What You Need to Operate a High-Risk Business
A high-risk business in 2026 needs five interlocking components: a regulated operating entity in the right jurisdiction, the activity-specific licence or registration, a high-risk banking arrangement with built-in redundancy, a card-acquirer or alternative-rails strategy that survives Visa VAMP and Mastercard ECP thresholds, and a live AML and chargeback-management stack.
“High-risk” is a banking-industry classification, not a judgement of legitimacy. It captures any merchant whose card-scheme merchant category code, transaction profile, or regulatory complexity produces elevated chargeback, fraud, or AML risk under the acquirer’s underwriting model. Card-scheme rulebooks do not themselves brand any MCC “high-risk”; the label flows from the monitoring programmes that capture these categories disproportionately. The Visa Acquirer Monitoring Programme (VAMP), in force since and under acquirer enforcement since , consolidated five legacy Visa programmes and 38 remediation processes into a single fraud-plus-dispute ratio.[1] Mastercard’s Excessive Chargeback Programme (ECP) tracks chargeback-to-transaction ratios with separate Excessive (ECM) and High-Excessive (HECM) tiers and escalating fee schedules into year two.[2] An operator’s MCC, business model, and historical chargeback record together determine whether the merchant is acceptable to a mainstream acquirer, a specialist high-risk acquirer, or no acquirer at all.
For most high-risk operators, the sequence is what determines the launch envelope. Formation runs first, but capital and key-person appointments can run in parallel. Banking pre-qualification should begin before capital is locked, because credible high-risk Electronic Money Institutions (EMIs) onboard licensed or licensable operators once the application file is in the regulator’s queue, not after authorisation. Card processing should be wired only after VAMP and ECP modelling: an operator whose expected fraud-plus-dispute ratio sits above the merchant Excessive threshold (1.5% in the EU, US, Canada, and Asia-Pacific from ) needs a product fix before card processing goes live, not a higher rolling reserve.[1]
The licence is the gate. For gambling, the route depends on the target market and the operator’s commercial appetite: Curaçao’s reformed CGA Green Seal for offshore credibility under a new regulator, Anjouan AOFA for the cheapest and fastest offshore entry, Malta MGA for EU passport access, Gibraltar for UK-adjacent reputation, Cyprus for EU sports-betting only, or Kahnawake for a North-American-adjacent corporate seat. For forex, the cluster is more bifurcated: Cyprus Investment Firm under CySEC for EU passport and MiFID II conduct rules, Abu Dhabi Global Market (ADGM) or Dubai International Financial Centre (DIFC) for regulated growth-jurisdiction credibility, Bahamas SCB or Labuan LFSA for established offshore. Saint Vincent and the Grenadines is closed for new forex entrants since the FSA’s notice of .[3]
The operating entity is typically a private limited company incorporated in the licensing jurisdiction. The substance choices vary sharply: Curaçao requires a resident managing director and Tier-IV-certified hosting; Cyprus CIF requires four directors and certified personnel; ADGM Category 3A requires a regulated FSRA Approved Person regime; Anjouan and Kahnawake have lighter physical-presence tests.
Card processing is a parallel workstream. Specialist high-risk acquirers typically quote 4.5%–8% all-in, with rolling reserves of 10%–20% held 90–180 days. Chargeback-management tooling (real-time dispute resolution, alerts, compelling-evidence packages) is no longer optional in 2026: the VAMP ratio excludes resolved disputes, so deploying these tools materially shifts the ratio before it triggers acquirer escalation.[1]
Ongoing compliance is permanent. AML obligations run under the EU Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624, applies ) and the European AML Authority (AMLA) operational from .[4] Card-scheme onboarding under the Visa Integrity Risk Programme and Mastercard’s Business Risk Assessment and Mitigation programme requires beneficial-owner identification, web-content review, and ongoing transaction monitoring. Activity-specific overlays apply: the UK Online Safety Act for adult platforms, MiCA for crypto-OTC desks, the EU Travel Rule for every CASP transfer with no de-minimis threshold (€1,000 is the verification trigger for self-hosted wallets, not an exemption floor).
Infrastructure Checklist
| Component | Purpose | Typical Timeline | Cross-Link |
|---|---|---|---|
| Company formation | Establish the regulated operating entity in the licensing jurisdiction | 1 to 4 weeks | Company formation |
| Licensing or registration | Authorise the activity under the chosen regime (gambling, forex, or adjacent) | 4 to 16 weeks drafting; 4 to 9 months regulator review depending on jurisdiction | Crypto licensing hub for crypto-adjacent activity |
| Banking placement (EMI plus correspondent) | Provide settlement, treasury, and payout infrastructure | 2 to 6 weeks EMI placement; 8 to 16 weeks traditional bank | High-risk banking |
| Card acquiring and alternative rails | Accept consumer payments; deploy Open Banking, account-to-account, and stablecoin rails for cost and redundancy | 4 to 8 weeks setup; ongoing chargeback tooling | (reference only) |
| Ongoing compliance | AML/CFT programme, transaction monitoring, RG and KYC tooling, audit, AMLA-readiness, card-scheme programme management | Permanent operating cost | (cross-reference within page) |
Choosing the Right Jurisdiction
Jurisdiction choice depends on the activity (gambling versus forex versus adjacent), the target market (EU retail, UK consumers, MENA, APAC, North America), the operator’s capital envelope, and the realistic banking profile that follows from the licence. In 2026 the practical decision narrows to two clusters: a gambling cluster running from Anjouan and the reformed Curaçao at the offshore end to Malta and Gibraltar at the EU and UK-adjacent end, and a forex cluster running from Labuan and the Bahamas at the offshore end to Cyprus, ADGM, and DIFC at the regulated end.
