High-Risk Business Infrastructure: Licensing, Banking & Compliance

What You Need to Operate a High-Risk Business

A high-risk business in 2026 needs five interlocking components: a regulated operating entity in the right jurisdiction, the activity-specific licence or registration, a high-risk banking arrangement with built-in redundancy, a card-acquirer or alternative-rails strategy that survives Visa VAMP and Mastercard ECP thresholds, and a live AML and chargeback-management stack.

“High-risk” is a banking-industry classification, not a judgement of legitimacy. It captures any merchant whose card-scheme merchant category code, transaction profile, or regulatory complexity produces elevated chargeback, fraud, or AML risk under the acquirer’s underwriting model.

Card schemes also define high-integrity-risk categories and MCC conditions. Visa’s listed categories include specified card-absent cases; a code does not make every transaction high-risk. This scheme classification is separate from an acquirer’s individual underwriting and monitoring programmes.^[10]

The Visa Acquirer Monitoring Programme (VAMP) consolidated the earlier VAMP, the Visa Fraud Monitoring Program and the Visa Dispute Monitoring Program into a single global programme built on one fraud-plus-dispute ratio, with thresholds effective from 1 June 2025 and an advisory period that ended on 30 September 2025.^[1]

Mastercard’s Excessive Chargeback Programme (ECP) tracks chargeback-to-transaction ratios with separate Excessive (ECM) and High-Excessive (HECM) tiers and escalating fee schedules into year two.^[2] An operator’s MCC, business model, and historical chargeback record together determine whether the merchant is acceptable to a mainstream acquirer, a specialist high-risk acquirer, or no acquirer at all.

For most high-risk operators, the sequence is what determines the launch envelope. Formation runs first, but capital and key-person appointments can run in parallel. Banking pre-qualification should begin before capital is locked, because credible high-risk Electronic Money Institutions (EMIs) onboard licensed or licensable operators once the application file is in the regulator’s queue, not after authorisation.

Card processing should be wired only after VAMP and ECP modelling: an operator whose expected fraud-plus-dispute ratio sits above the merchant Excessive threshold (1.5% in the EU, US, Canada, and Asia-Pacific from 1 April 2026; 1.5% in LAC; 2.2% in CEMEA) needs a product fix before card processing goes live, not a higher rolling reserve.^[1] These Visa merchant thresholds apply where the acquirer is neither Above Standard nor Excessive; Visa’s public fact sheet excludes Brazil, Chile, and India; their programmes are announced separately. Monthly floors are 1,500 fraud-and-dispute events, or in CEMEA at least 150 events and USD 75,000.

The licence is the gate. For gambling, the route depends on the target market and the operator’s commercial appetite: Curaçao’s reformed CGA Green Seal for offshore credibility under a new regulator, Malta MGA for EU-supervised credibility, Gibraltar for UK-adjacent reputation, Cyprus for EU sports-betting only, or Kahnawake for a North-American-adjacent corporate seat.

For forex, the cluster is more bifurcated: Cyprus Investment Firm under CySEC for EU passport and MiFID II conduct rules, Abu Dhabi Global Market (ADGM) or Dubai International Financial Centre (DIFC) for regulated growth-jurisdiction credibility, Bahamas SCB or Labuan LFSA for established offshore. Saint Vincent and the Grenadines is closed: there is no SVG forex licence and foreign authorisation is required, because the FSA issues no forex or brokerage licence and does not regulate the companies used for it.^[3]

The operating entity is typically a private limited company incorporated in the licensing jurisdiction. The substance choices vary sharply: Curaçao requires a resident managing director and the player-transaction register on a Tier-IV certified server on the island; Cyprus CIF requires four directors and certified personnel; ADGM Category 3A requires a regulated FSRA Approved Person regime; Kahnawake has lighter physical-presence tests.

Card processing is a parallel workstream. Specialist high-risk acquirers typically quote 4.5%–8% all-in, with rolling reserves of 10%–20% held 90–180 days. Chargeback-management tooling (real-time dispute resolution, alerts, compelling-evidence packages) is no longer optional in 2026: the VAMP ratio excludes disputes resolved through pre-dispute solutions and fraud reports that qualify for Compelling Evidence 3.0, in both cases subject to the timing of Visa’s data extract, so deploying these tools materially shifts the ratio before it triggers acquirer escalation.^[1]

Ongoing compliance is permanent. AML obligations run under the EU Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624, applies 10 July 2027) and the European AML Authority (AMLA) operational from 1 July 2025.^[19][20] Card-scheme onboarding under the Visa Integrity Risk Programme and Mastercard’s Business Risk Assessment and Mitigation programme requires beneficial-owner identification, web-content review, and ongoing transaction monitoring.

