetite across the institution, the specialist EMIs that serve these sectors calibrate their appetite to high-risk verticals from the outset rather than retrofitting it. The operational consequence is faster onboarding, lighter relationship-size thresholds, and a documentation process built for crypto and fintech profiles rather than against them.

EMI accounts are the primary route for most high-risk operators. The legal basis is Directive 2009/110/EC (EMD2), which regulates electronic money institutions as a category distinct from credit institutions, with the stated aim of removing barriers to market entry for e-money issuance.^[8] EMIs provide SEPA Credit Transfer, SEPA Instant, indirect SWIFT correspondent access, and multi-currency IBANs under EEA passporting. They cannot accept deposits, cannot pay interest, and are not covered by deposit-guarantee schemes such as the FSCS (£120,000 per claimant from 1 December 2025) or the EU DGSD (€100,000).

Instead, EMIs safeguard client funds under EMD2 Article 7, usually in segregated accounts at credit institutions (the Directive also allows secure, low-risk assets or an insurance policy or comparable guarantee). Typical onboarding for high-risk verticals runs 4–10 weeks (versus 2–6 weeks for low-risk B2B).

UK-supervised EMIs are now subject to the FCA’s Supplementary Safeguarding Regime under Policy Statement PS25/12, in force from 7 May 2026, which requires daily reconciliation of safeguarded balances, a resolution pack, a monthly safeguarding return to the FCA, and an annual safeguarding audit by a qualified auditor. A firm is exempt from the audit if it has not been required to safeguard more than £100,000 at any time over a period of at least 53 weeks; until 14 May 2027 that period runs from 7 May 2026.^[9]

Operators choosing an EMI in 2026 should verify the firm has implemented the PS25/12 regime across its core requirements (daily reconciliation, the resolution pack, the monthly return, and the annual audit where it applies); an EMI still operating under pre-May 2026 reconciliation cadence is a material counterparty risk.

Offshore Banking

Offshore banking is appropriate for offshore-incorporated holding entities, non-EU operating companies, and structures where EU or UK IBAN issuance is not commercially material. As of the FATF plenary of 19 June 2026, the Cayman Islands remains off the FATF grey list (delisted October 2023) and off the EU AML high-risk list, while the British Virgin Islands was added to the FATF grey list on 13 June 2025 and to the EU AML high-risk list under Delegated Regulation (EU) 2026/83, effective 29 January 2026; AIFMD 2.0 prohibits marketing of investment funds from EU-AML-listed jurisdictions under private placement regimes from 16 April 2026.

Mauritius, which is classed midshore rather than strictly offshore, requires a Global Business Company to hold its principal bank account in Mauritius as a substance condition. Local banks nonetheless decline pooled end-client fiat for trading models in most cases, so elevated-risk profiles keep client-facing flows on EU or UK payment-institution rails. The constraint to plan around is IBAN acceptance: an offshore-domiciled entity holding only a non-EEA IBAN does not benefit from Article 9 of Regulation (EU) 260/2012 (SEPA Regulation), and counterparties may lawfully refuse the payment.^[10]

Multi-Provider Strategy

Multi-provider banking is the prudent default for any crypto, fintech, or high-risk operator processing more than €1m annually. Single-provider dependency is no longer a tolerable risk profile, given the 2024 banking-as-a-service middleware collapse, the FCA’s findings on EMI safeguarding shortfalls (the regulator’s pre-PS25/12 dataset estimated an average 65% shortfall in client funds across twelve insolvent payment firms, using total assets as a proxy for safeguarded funds, and a 2.3-year average to first distribution in the six cases where one had been made), and US supervisory enforcement against sponsor banks over their fintech partnerships, such as the Federal Reserve’s June 2024 action against Evolve Bank & Trust.^[7][9][23]

For operational payments, the recommended structure is a primary EEA-passported EMI for SEPA and multi-currency IBANs, a secondary provider in a different jurisdiction and sponsor chain, and a bank for treasury, large-value SWIFT and credit where available. A CASP receiving client funds other than e-money tokens must place them with a credit institution or central bank by the end of the following business day, in an account separately identifiable from its own funds, unless the CASP is itself an EMI, payment institution or credit institution under MiCA Article 70(5).

The independent specialist we introduce also coordinates crypto-to-fiat settlement and on-chain stablecoin rails alongside the fiat structure. Operators who rely on one EMI for SEPA and one acquirer for cards are one consent order or one middleware insolvency away from a full operational stop.