The decision framework runs across six axes: regulator posture toward the activity, capital and cost reality, banking accessibility, EU or UK market access, the speed and certainty of the application process, and the operational headcount required for substance. An operator serving EU retail gambling clients needs a Malta MGA licence or another EU-passporting authorisation; an operator serving non-EU markets through web-only distribution can run from Anjouan or Curaçao at materially lower cost. A forex operator targeting EU retail clients with leverage above 1:30 on majors cannot do so under the European Securities and Markets Authority (ESMA) caps codified in CySEC Directive DI-87-09; an operator targeting professional or non-EU retail clients can run from ADGM, DFSA, Bahamas, or Labuan with higher leverage and lighter conduct overlays.[5]
Jurisdiction Comparison
| Jurisdiction | Regulator | Activity | Capital | Application + annual | Tax | Banking 1–10 |
|---|---|---|---|---|---|---|
| Curaçao | CGA (under LOK) | Gambling B2C / B2B | ~€500k operating capital | €4,592 + €47,450 annual | 0% gaming; 2% E-Zone CIT | 5 |
| Anjouan (Comoros) | AOFA / ALSI | Gambling | None | ~€17,828 Year 1; ~€17,000 annual | 0% all taxes | 3 |
| Malta | MGA | Gambling B2C / B2B | €40k–€100k | €5,000 + €25,000 + compliance contribution | 5% gaming on Malta-based GGR; 35% CIT (effective lower) | 8 |
| Gibraltar | Gambling Commissioner (Gambling Act 2025) | Gambling B2C / B2B / Support Services | High substance bar | £10,000 + £100,000 per B2C category | 0.15% gross profit (£100k exempt); 12.5% CIT | 8 |
| Cyprus (NBA) | Εθνική Αρχή Στοιχήματοσ (NBA) | Sports betting Class B only | €500k + €550k bank guarantee | €30,000 (1-yr) or €45,000 (2-yr) | 13% effective (10% NPT + 3% NBA) | 7 |
| Kahnawake | KGC | Gambling (Client Provider Authorisation) | None | USD 40,000 + USD 20,000 annual | 0% | 6 |
| Cyprus (CIF) | CySEC | Forex / CFD investment firm | €75k–€750k paid-up | ~€40,000 + DORA + audit | 15% CIT (from 1 January 2026) | 7 |
| ADGM (Abu Dhabi) | FSRA | Forex / CFD / Cat 3A or Cat 4 | USD 50k (Cat 4) – USD 500k (Cat 3A) | USD 5,000–USD 40,000 each side | 9% federal CIT; 0% QFZP | 9 |
| DIFC (Dubai) | DFSA | Forex / CFD / Cat 2 / Cat 3A / Cat 4 | USD 30k (Cat 4) – USD 2m (Cat 2) | USD 25,000 each side | 9% federal CIT; 0% QFZP | 9 |
| Bahamas | SCB | Securities Industry Act 2024 + CFD overlay | USD 25k–USD 300k by class (SIR 2012 Reg. 55) | USD 5k + USD 20k + USD 45k CFD annual + quarterly activity fee | 0% CIT / CGT / WHT | 5 |
| Labuan | LFSA | Money broking (FX) | RM 1m conventional; RM 1.5m digital-asset≈ $222K conventional; $333K digital-asset | USD 5,000–USD 10,000 annual | 3% audited net profit or flat MYR 20,000≈ $4K flat | 5 |
| Saint Vincent and the Grenadines | FSA | Closed for new entrants (FSA notice ) | n/a | n/a | n/a | 2 |
Choose Curaçao under the new LOK if the operator wants offshore tax efficiency and is comfortable with an emerging-regulator credibility profile that is still settling. The Landsverordening op de Kansspelen entered into force on , replacing the master and sublicence model that had operated since 1996. The transitional Orange Seal regime ended on , and operators displaying the Orange Seal after that date are in breach of LOK Article 1.2(1). The CGA has a 553-application pipeline as of late 2024, which reads both as demand validation and as a queue-management risk. Substance is meaningful but achievable: a Curaçao public or private limited company with a resident managing director, statutory seat in Curaçao, Tier-IV-certified physical server hosting on the island, and a phased build-up to three resident key persons by year five (enforcement deadline extended to ).[6]
Choose Anjouan AOFA if the operator needs the fastest, cheapest credible offshore route and accepts that several large markets are geo-blocked (United States, United Kingdom, France, Germany, the Netherlands, Spain, Australia, and Austria). The Anjouan Offshore Finance Authority licence, administered by Anjouan Licensing Services Inc., is priced at roughly €17,828 all-in for Year 1 (incorporation, licence, compliance officer, ISP monitoring); the annual regulator pack runs at around €17,000 from Year 2, with a certificate-renewal-only fee of approximately €13,300; zero gaming, corporate, and VAT tax; and a 4-to-8-week timeline.[7] Major B2B suppliers (including the largest live-casino provider) now whitelist Anjouan licences, which closes the credibility gap the jurisdiction had in 2023.
Choose Malta MGA if the operator’s commercial model needs EU passport access and full reputational credibility. The Gaming Act 2018 framework prices a B2C Type 1 licence at €5,000 application plus €25,000 annual licence plus an annual compliance contribution ranging from €15,000 to €375,000 by gross gaming revenue band.[8] Malta’s 5% gaming tax applies only on Malta-based player revenue; the 35% corporate tax becomes effective 5% under the long-standing refund regime. The trade-off is the highest operational and regulatory cost on the gambling cluster, and a tighter advertising and player-protection overlay.