Activity-specific overlays apply: the UK Online Safety Act for adult platforms, MiCA for crypto-OTC desks, the EU Travel Rule for every CASP transfer with no de-minimis threshold (€1,000 is the verification trigger for self-hosted wallets, not an exemption floor).

Infrastructure Checklist

Choosing the Right Jurisdiction

Anjouan and Mwali, as of August 2026. The Banque Centrale des Comores names both island authorities among fictitious structures issuing licences illegally, and the 2024 GIABA mutual evaluation records gambling as prohibited throughout the Union of the Comoros. Banks, payment providers, and platform counterparties price that in. Anjouan stays in the comparison below so the trade-off is visible. Curaçao under the LOK and Malta under its Gaming Act license through a lawfully constituted regulator, which Anjouan cannot show; neither licence replaces the permission each target market requires.

Jurisdiction choice depends on the activity (gambling versus forex versus adjacent), the target market (EU retail, UK consumers, MENA, APAC, North America), the operator’s capital envelope, and the realistic banking profile that follows from the licence. In 2026 the practical decision narrows to two clusters: a gambling cluster running from the reformed Curaçao at the offshore end to Malta and Gibraltar at the EU and UK-adjacent end, and a forex cluster running from Labuan and the Bahamas at the offshore end to Cyprus, ADGM, and DIFC at the regulated end.

The decision framework runs across six axes: regulator posture toward the activity, capital, and cost reality, banking accessibility, EU or UK market access, the speed, and certainty of the application process, and the operational headcount required for substance. An operator serving EU retail gambling clients needs a licence in each target member state; an operator serving non-EU markets through web-only distribution can run from Curaçao at materially lower cost, and Anjouan is included in the comparison only subject to the warning above.

A forex operator targeting EU retail clients with leverage above 1:30 on majors cannot do so under the European Securities and Markets Authority (ESMA) caps codified in CySEC Directive DI-87-09; an operator targeting professional clients can run from ADGM or the DFSA, whose retail margin rules do not apply to them, and one targeting non-EU retail clients can use the Bahamas, where, as of October 2026, the CFD Rules allow up to 200:1.^[5] Labuan is an option only for institutional and high-net-worth clients, whom Labuan money broking is intended to serve.^[14]

Jurisdiction Comparison

Choose Curaçao under the new LOK if the operator wants offshore tax efficiency and is comfortable with an emerging-regulator credibility profile that is still settling. The Landsverordening op de Kansspelen entered into force on 24 December 2024, replacing the master and sublicence structure of the 1993 offshore-gaming ordinance. The transitional Orange Seal regime ended on 15 October 2025, and operators displaying the Orange Seal after that date are in breach of LOK Article 1.2(1).

The CGA’s licence register of 21 September 2026 lists 665 licence records, 109 of them marked expired or revoked, which reads both as demand validation and as active supervision.^[24] Substance is meaningful but achievable: a Curaçao public or private limited company with a resident managing director, statutory seat in Curaçao, the critical player-transaction register held on a server in a Tier-IV certified data centre on the island, and a phased build-up to three resident key persons by year five (enforcement deadline extended to 1 April 2027).^[6]

Anjouan is excluded from the licensing recommendations. The Banque Centrale des Comores warns that AOFA and related bodies lack legal authorisation and that no online betting, gaming or gambling licence has been issued in the Union. Commercial package prices, renewal quotes, and delivery estimates cannot be presented as statutory licence fees or a lawful approval timeline. No blanket gaming, corporate or VAT exemption is established by those marketing claims.^[7]

A supplier’s willingness to contract with an operator does not establish regulatory permission. Check the operator’s lawful authorisation and customer-market restrictions before arranging software, payment rails or a separate payment-agent company. These commercial arrangements do not validate a private Anjouan certificate.