Documentation and Compliance Requirements

Documentation for high-risk banking is materially more demanding than standard know-your-business. Three categories matter: the universal corporate package, the high-risk-specific overlay that every applicant in a flagged sector has to deliver, and the ongoing monitoring obligations the institution applies after the account opens. In our experience, incomplete or inconsistent documentation is the most frequent cause of application stalls.

In practice, the documentation gap that stalls applications is rarely a missing item; it is an inconsistent narrative across the cap table, AML policy, fund-flow diagram, and source-of-wealth file, where one document implies a structure the others do not corroborate.

Standard KYB Documentation

Institutions build the universal package on the identification requirements of the EU AMLR (Regulation (EU) 2024/1624) Article 22 and FATF Recommendations 24 and 25 on beneficial ownership, then add their own risk-based requests; each bank or EMI decides which documents it requires.^[11][12] The package typically covers:

• certificate of incorporation
• articles or memorandum
• current share register and cap table with all ultimate beneficial owners at the 25% threshold (the Commission may later set a lower threshold, of at most 15%, for higher-risk categories of entity)
• certificate of good standing or incumbency
• register of directors with fit-and-proper evidence
• the financial statements the business has, audited where the law or the institution requires it (a new business relies instead on its projections, business plan, and evidence of funding)
• three-year financial projections
• a fund-flow diagram
• a written business plan
• and proof of operating address

The package should be a single indexed bundle, not assembled ad hoc as the institution requests items. The US Corporate Transparency Act position changed on 26 March 2025: FinCEN’s interim final rule, made permanent by a final rule in force from 14 August 2026, exempts US-formed entities and US persons from BOI reporting; only foreign reporting companies must file.^[21]

High-Risk-Specific Documentation

The overlay specific to high-risk verticals is where many applications stall. A bespoke AML/CFT policy manual is mandatory; in our experience, a template manual lifted from another operator’s licensing pack is a common reason an application loses momentum around week six. The FCA’s Decision Notice of 3 January 2024 refusing Zeux Limited’s registration as a cryptoasset business under the Money Laundering Regulations shows what supervisors test: among other failings, its business-wide risk assessment had no compliant methodology, which the FCA said should set out the sources used, how control effectiveness is tested, and how residual risk is calculated.^[13]

EBA Guidelines EBA/GL/2024/01, applicable from 30 December 2024, extend the EU risk-factor guidelines to crypto-asset service providers and expect them to have suitable and effective monitoring tools, including transaction monitoring and advanced analytics.^[14]

For crypto operators, the high-risk documentation pack adds:

• Blockchain analytics contract: an executed contract rather than a trial account, covering every chain the business settles on.
• Wallet disclosure: covering all operational addresses.
• Custody operating model: hot/warm/cold split, MPC or multisig, key-ceremony procedures, custodian counterparties.
• Source-of-wealth and source-of-funds evidence trail: traceable through fiat to crypto to gains to fiat.
• Security certifications: increasingly expected at SOC 2 Type II, ISO/IEC 27001:2022, and PCI DSS v4.0.1 where card data is processed.
• Proof of the regulatory licence held: MiCA CASP authorisation, FCA cryptoasset registration, FINMA supervision, VARA/ADGM/DFSA authorisation, or MAS DPT/DTSP licence.

What Banks Check During Ongoing Monitoring

Until 10 July 2027, ongoing monitoring follows the national rules that transpose the EU anti-money-laundering directives. From that date Article 26 of the EU AMLR governs it. Both sit alongside the existing EBA Guidelines EBA/GL/2021/02 as amended by EBA/GL/2023/03, EBA/GL/2023/04, and EBA/GL/2024/01.^[11][14] The new EU Anti-Money Laundering Authority (AMLA) has been operational since 1 July 2025, with headquarters at the Messeturm in Frankfurt; AMLA assumed all EBA AML/CFT mandates on 1 January 2026 and is preparing the first direct-supervision cycle for 2028.