Choose Gibraltar if the operator’s customer base is primarily UK and EU and full institutional credibility matters. The Gambling Act 2025 (commenced under Notice of Commencement LN.2026/064, all sections except ss.55–77 which remain excluded pending a separate commencement notice) restructured the regime around six licence categories at £10,000 application plus £100,000 annual per B2C category and 0.15% gross-profit duty above £100,000 exempt. The dual UK tax burden is the planning constraint: UK Remote Gaming Duty at 40% applies on UK customer turnover regardless of operator location, which is why a major UK-listed sportsbook operator and other UK-facing brands have migrated to Malta.[9] See the Gibraltar formation guide for the formation layer; formation is arranged through a Gibraltar-resident agent.
Choose Cyprus NBA Class B only if the model is pure sports-event betting. Online casino, slots, poker, exchange betting, and lotteries remain prohibited in Cyprus, with operator penalties up to five years’ imprisonment and €300,000 fines.[10] The €500,000 paid-up capital plus a €550,000 bank guarantee from a Cyprus or EU bank is a real cost that pushes the practical floor of a Cyprus sports-betting build above many alternatives.
Choose Kahnawake if the operator wants a Mohawk Territory corporate seat with North-American-adjacent recognition. Servers must be hosted with Mohawk Internet Technologies inside the territory; the licence does not permit US-facing operations under the 2016 settlement with New Jersey’s Division of Gaming Enforcement. CPA pricing is USD 40,000 plus USD 20,000 annual.
Choose Cyprus CIF if the forex operator’s primary market is EU retail. The €75,000–€750,000 capital tiers under Cyprus Law 87(I)/2017 transpose MiFID II; DORA has applied to all CIFs since under CySEC Circular C700; CySEC Directive DI-87-09 (amended ) imposes ESMA leverage caps with a 10% initial margin floor for commodity or stock-index CFDs not expressly listed in the directive.[5] MiCA Article 60 lets a CIF notify CySEC and provide equivalent crypto-asset services without a separate CASP authorisation, which is a useful overlay for operators combining FX and crypto products. See the Cyprus crypto licensing guide for the MiCA layer.
Choose ADGM Category 3A or DFSA Category 3A if the forex operator wants regulated-jurisdiction credibility with materially better banking accessibility than EU peers. ADGM’s FSRA finalised prudential-framework reforms on : Category 4 base capital rose from USD 10,000 to USD 50,000; non-public-fund custody dropped from USD 4m to USD 250,000; professional-indemnity-insurance minimums apply from .[11] DFSA’s Consultation Paper 161 reforms, in force May 2025, set Category 4 base capital at USD 30,000; Activity-Based Capital Requirements are introduced in July 2026.[12] Both regimes pair with the UAE’s 9% federal corporate tax and the Qualifying Free Zone Person regime for 0% on qualifying income.
Choose Bahamas SCB or Labuan FSA if the forex operator’s clients are non-EU and the priority is cost-efficient regulated offshore. The Bahamas Securities Industry Act 2024 (No. 39 of 2024) replaced the 2011 Act in a “comprehensive overhaul and modernisation” per Prime Minister Davis’s contribution to Parliament; broker-dealer capital figures range from USD 25,000 (Class IV) to USD 300,000 (Class I), set by Regulation 55 of the Securities Industry Regulations 2012 and preserved transitionally under SIA 2024 pending a replacement capital rule. The CFD overlay under the Securities Industry (Contracts for Differences) Rules 2020 was repriced by the Securities Industry (Fees) Rules 2024 (S.I. No. 107 of 2024, gazetted ):
- CFD principal: USD 5,000 application, USD 20,000 registration, USD 45,000 annual renewal, plus a quarterly activity fee per Commission policy.
- CFD Supervisory Officer: USD 1,250 application, USD 3,750 registration, USD 6,250 annual renewal.[13]
Labuan’s Money Broking Licence under section 86 of the Labuan Financial Services and Securities Act 2010 sets paid-up at RM 1,000,000 (conventional) or RM 1,500,000 (digital-asset) under the LFSA Guidelines on the Establishment of Money Broking Business in Labuan IBFC effective , which revised the earlier RM 500,000 conventional floor; a 20% additional reserve continues to apply under ongoing reform.[14] Tax is 3% of audited net profits or a flat MYR 20,000 election.
Avoid SVG for new forex entrants. The FSA’s notice of required all Business Companies and Limited Liability Companies engaging in FX activity to provide a certified copy of a regulator licence from the jurisdiction(s) where the activity is conducted, with a transitional period to . The FSA does not issue an FX-specific licence and never did.[3] New SVG forex builds are not a credible 2026 route; operators that previously used SVG IBCs have migrated to Mauritius, Comoros (Mwali/Anjouan), Belize, Labuan, and the UAE.
Setting Up Your Company
Company formation for a high-risk business is straightforward in form and consequential in substance: the operating entity must be incorporated in the licensing jurisdiction, with the substance the regulator expects, before the licence application progresses. The standard route is a private limited company in the chosen jurisdiction, with share-capital, director, and shareholder structures shaped by the licensing regime.
Entity types vary by jurisdiction. Curaçao uses the public or private limited company under Curaçao corporate law, with statutory seat on the island and a resident managing director. Anjouan uses the International Business Company under Comoros law. Malta uses the limited liability company under the Maltese Companies Act. Gibraltar uses the private company limited by shares. Cyprus uses the limited liability company. Bahamas uses the company limited by shares under the Companies Act 1992 or the International Business Companies Act 2000. Labuan uses the Labuan company under the Labuan Companies Act 1990. ADGM and DIFC each operate their own companies law (ADGM Companies Regulations 2020; DIFC Companies Law 2018), with private companies the standard vehicle for licensed financial services.