Choose Malta MGA if the operator’s commercial model needs a licence supervised inside the EU and full reputational credibility. The Gaming Act 2018 framework prices a B2C Type 1 licence at €5,000 application plus €25,000 annual licence plus a revenue-based compliance contribution, paid monthly, with an annual €15,000 minimum and €375,000 maximum; first-period minimum relief and qualifying-start-up relief apply.^[8]

Malta’s 5% gaming tax applies only to Malta-based player revenue. The company first pays 35% corporate income tax; a qualifying 6/7 shareholder refund on distributed trading profits can produce a combined 5% effective result, so 5% is not an automatic company rate. The trade-off is the highest operational and regulatory cost on the gambling cluster, and a tighter advertising and player-protection overlay.

Choose Gibraltar if the operator wants a British Overseas Territory licence and institutional credibility matters; a Gibraltar licence gives no automatic UK or EU market access. The Gambling Act 2025 (commenced 1 April 2026 under Notice of Commencement LN.2026/064, all sections except ss.55–77 which remain excluded pending a separate commencement notice) restructured the regime around six licence categories.^[9] Under the Gambling (Duties and Licence Fees) Regulations 2026, a new B2C betting or gaming operator pays a £30,000 application fee and £50,000–200,000 a year per licence by annual gross yield, and general betting and gaming duty is 0.15% of gross profit with the first £100,000 exempt. See the Gibraltar formation guide for the corporate layer.

Remote Gaming Duty is 40% of remote gaming profits from UK persons, not customer turnover. HMRC defines the base as relevant gaming payments less the applicable prizes. The place-of-consumption rule applies regardless of operator location, so moving to Malta does not remove this UK liability. Remote betting is subject to a separate duty; do not apply the online-gaming rate to sports-betting turnover.^[18]

Choose Cyprus NBA Class B only if the model is pure sports-event betting. Online casino games (including slots and poker), betting exchanges, spread betting, and greyhound-race betting remain prohibited in Cyprus, with operator penalties up to five years’ imprisonment and €300,000 fines.^[10] The €500,000 paid-up capital plus a €550,000 bank guarantee from a Cyprus or EU bank is a real cost that pushes the practical floor of a Cyprus sports-betting build above many alternatives.

Choose Kahnawake if the operator wants a Mohawk Territory corporate seat with North-American-adjacent recognition. Servers must be hosted with Mohawk Internet Technologies inside the territory; Kahnawake-hosted sites may not serve US residents in states where they are not authorised, under the agreement the New Jersey Division of Gaming Enforcement announced on 26 September 2016.^[26] CPA pricing is USD 35,000 to apply, including the first year’s annual fee (USD 40,000 for complete applications filed from 1 January 2027), then USD 20,000 a year.

Choose Cyprus CIF if the forex operator’s primary market is EU retail. The €75,000–€750,000 initial-capital tiers come from Article 9 of the Investment Firms Directive and apply to CIFs licensed under Cyprus Law 87(I)/2017, which transposes MiFID II; DORA has applied to all CIFs since 17 January 2025 under CySEC Circular C700; CySEC Directive DI-87-09 (amended 5 September 2025) imposes ESMA leverage caps with a 10% initial margin floor for commodity or stock-index CFDs not expressly listed in the directive.^[5]

MiCA Article 60 lets a CIF notify CySEC and provide equivalent crypto-asset services without a separate CASP authorisation, which is a useful overlay for operators combining FX and crypto products. See the Cyprus crypto licensing guide for the MiCA layer.

Choose ADGM Category 3A or DFSA Category 3A if the forex operator wants regulated-jurisdiction credibility with materially better banking accessibility than EU peers. ADGM’s FSRA finalised prudential-framework reforms on 19 August 2025: Category 4 base capital rose from USD 10,000 to USD 50,000; non-public-fund custody dropped from USD 4m to USD 250,000; professional-indemnity-insurance minimums apply from 1 January 2026.^[11]

DFSA’s Consultation Paper 161 reforms, in force from 1 July 2025, set Category 4 base capital at USD 30,000; Activity-Based Capital Requirements are introduced in July 2026.^[12] Both regimes pair with the UAE’s 9% federal corporate tax and the Qualifying Free Zone Person regime for 0% on qualifying income.