Under AMLAR Article 13(4), supervision begins six months after publication of the selected list; the first selection is capped at 40 when more entities qualify.^[15]

Typical post-onboarding cadence runs quarterly compliance reviews, behavioural transaction monitoring, daily sanctions re-screening, a documented suspicious activity report pipeline, annual wallet re-disclosure with event-driven updates, and enhanced due diligence refreshes (annual for high-risk, every two years for medium-high, every three years for medium). In New York, NYDFS’s 17 September 2025 Industry Letter says that all New York banking organisations, and the licensed branches and agencies of foreign banks, should consider using blockchain analytics tools.^[16]

The honest editorial position is that documentation discipline matters more than licence prestige for most operators at the placement stage. An MGA-licensed gambling operator with a polished, business-specific compliance pack and a clean Mastercard SPME §9.4.2 registration record will out-place a UKGC-licensed operator submitting template policies and a stale audit. Licence type is what gets a profile considered; documentation discipline is what gets it accepted.

What High-Risk Banking Costs

On our planning estimate, high-risk banking costs roughly 5 to 15 times standard SME pricing, and the multiple holds across the whole stack: monthly maintenance, SEPA, SWIFT, FX, and card processing. It prices the compliance and monitoring burden the institution has to carry, not a penalty levied against the individual business. The typical 2026 ranges follow (institutions quote per case), with the rolling-reserve mechanic that distorts cash flow worked through in cash terms.

The real constraint for most high-risk operators is not the headline transaction fee but the rolling reserve: a 10 percent reserve on card-processing volume of €5m monthly withholds €500k each month and locks €3m continuously once the 180-day window has filled, and operators routinely undercapitalise this line on the cost projection.

Unlike standard SME pricing, which is set by the institution’s published tariff and rarely negotiated, high-risk banking pricing is bilateral, dynamic, and moves down with three levers. A regulatory licence in place at the application stage (MiCA CASP, FCA cryptoasset registration, FINMA, BaFin, VARA, MGA, UKGC) compresses the friction premium toward the medium-risk tier.

Transaction-volume commitments typically buy markup reductions, with further rebates at higher monthly volume tiers, negotiated with each institution. The most consistent lever is compliance infrastructure maturity: SOC 2 Type II, ISO 27001:2022, a dedicated MLRO, Travel Rule readiness, and a documented chargeback workflow holding dispute rates under 0.5% all reduce the effective rate. Reserve negotiations rarely succeed in the first quarter; they open up after the third or fourth month of clean processing data, and can then step down, for example from 15% to 10% to 7.5% over 18 months.

How Jagelski & Partners Helps

Jagelski & Partners pre-qualifies high-risk businesses across 90+ banking and payment institutions, identifying the providers most likely to accept an application before it is formally filed. Jagelski & Partners scopes banking options in writing and introduces an independent specialist before any account application is filed. You contract directly with the specialist; account approval remains the financial institution's decision.

Through Jagelski & Partners’ partner network, businesses placed more than fourteen billion euros in client turnover across banking and EMI relationships in 2025. Each business is pre-qualified across the network before any formal application, and the institutional rate is passed through without markup. There is no onboarding fee.

Pre-qualification process. Pre-qualification is a 3–5 business-day exercise in which we present an anonymised business profile against the current acceptance criteria of institutions across the network. The institutions confirm appetite (yes, qualified yes, or no) before any application is submitted. The client does not formally apply to any institution until the placement is matched, which reduces the rejection-history risk that comes from going door-to-door.

Multi-provider strategy. The placement is not a single account. An operator processing material volume can diversify operational payments across a primary EEA-passported EMI and a second provider in a different jurisdiction and sponsor chain. A CASP receiving client funds other than e-money tokens must place them with a credit institution or central bank by the end of the following business day, in an account separately identifiable from its own funds, unless the CASP is itself an EMI, payment institution or credit institution under MiCA Article 70(5). That client-funds placement is a legal requirement where applicable, even if a bank is optional for the operator’s own treasury.

The independent specialist we introduce coordinates onboarding across all three so that operational dependency is split from day one. Jagelski & Partners is paid by the institution, not by the client. The placement carries no onboarding fee. Institutional banking and EMI pricing is passed through without markup.

Ongoing relationship. After the introduction, the client deals directly with the institution and any independent specialist retained for support. EDD refreshes, sanctions queries, transaction-monitoring alerts, periodic disclosures and any rate renegotiation belong to that direct relationship. Jagelski & Partners does not provide ongoing account support or manage delivery.

What the service does not do. Jagelski & Partners does not guarantee account opening. Pre-qualification identifies institutions most likely to accept the profile; it does not commit those institutions to approval. We do not pursue placement for businesses whose model the network cannot underwrite.

Frequently Asked Questions

References