Share-capital practice varies sharply. Anjouan, Kahnawake, and the Bahamas accept nominal share capital at formation, with licensing capital paid up before authorisation. Curaçao, Malta, Gibraltar, and Cyprus require the licensing capital to be paid up alongside or before the application. ADGM and DIFC apply base-capital requirements at authorisation, with risk-based add-ons assessed against the firm’s prudential category.
Director and key-person substance is the recurring trap. Curaçao’s LOK requires at least one resident managing director, with three resident key persons by year five (enforcement deadline extended to ). Malta’s MGA applies fit-and-proper assessment to all qualifying shareholders, directors, and key persons. Cyprus CIF requires two executive plus two independent non-executive directors, a Cyprus office, certified personnel under CySEC’s certification framework, and an external auditor on record. ADGM FSRA and DFSA each operate an Approved Person regime with senior executive officer, finance officer, compliance officer, and money-laundering reporting officer appointments tied to physical presence in the relevant free zone. Labuan reform now requires a Labuan office plus dedicated IT staff under the 2024 amendments.
For operators planning multi-vertical activity (gambling plus payments, forex plus crypto), the most common formation mistake is layering the holding entity into a jurisdiction the home regulator later treats as an indirect parent for substance-assessment purposes. The result is a regulator-led redesign mid-application, which adds three to six months to the launch envelope. A simpler structure, an operating entity in the licensing jurisdiction with a single layer of holding above it and substance in both places, survives most fit-and-proper reviews. In practice, operators that pre-clear the parent-company structure with the licensing regulator before formation typically shorten the application cycle by two to four months compared with operators that present the structure for the first time in the application file itself.
For gambling and adjacent verticals where Jagelski & Partners’ formation partner does not directly hold local-agent capacity (notably Curaçao, Anjouan, Malta, Gibraltar, and Kahnawake), formation runs through the licensing jurisdiction’s locally-licensed corporate-service agents, sequenced by Jagelski & Partners alongside the licensing and banking workstreams. For forex jurisdictions where the formation partner has direct coverage (Cyprus, Bahamas, Labuan, BVI, the UAE, and Belize), formation is delivered under a single engagement. See the full company formation hub and the European company formation and offshore company formation regional pages for the entity-level details.
Licensing Requirements
A high-risk business needs a licence or registration matched to the activity, not a generic “high-risk authorisation.” Gambling operators need a gambling licence from a recognised gaming regulator. Forex operators need an investment-firm or securities-broker licence from a securities regulator. Adult, CBD, OTC, and other adjacent verticals are licensed under general commercial frameworks plus activity-specific overlays (UK Online Safety Act for adult platforms, MiCA for crypto OTC desks, EU Novel Foods for CBD products).
The gambling cluster. Curaçao’s LOK regime is the structural change of the cycle. The Landsverordening op de Kansspelen, P.B. 2024 no. 157, was approved by Parliament on (13 votes in favour, 6 against) and entered into force on .[6] The Curaçao Gaming Authority replaced the legacy Gaming Control Board’s role of nominal regulator behind four private master licensees: the master and sublicence model is closed.
Application is phased over up to 24 weeks; eligible applicants are Curaçao public or private limited companies with a statutory seat on the island and at least one resident managing director. Fees published by the CGA are €4,592 non-refundable application plus €47,450 annual B2C licence, split between the National Treasury and CGA supervisory budget. Server hosting must be Tier IV certified, physically located in Curaçao, with jurisdictional access for audits. AML obligations under the GCB/CGA Anti-Money Laundering, Counter-Terrorist Financing, and Counter-Proliferation Financing Regulations have been in force since , with full compliance required by .
Anjouan’s licence under the Computer Gaming Licensing Act 2005 (modernised 2023) is administered by the Anjouan Offshore Finance Authority through Anjouan Licensing Services Inc. as administrator. The licence permits casino, sports betting, lottery, and crypto-gaming activity; geo-blocking is required for the United States, United Kingdom, France, Germany, the Netherlands, Spain, Australia, Austria, Comoros, and FATF-blacklisted jurisdictions.[7]
Malta’s MGA framework under the Gaming Act 2018 and Gaming Licence Fees Regulations splits activity into Type 1 (casino and RNG), Type 2 (fixed-odds betting), Type 3 (peer-to-peer, exchange, and bingo), and Type 4 (controlled-skill games). Application is €5,000 per licence; annual licence fee is €25,000 (Types 1–3) or €10,000 (Type 4); annual compliance contribution ranges from minimum €5,000–€25,000 to maximum €500,000–€600,000 depending on type and gross gaming revenue band.[8] The 12-month start-up exemption from compliance contribution is available to qualifying start-ups.
Gibraltar’s Gambling Act 2025 (commenced under LN.2026/064; sections 55–77 on personal-management licences remain excluded pending a separate commencement notice) replaced the 2005 Act with six licence categories: B2C Bookmaker, B2C Gaming, B2C Betting Intermediary, B2B, Gambling Operator Support Services, and Personal or Key-Person licences. Application is £10,000 per category; annual licence is £100,000 per B2C category (a B2C casino plus sportsbook operator pays £200,000 annually); gambling duty is 0.15% of gross profit with the first £100,000 exempt.[9]
Cyprus NBA Class B under Betting Law 37(I)/2019 authorises online sports-event betting only; online casino, slots, poker, exchange betting, and lotteries remain prohibited.[10] Capital is €500,000 paid-up plus a €550,000 bank guarantee. Kahnawake’s Client Provider Authorisation under the Regulations Concerning Interactive Gaming 1999 (last amended December 2024) is USD 40,000 application plus USD 20,000 annual, with a 6-month provisional period before the full 5-year CPA grants.