Choose Bahamas SCB or Labuan FSA if the forex operator’s clients are non-EU and the priority is cost-efficient regulated offshore. The Bahamas Securities Industry Act 2024 (No. 39 of 2024) replaced the 2011 Act in a “comprehensive overhaul and modernisation” per Prime Minister Davis’s contribution to Parliament; broker-dealer capital figures range from USD 25,000 (Class IV) to USD 300,000 (Class I), originating in Regulation 55 of the Securities Industry Regulations 2000, preserved by Regulation 149 of the 2012 Regulations pending other prescribed requirements. The CFD overlay under the Securities Industry (Contracts for Differences) Rules 2020 was repriced by the Securities Industry (Fees) Rules 2024 (S.I. No. 107 of 2024, gazetted 23 December 2024):

• CFD principal: USD 5,000 application, USD 20,000 registration, USD 45,000 annual renewal, plus a quarterly activity fee per Commission policy.
• CFD Supervisory Officer: USD 1,250 application, USD 3,750 registration, USD 6,250 annual renewal.^[13]

Labuan’s Money Broking Licence under section 90 of the Labuan Financial Services and Securities Act 2010 sets paid-up at RM 1,000,000 (conventional) or RM 1,500,000 (digital-asset) under the LFSA Guidelines on the Establishment of Money Broking Business in Labuan IBFC effective 9 September 2024, which revised the earlier RM 500,000 conventional floor.^[14]

Tax is 3% of audited net chargeable profits where the annual economic-substance requirements are met, rising to 24% of chargeable profits under LBATA s.2B(1A) if they are not (the Income Tax Act 1967 applies only by irrevocable election); the legacy fixed MYR 20,000 lump-sum election was abolished by the Finance Act 2018 from the year of assessment 2020 (accounting periods ending in 2019).^[27]

Avoid SVG for new forex entrants. The FSA’s current warning notices state that it does not issue licences for forex trading or brokerage, does not regulate Business Companies or Limited Liability Companies engaged in it, and that any such company must be authorised in the jurisdiction or jurisdictions where its clients are located.^[3] New SVG forex builds are not a credible 2026 route: a new operator needs the authorisation its customer markets require, and the forex licensing guide compares the routes, including Mauritius, Belize, Labuan, and the UAE.

Setting Up Your Company

Incorporation eligibility and local substance depend on the licensing regime. For example, the Malta Gaming Authority accepts applications from companies established in the EU or EEA, subject to the other application conditions; Maltese incorporation is not universal. The entity’s capital, directors, shareholders and operational substance must meet the chosen regime’s requirements.^[11]

Entity types vary by jurisdiction. Curaçao uses the public or private limited company under Curaçao corporate law, with statutory seat on the island and a resident managing director. Anjouan uses an International Business Company under island-level Anjouan legislation. For Malta, an eligible EU or EEA company may apply; the Maltese limited liability company is one option. Gibraltar uses the private company limited by shares. Cyprus uses the limited liability company.

Bahamas uses the company limited by shares under the Companies Act 1992 or the International Business Companies Act 2000. Labuan uses the Labuan company under the Labuan Companies Act 1990. ADGM and DIFC each operate their own companies law (ADGM Companies Regulations 2020; DIFC Companies Law 2018), with private companies the standard vehicle for licensed financial services.

Share-capital practice varies sharply. Kahnawake and the Bahamas accept nominal share capital at formation, with licensing capital paid up before authorisation. Malta, Gibraltar, and Cyprus require the licensing capital to be paid up alongside or before the application. Curaçao assesses financial viability and sufficient liquidity for expected prize payments; its LOK does not prescribe a general fixed paid-up licensing-capital amount or universal payment deadline. ADGM and DIFC apply base-capital requirements at authorisation, with risk-based add-ons assessed against the firm’s prudential category.

Director and key-person substance is the recurring trap. Curaçao’s LOK requires at least one resident managing director, with three resident key persons by year five (enforcement deadline extended to 1 April 2027). Malta’s MGA applies fit-and-proper assessment to all qualifying shareholders, directors, and key persons. Cyprus CIF requires two executive plus two independent non-executive directors, a Cyprus office, certified personnel under CySEC’s certification framework, and an external auditor on record.