The forex cluster. Cyprus’s CIF licence under Law 87(I)/2017 is the dominant EU-passporting route for retail FX and CFD operators. Capital tiers are €75,000 paid-up (no client money or securities handling), €150,000 (matched-principal dealing), and €750,000 (dealing on own account and market-making).[15] ESMA’s product-intervention regime, codified in CySEC Directive DI-87-09, caps retail leverage at 30:1 on FX majors, 20:1 on non-majors and major indices (5% gold margin), 10:1 on commodities and non-major indices, 5:1 on equities, and 2:1 on cryptoassets; the amendment imposed a 10% initial-margin floor on commodity or stock-index CFDs not expressly listed.[5] Negative-balance protection is mandatory; the 50% margin close-out rule applies; monetary inducements are banned. MiCA Article 60 permits the CIF to provide equivalent crypto-asset services through notification, without a separate CASP authorisation.
ADGM FSRA Category 3A licences retail-or-institutional forex dealing as matched principal at USD 500,000 base capital, rising to USD 2,000,000 for retail OTC-derivatives dealing as matched principal under the FSRA’s amendments; Category 4 (arranging and advising) is USD 50,000.[11] DFSA Category 3A is USD 500,000; Category 4 is USD 30,000 under CP161 (May 2025), rising via the Activity-Based Capital Requirements introduced in July 2026.[12]
Bahamas SCB broker-dealer capital figures, set by Regulation 55 of the Securities Industry Regulations 2012 and transitionally preserved under the Securities Industry Act 2024 pending a replacement capital rule, are:
- Class I: USD 300,000.
- Class II: USD 120,000.
- Class III: USD 60,000.
- Class IV: USD 25,000.
SIA 2024 itself reorganises registration around functional categories (Dealing, Managing, Advising, Arranging) rather than numbered classes.[13] The CFD overlay under the Securities Industry (Contracts for Differences) Rules 2020, repriced by the Securities Industry (Fees) Rules 2024 (S.I. No. 107 of 2024, gazetted ), adds USD 5,000 application, USD 20,000 registration, and USD 45,000 annual renewal, plus a quarterly activity fee per Commission policy. Labuan’s Money Broking Licence (Conventional) under section 86 LFSSA 2010 (amended by Act A1654 of 2022) requires RM 1,000,000 paid-up unimpaired by losses (revised upward from RM 500,000 under LFSA Guidelines effective ), rising to RM 1,500,000 for digital-asset variants, with a 20% additional reserve under ongoing reform.[14]
Jagelski & Partners’ licensing partners are engaged by governments to draft national crypto and virtual-asset frameworks, and bring 16+ years of regulatory advisory experience across fintech and virtual-asset markets to high-risk licensing. In our experience, applications fail most often on the governance file rather than the technology file. A money-laundering reporting officer who cannot articulate the operator’s risk appetite in the regulator’s vocabulary, or a board composition that does not survive fit-and-proper scrutiny, costs more time than any single technical gap. See the crypto licensing hub for the consolidated crypto-asset framework that overlays many high-risk operations.
Banking
Banking is the binding constraint on most high-risk launches, not licensing. A correctly licensed gambling or forex operator with no operational banking is dark from day one, and operators that secure only one banking provider have one point of failure that closes the business when the provider exits. The structural answer is redundancy: two Electronic Money Institutions minimum, one card acquirer, one alternative-rails channel (Open Banking or stablecoin off-ramp), and chargeback-management tooling deployed before card processing goes live.
Why mainstream banks decline high-risk operators is structural, not personal. The European Banking Authority’s Opinion on de-risking (EBA/Op/2022/01, ) recorded that de-risking affects “payment institutions and electronic money institutions” themselves, with credit institutions terminating payment-institution and EMI accounts because of perceived AML risk; the EBA recorded that de-risking of entire categories of customers, without due consideration of individual customers’ risk profiles, can be unwarranted and a sign of ineffective ML/TF risk management.[4] The follow-up Guidelines (EBA/GL/2023/04, ) require risk-based rather than category-based decisions. Practical effect on a 2026 high-risk operator: the EMI archetype, not the traditional-bank archetype, is the realistic primary banking route, with traditional-bank correspondent relationships reserved for the licensed operator’s treasury layer.
The EMI archetype is well suited to the high-risk operator’s deposit-and-payout volume because the Electronic Money Directive 2 (Directive 2009/110/EC) creates a regulatory category authorised to issue dedicated IBANs, run SEPA and SEPA Instant flows, hold safeguarded client funds (note: not deposit-protected), and operate modern KYC and AML tooling that scales with transaction count. Onboarding for a licensed or licensable high-risk operator is typically 2 to 6 weeks once the file is complete. The traditional-bank archetype is better suited to the treasury layer, with broader correspondent reach for FX, settlement, payroll, and vendor payments; onboarding runs 8 to 16 weeks when achievable.
IBAN discrimination is the recurring operational problem. SEPA Regulation Article 9(2) (Regulation (EU) 260/2012) provides that a payee accepting a credit transfer or using a direct debit to collect funds from a payer holding a payment account located within the Union shall not specify the Member State in which that payment account is to be located. The Court of Justice confirmed in C-28/18 VKI v Deutsche Bahn () that residency-conditioned acceptance breaches Article 9(2).