ADGM FSRA and DFSA each operate an Approved Person regime with senior executive officer, finance officer, compliance officer, and money-laundering reporting officer appointments tied to physical presence in the relevant free zone. Labuan’s 2024 Money Broking Guidelines require an operational office in Labuan and, for electronic business models, dedicated IT staff.^[14]

For operators planning multi-vertical activity (gambling plus payments, forex plus crypto), the most common formation mistake is layering the holding entity into a jurisdiction the home regulator later treats as an indirect parent for substance-assessment purposes. The result is a regulator-led redesign mid-application, which adds three to six months to the launch envelope. A simpler structure, an operating entity in the licensing jurisdiction with a single layer of holding above it and substance in both places, survives most fit-and-proper reviews. In practice, operators that pre-clear the parent-company structure with the licensing regulator before formation typically shorten the application cycle by two to four months compared with operators that present the structure for the first time in the application file itself.

For gambling and adjacent verticals where Jagelski & Partners’ formation partner does not directly hold local-agent capacity (notably Curaçao, Malta, Gibraltar, and Kahnawake), formation runs through the licensing jurisdiction’s locally-licensed corporate-service agents, sequenced by the independent specialist carrying the mandate alongside the licensing and banking workstreams.

For forex jurisdictions where the formation partner has direct coverage (Cyprus, Bahamas, Labuan, BVI, the UAE, and Belize), the formation partner delivers formation under its own engagement with the client. See the full company formation hub and the European company formation and offshore company formation regional pages for the entity-level details.

Licensing Requirements

A high-risk business needs a licence or registration matched to the activity, not a generic “high-risk authorisation.” Gambling operators need a gambling licence from a recognised gaming regulator. Forex operators need an investment-firm or securities-broker licence from a securities regulator. Adult, CBD, OTC, and other adjacent verticals are licensed under general commercial frameworks plus activity-specific overlays (UK Online Safety Act for adult platforms, MiCA for crypto OTC desks, EU Novel Foods for CBD products).

The gambling cluster. Curaçao’s LOK regime is the structural change of the cycle. The Landsverordening op de Kansspelen, P.B. 2024 no. 157, was approved by Parliament on 17 December 2024 (13 votes in favour, 6 against) and entered into force on 24 December 2024.^[6] The Curaçao Gaming Authority replaced the legacy Gaming Control Board’s role of nominal regulator behind four private master licensees: the master and sublicence model is closed.

From a complete file, the LOK Article 5.1 clock runs eight weeks for phase 1 (extendable by four), four weeks for the applicant to file phase 2, and eight weeks for the phase-2 decision (extendable by four); eligible applicants are Curaçao public or private limited companies with a statutory seat on the island and at least one resident managing director. Fees set by the LOK are €4,592 non-refundable application plus €47,450 annual B2C licence, split between the National Treasury and CGA supervisory budget. A ministerial regulation can adjust the annual amounts from 1 January of any year in line with the consumer price index. Owner-related and domain/application charges are additional; the first annual charge is prorated.

The LOK does not require the gaming platform itself to sit on the island. What it requires is narrower and easy to under-budget: the digital register of the critical data on players, gameplay, and financial transactions must be kept available to the CGA at all times on a server in a Tier-IV certified data centre in Curaçao.^[6]

AML obligations under the GCB/CGA Anti-Money Laundering, Counter-Terrorist Financing, and Counter-Proliferation Financing Regulations have been in force since 20 May 2024, with full compliance required by 1 September 2024.

Anjouan is excluded as a recognised gambling licensing route. The marketed certificate does not establish permission for casino, sports betting, lottery, prediction markets, or crypto-gaming. No officially published licensing procedure, fee schedule, or statutory decision clock has been identified; the BCC warning applies irrespective of a vendor’s activity list or geo-blocking conditions.^[7]

Malta’s MGA framework under the Gaming Act 2018 and Gaming Licence Fees Regulations splits activity into Type 1 (casino and RNG), Type 2 (fixed-odds betting), Type 3 (peer-to-peer, exchange, and bingo), and Type 4 (controlled-skill games). Application is €5,000 per licence; annual licence fee is €25,000 (Types 1–3) or €10,000 (solely Type 4); annual compliance contribution ranges from minimum €5,000–€25,000 to maximum €375,000–€600,000 across the four types, depending on type and gross gaming revenue band.^[8] The 12-month start-up exemption from compliance contribution is available to qualifying start-ups.