On , the Italian Antitrust Authority fined a Lithuania-licensed pan-EU neobank group €11.5 million, with a €1.5 million element specifically for failing to provide clear and exhaustive information on the requirements and timeframe for obtaining an Italian IBAN (starting with IT) instead of a Lithuanian IBAN (starting with LT), in breach of articles 20, 21 and 22 of the Consumer Code.[16] Despite the law, Lithuanian and Belgian IBANs continue to face the highest rejection rates, at 24% and 23% of refused-IBAN complaints in the Accept My IBAN dataset (ECC-Net, 2025); operators with a substantive German or Dutch customer base should plan for at least one German or Dutch IBAN inside the banking stack.
Through Jagelski & Partners’ partner network, businesses placed more than fourteen billion euros in client turnover across banking and EMI relationships in 2025. Placement runs as pre-qualification across 90+ banking and payment institutions rather than sequential applications: the firm’s analysts assess the client profile against the live appetite of the partner network, surface the credible matches by archetype, and run placements in parallel. For high-risk operators, the matchable archetypes split into specialist high-risk EMIs with elevated reserve and pricing, regulated payments institutions in growth jurisdictions (notably the UAE) with lower-friction onboarding for licensed operators, and traditional banks with established crypto and gambling appetite typically requiring a regulated counterparty plus a minimum AUM commitment.
Jagelski & Partners is paid by the institution, not by the client. We do not mark up institutional banking or EMI pricing, and we do not charge an onboarding fee. The pricing on the client’s account-opening documentation is the institutional rate.
Card acquiring runs in parallel. Specialist high-risk acquirers price at 4.5%–8% all-in with rolling reserves of 10%–20% held for 90 to 180 days; setup fees are typically €5,000–€10,000. Chargeback-management tooling (real-time dispute resolution, alerts, and compelling-evidence packages) is now operational standard: resolved disputes are excluded from the VAMP ratio, so deploying these tools materially affects whether the merchant breaches the 1.5% Excessive threshold (live in the EU, US, Canada, and Asia-Pacific from under acquirer enforcement).[1] Mastercard’s ECP fee escalation reaches USD 100,000 per month from month 19 of continuous breach.[2] Experienced operators size the rolling-reserve impact on cash flow before signing the merchant agreement: a 15% reserve held 180 days on a €3 million monthly card book locks up €2.7 million of working capital at steady state, which is the operational figure that determines whether the acquirer pricing is acceptable, not the headline processing rate.
Ongoing Compliance
Ongoing compliance is a permanent operating cost, not a one-time licensing event. For a high-risk operator in 2026 the compliance perimeter runs across AML and CFT obligations under the new EU Anti-Money Laundering Package, activity-specific overlays (Online Safety for adult, MiCA Travel Rule for crypto, ESMA conduct for forex, Responsible Gambling for gaming), card-scheme programme management (VAMP, ECP, VIRP, BRAM), and ongoing prudential and supervisory reporting cycles.
The EU AML package is the cross-cutting regulatory event of 2026. Regulation (EU) 2024/1620 established the Anti-Money Laundering Authority (AMLA) in Frankfurt, operational from ; AMLAR Article 5(2) caps AMLA’s direct supervision at exactly 40 entities operating in at least six Member States, with the first selection process commencing and direct supervision transferring to AMLA on .
Regulation (EU) 2024/1624 (the AMLR Single Rulebook) applies from for most sectors and for professional football and certain crypto sectors; the beneficial-ownership threshold drops from “more than 25%” to “25% or more”, with the Commission empowered to lower it further to 15% for specified high-risk sectors.[4] The Directive component (Directive (EU) 2024/1640, AMLD6) restructures the member-state institutional framework. Twenty-three AMLA Level-2 and Level-3 measures must be published by , which makes 2026 the year operators must complete gap-assessment work rather than wait for the regime’s headline application date.
The EU Travel Rule (Regulation (EU) 2023/1113) has applied since : CASPs and obliged entities must collect originator and beneficiary data on every crypto-asset transfer, with no de-minimis threshold; transfers above €1,000 to or from a self-hosted wallet additionally trigger wallet-ownership verification. Operators running crypto OTC desks or stablecoin off-ramps as part of a high-risk business stack are inside this perimeter.
For UK-facing adult platforms, OFCOM’s HEAA regime under the Online Safety Act 2023 has been in force since . Approved methods include Open Banking, photo-identification matching, facial age estimation, credit-card check, digital identity services, mobile-network-operator authentication, and email-based estimation; self-declaration is explicitly insufficient. Maximum penalty under the Online Safety Act 2023 (Qualifying Worldwide Revenue) Regulations 2025 (in force ) is £18 million or 10% of qualifying worldwide revenue, plus business-disruption orders.[17] OFCOM enforcement through May 2026 includes six fines: notably the £1.35 million plus £50,000 penalty on 8579 LLC () for failure to implement age assurance and to respond to a statutory information request.
Gambling operators carry their own ongoing compliance burden: AML and CFT programmes calibrated to the licensing jurisdiction’s expectations (Malta MGA, Curaçao CGA, Gibraltar GC, Cyprus NBA), responsible-gambling tooling, source-of-funds checks on enhanced-due-diligence triggers (typically above £2,000 single transaction under UK Gambling Commission guidance with risk-sensitive triggers below), and ongoing system and compliance audits. Forex operators carry MiFID II conduct overlays (best execution, suitability and appropriateness, inducement rules), CySEC quarterly returns and audited financials, ESMA reporting, DORA ICT risk management since , and AMLA-readiness from 2026 onwards.