Gibraltar’s Gambling Act 2025 (commenced 1 April 2026 under LN.2026/064; sections 55–77 on regulated functions and regulated individuals remain excluded pending a separate commencement notice) replaced the 2005 Act with six licence categories: B2C Bookmaker, B2C Gaming, B2C Betting Intermediary, B2B, Gambling Operator Support Services, and Personal or Key-Person licences.

Under the Gambling (Duties and Licence Fees) Regulations 2026, a new B2C betting or gaming operator pays a £30,000 application fee, and annual fees run £50,000, £100,000, or £200,000 per licence by annual gross yield, so an operator holding both a betting and a gaming licence pays each. A betting intermediary pays £15,000 to apply and £100,000 a year. General betting and gaming duty is 0.15% of gross profit with the first £100,000 exempt; intermediary duty has no exemption.

Cyprus NBA Class B under Betting Law 37(I)/2019 authorises online sports-event betting only; online casino, slots, poker, exchange betting, and lotteries remain prohibited.^[10] Capital is €500,000 paid-up plus a €550,000 bank guarantee. Kahnawake’s Client Provider Authorisation under the Regulations Concerning Interactive Gaming 1999 (last amended December 2024) costs USD 35,000 to apply, including the first year’s annual fee (USD 40,000 for complete applications filed from 1 January 2027), then USD 20,000 a year,^[21] with a 6-month provisional period before the full 5-year CPA grants.

The forex cluster. Cyprus’s CIF licence under Law 87(I)/2017 is the dominant EU-passporting route for retail FX and CFD operators. Initial-capital tiers under Article 9 of the Investment Firms Directive are:^[15][25]

• €75,000 paid-up (no client money or securities handling).
• €150,000 (other investment services, such as execution or reception and transmission where client money or securities are held).
• €750,000 (dealing on own account and market-making).

ESMA’s product-intervention regime, codified in CySEC Directive DI-87-09, caps retail leverage at:

• 30:1 on FX majors.
• 20:1 on non-majors and major indices (5% gold margin).
• 10:1 on commodities and non-major indices.
• 5:1 on equities.
• 2:1 on cryptoassets.

The 5 September 2025 amendment imposed a 10% initial-margin floor on commodity or stock-index CFDs not expressly listed.^[5] Negative-balance protection is mandatory; the 50% margin close-out rule applies; monetary inducements are banned. MiCA Article 60 permits the CIF to provide equivalent crypto-asset services through notification, without a separate CASP authorisation.

ADGM FSRA Category 3A licences retail-or-institutional forex dealing as matched principal at USD 500,000 base capital, rising to USD 2,000,000 for retail OTC-derivatives dealing as matched principal; Category 4 (arranging and advising) is USD 50,000.^[11] DFSA Category 3A is USD 200,000 and matched-principal dealing sits in Category 2 at USD 500,000; Category 4 is USD 30,000 under CP161 (from 1 July 2025), rising via the Activity-Based Capital Requirements introduced in July 2026.^[12]

Bahamas SCB broker-dealer capital figures, originating in Regulation 55 of the Securities Industry Regulations 2000 and preserved by Regulation 149 of the 2012 Regulations pending other prescribed requirements, are:

• Class I: USD 300,000.
• Class II: USD 120,000.
• Class III: USD 60,000.
• Class IV: USD 25,000.

SIA 2024 itself reorganises registration around functional categories (Dealing, Managing, Advising, Arranging) rather than numbered classes.^[13] The CFD overlay under the Securities Industry (Contracts for Differences) Rules 2020, repriced by the Securities Industry (Fees) Rules 2024 (S.I. No. 107 of 2024, gazetted 23 December 2024), adds USD 5,000 application, USD 20,000 registration, and USD 45,000 annual renewal, plus a quarterly activity fee per Commission policy.

Labuan’s Money Broking Licence (Conventional) under section 90 LFSSA 2010 (amended by Act A1654 of 2022) requires RM 1,000,000 paid-up unimpaired by losses (revised upward from RM 500,000 under LFSA Guidelines effective 9 September 2024), rising to RM 1,500,000 for digital-asset variants.^[14]

Jagelski & Partners’ licensing partners are engaged by governments to draft national crypto and virtual-asset frameworks, and bring 17+ years of regulatory advisory experience across fintech and virtual-asset markets to high-risk licensing. In our experience, applications fail most often on the governance file rather than the technology file. A money-laundering reporting officer who cannot articulate the operator’s risk appetite in the regulator’s vocabulary, or a board composition that does not survive fit-and-proper scrutiny, costs more time than any single technical gap. See the crypto licensing hub for the consolidated crypto-asset framework that overlays many high-risk operations.