Frame compliance as a recurring fraction of revenue, not a project line. For a mid-sized high-risk operator (gambling or forex), the realistic annual cost runs €150,000–€600,000 across the money-laundering reporting officer and compliance team, transaction monitoring, AML and KYC tooling, card-scheme programme management, audit, and regulatory levies. Operators that under-budget compliance in year one typically over-spend it by 30%–50% in year two when a regulator request, a card-scheme remediation, or an enforcement action forces remedial spend.
Realistic Timeline and Costs
The realistic end-to-end timeline from formation to operational launch is 4 to 12 months for an offshore gambling build (Anjouan or Curaçao), 6 to 14 months for an EU gambling build (Malta or Gibraltar), and 6 to 15 months for a regulated forex build (Cyprus CIF, ADGM, or DFSA). The professional-fee envelope ranges from €30,000 to €250,000 depending on jurisdiction mix, business model complexity, and the parent-company structure. Capital, banking float, and ongoing operating expenditure sit outside that figure.
End-to-End Timeline and Cost Range
| Phase | Timeline | Cost Range (professional fees) | Notes |
|---|---|---|---|
| Company formation | 1 to 4 weeks | €2,000 to €10,000 | Varies by jurisdiction; local-agent route applies for Curaçao, Anjouan, Malta, Gibraltar, Kahnawake |
| Banking and payments pre-qualification | 3 to 5 days pre-qualification; placement 2 to 16 weeks downstream | €0 (paid by the institution) | No markup, no onboarding fee; runs in parallel with capital deposit and file drafting |
| Licensing application drafting and filing | 4 to 16 weeks drafting; 4 to 9 months regulator review | €20,000 to €120,000 | Anjouan and Kahnawake at the lower end; Malta and Cyprus CIF at the higher end |
| Card acquiring and alternative rails setup | 4 to 8 weeks | €5,000 to €25,000 setup; 4.5%–8% all-in processing; 10%–20% rolling reserve | Begins only after VAMP and ECP modelling; chargeback tooling deployed first |
| Pre-launch readiness | 2 to 6 weeks | Variable | Governance sign-off, MLRO induction, RG and KYC tooling integration, external-audit engagement |
| Total to operational launch | 4 to 15 months realistic | €30,000 to €250,000 in professional fees, plus minimum capital, plus banking float | Jurisdiction mix and product complexity drive the variance more than the regulator’s pace |
What compresses the envelope: pre-qualified banking before capital is locked, pre-drafted compliance documentation (AML/CFT manual, governance policies, MLRO appointment, responsible-gambling policy for gaming or best-execution policy for forex), a clean fit-and-proper file for directors and substantial shareholders, and a chosen regulator with a published throughput record. What expands it: regulator backlog (Curaçao CGA on a 553-application pipeline as of late 2024; CySEC on a thicker post-MiCA queue), banking sequenced after licensing rather than in parallel, a parent-company structure the regulator decides to assess for indirect substance, and an MLRO appointed late.
The realistic envelope expands when banking is treated as a downstream task and contracts when it runs in parallel with capital deposit and file drafting. In our experience, operators that start the banking conversation early enough to surface the institutions’ appetite before the licence file is filed shorten the path to live trading by six to ten weeks, because the regulator’s banking question is answered when the file is read, not after.
Frequently Asked Questions
“High-risk” is a banking and card-scheme classification reflecting elevated chargeback, fraud, or AML risk under the acquirer’s underwriting model. It captures gambling and forex operators, OTC desks, adult-content platforms, CBD and cannabis-adjacent commerce, nutraceuticals and DTC pharma, dating and ticketing platforms, debt collection, and several adjacent verticals. The label flows from card-scheme monitoring programmes (Visa VAMP, Mastercard ECP) that capture these categories disproportionately, plus regulator and EU AML guidance on customer-due-diligence intensity. It is not a judgement of business legitimacy; it is an acquirer’s risk-rating decision driven by transaction profile, regulatory complexity, and historical loss data.
From , the merchant Excessive VAMP ratio dropped from 2.2% to 1.5% in the European Union, United States, Canada, and Asia-Pacific. The VAMP ratio combines TC40 fraud reports and TC15 non-fraud disputes against settled card-not-present volume. Merchants above 1.5% face acquirer escalation and a USD 8 per-case fee on the acquirer and merchant. Resolved disputes through Verifi RDR and CDRN, Ethoca Alerts, Order Insight, and Compelling Evidence 3.0 are excluded from the ratio, so the live operational answer is to deploy chargeback-management tooling before the merchant ratio reaches the threshold, not after.
Yes, with caveats. The Landsverordening op de Kansspelen replaced the master-and-sublicence model on ; the Orange Seal transition ended on ; operators displaying the Orange Seal after that date are in breach of LOK Article 1.2(1). New applicants apply directly to the Curaçao Gaming Authority for a Green Seal at €4,592 application plus €47,450 annual fee, with operating capital of approximately €500,000 and Tier-IV-certified server hosting in Curaçao. The CGA had a 553-application pipeline at late 2024, which reads as both demand validation and queue-management risk. Curaçao now sits between Anjouan (cheaper, faster, less credible) and Malta (more expensive, slower, EU-passported).
The SVG Financial Services Authority’s notice of required all Business Companies and Limited Liability Companies engaging in FX activity to provide a certified copy of a regulator licence from the jurisdiction(s) where the activity is conducted, with a transitional period to . The FSA has never issued an FX-specific licence and does not propose to do so. Sanctions for non-compliance run under FSA Act section 37(1) (cancellation of registration) and the IBC (Amendment) Act 2018 section 172(1)(a)(ii) (strike-off). New forex operators have migrated primarily to Mauritius, Comoros (Mwali or Anjouan), Belize, Labuan, and the UAE. SVG is not a credible 2026 route for a new forex build.
AMLA has been operational from and is based in Frankfurt. Direct supervision is statutorily capped at exactly 40 entities under AMLAR Article 5(2): the selection process begins on and supervision transfers to AMLA on . Twenty-three AMLA Level-2 and Level-3 regulatory technical standards and guidelines must be published by , which means high-risk obliged entities should be running gap-assessment work through 2026 rather than waiting for the AMLR headline application date of . The new 25%-or-more beneficial-ownership threshold applies from across all obliged entities, including high-risk verticals.
Operationally, no. A single Electronic Money Institution is a single point of failure, and EMI exits from specific high-risk verticals (crypto, gambling, adult) happen multiple times per year. The minimum redundancy posture for a high-risk operator in 2026 is two EMIs, one card acquirer, and one alternative-rails channel (Open Banking, account-to-account, or stablecoin off-ramp). Operators with substantive German, Dutch, or French customer bases should also build at least one local-IBAN-country relationship to mitigate IBAN-discrimination friction, despite the legal protection in SEPA Regulation Article 9(2) and the recent Italian Antitrust Authority decision against a Lithuania-licensed pan-EU neobank group (, €11.5 million total).
Licensing and formation are quoted as separate engagements with transparent professional fees. Banking is different. Jagelski & Partners is paid by the institution, not by the client. We do not mark up institutional banking or EMI pricing, and we do not charge an onboarding fee. Compliance advisory, MLRO support, AMLA-readiness work, and card-scheme programme management (VAMP and ECP) are quoted upfront and separately. For a high-risk operator across formation, licensing, banking placement, card-acquiring setup, and pre-launch readiness, the realistic professional-fee envelope is €30,000 to €250,000 depending on jurisdiction mix and complexity. Capital and banking float sit outside that figure and are paid into the operating entity.
Plan Your High-Risk Business Launch
Jagelski & Partners scopes formation, licensing, banking, and compliance for gambling, forex, and adjacent high-risk operators across 52 jurisdictions. Strategy call in 24 hours.
References
Show all references
- Visa, Visa Acquirer Monitoring Program Fact Sheet 2025, corporate.visa.com, accessed .
- Mastercard (via JPMorgan Payments and Moneris Solutions), Visa/Mastercard Risk Program Thresholds (March 2025), moneris.com, accessed .
- Financial Services Authority of Saint Vincent and the Grenadines, Notice on Companies engaging in Forex Business Activity (), svgfsa.com, accessed .
- European Banking Authority, Opinion of the European Banking Authority on ‘de-risking’ (EBA/Op/2022/01, ), eba.europa.eu, accessed .
- Cyprus Securities and Exchange Commission, Directive DI-87-09 of CySEC on the Restriction of Marketing, Distribution or Sale of CFDs to Retail Clients (as amended ), cysec.gov.cy, accessed .
- Curaçao Gaming Authority, Online Gaming under the Landsverordening op de Kansspelen (LOK), cga.cw, accessed .
- Anjouan Offshore Finance Authority (administered by Anjouan Licensing Services Inc.), Anjouan Gaming Licensing framework under the Computer Gaming Licensing Act 2005, offshorefinanceauthority.com, accessed .
- Malta Gaming Authority, Gaming Licence Fees Regulations (Legal Notice 409 of 2017) and Gaming Act 2018 framework, mga.org.mt, accessed .
- Government of Gibraltar Gambling Division, The Gambling Act 2025 (Notice of Commencement LN.2026/064; commenced for all sections except ss.55–77 which remain excluded pending a separate commencement notice), gamblingdivision.gov.gi, accessed .
- National Betting Authority (Cyprus), Betting Law 37(I)/2019 and licensing framework, nba.gov.cy, accessed .
- Abu Dhabi Global Market Financial Services Regulatory Authority, FSRA Getting Started Guide (May 2025) and Dear SEO letter on prudential framework reform (), adgm.com, accessed .
- Dubai Financial Services Authority, Prudential, Investment, Insurance Intermediation and Banking Module (PIB) and Consultation Paper 161 on prudential framework reform, dfsa.ae, accessed .
- Securities Commission of The Bahamas, Securities Industry Act 2024 (No. 39 of 2024); Securities Industry (Contracts for Differences) Rules 2020 (substantive framework) read with the Securities Industry (Fees) Rules 2024 (S.I. No. 107 of 2024, gazetted ) (current fee schedule); broker-dealer class capital figures preserved transitionally from Regulation 55 of the Securities Industry Regulations 2012, scb.gov.bs, accessed .
- Labuan Financial Services Authority, Labuan Financial Services and Securities Act 2010 (s.86 Money Broking framework, as amended by Act A1654 of 2022) read with LFSA Guidelines on the Establishment of Money Broking Business in Labuan IBFC, effective , labuanfsa.gov.my, accessed .
- Republic of Cyprus, Law 87(I)/2017 on the Provision of Investment Services, the Exercise of Investment Activities, the Operation of Regulated Markets and other related matters, transposing MiFID II, cysec.gov.cy, accessed .
- European Union, Regulation (EU) 260/2012 establishing technical and business requirements for credit transfers and direct debits in euro (Article 9), eur-lex.europa.eu, accessed . See also Italian Antitrust Authority (AGCM) decision of fining a Lithuania-licensed pan-EU neobank group €11.5 million for IBAN-related and other consumer-code breaches; AGCM English-language press release at en.agcm.it.
- OFCOM, Online Safety Act 2023: Highly Effective Age Assurance Guidance (January 2025) and Protection of Children Codes (April 2025); Online Safety Act 2023 (Qualifying Worldwide Revenue) Regulations 2025 (in force ), ofcom.org.uk, accessed .