Banking

Banking is the binding constraint on most high-risk launches, not licensing. A correctly licensed gambling or forex operator with no operational banking is dark from day one, and operators that secure only one banking provider have one point of failure that closes the business when the provider exits. The structural answer is redundancy: two Electronic Money Institutions minimum, one card acquirer, one alternative-rails channel (Open Banking or stablecoin off-ramp), and chargeback-management tooling deployed before card processing goes live.

Why mainstream banks decline high-risk operators is structural, not personal. The European Banking Authority’s Opinion on de-risking (EBA/Op/2022/01, 5 January 2022) recorded that de-risking affects “payment institutions and electronic money institutions” themselves, with credit institutions terminating payment-institution and EMI accounts because of perceived AML risk; the EBA recorded that de-risking of entire categories of customers, without due consideration of individual customers’ risk profiles, can be unwarranted and a sign of ineffective ML/TF risk management.^[4] The follow-up Guidelines (EBA/GL/2023/04, 31 March 2023) require risk-based rather than category-based decisions.

Practical effect on a 2026 high-risk operator: the EMI archetype, not the traditional-bank archetype, is the realistic primary banking route, with traditional-bank correspondent relationships reserved for the licensed operator’s treasury layer.

The EMI archetype is well suited to the high-risk operator’s deposit-and-payout volume because the Electronic Money Directive 2 (Directive 2009/110/EC) creates a regulatory category authorised to issue dedicated IBANs, run SEPA and SEPA Instant flows, hold safeguarded client funds (note: not deposit-protected), and operate modern KYC and AML tooling that scales with transaction count.

Onboarding for a licensed or licensable high-risk operator is typically 2 to 6 weeks once the file is complete. The traditional-bank archetype is better suited to the treasury layer, with broader correspondent reach for FX, settlement, payroll, and vendor payments; onboarding runs 8 to 16 weeks when achievable.

IBAN discrimination is the recurring operational problem. SEPA Regulation Article 9(2) (Regulation (EU) 260/2012) provides that a payee accepting a credit transfer or using a direct debit to collect funds from a payer holding a payment account located within the Union shall not specify the Member State in which that payment account is to be located. The Court of Justice confirmed in C-28/18 VKI v Deutsche Bahn (5 September 2019) that residency-conditioned acceptance breaches Article 9(2).

On 2 April 2026, the Italian Antitrust Authority fined a Lithuania-licensed pan-EU neobank group €11.5 million, with a €1.5 million element specifically for failing to provide clear and exhaustive information on the requirements and timeframe for obtaining an Italian IBAN (starting with IT) instead of a Lithuanian IBAN (starting with LT), in breach of articles 20, 21 and 22 of the Consumer Code.^[16]

Despite the law, refusals persist: of the 4,688 complaints Accept My IBAN received from 2021 to the end of March 2025, 24% concerned Lithuanian, 23% Belgian and 22% German IBANs, a count of reports rather than a refusal rate.^[23] In our experience, operators with a substantive German or Dutch customer base should still plan for at least one German or Dutch IBAN inside the banking stack.

Through Jagelski & Partners’ partner network, businesses placed more than fourteen billion euros in client turnover across banking and EMI relationships in 2025. Placement runs as pre-qualification across 90+ banking and payment institutions rather than sequential applications: the firm’s analysts assess the client profile against the live appetite of the partner network, surface the credible matches by archetype, then introduce an independent specialist to coordinate the placements.

For high-risk operators, the matchable archetypes split into specialist high-risk EMIs with elevated reserve and pricing, regulated payments institutions in growth jurisdictions (notably the UAE) with lower-friction onboarding for licensed operators, and traditional banks with established crypto and gambling appetite typically requiring a regulated counterparty plus a minimum AUM commitment.

Jagelski & Partners is paid by the institution, not by the client. We do not mark up institutional banking or EMI pricing, and we do not charge an onboarding fee. The pricing on the client’s account-opening documentation is the institutional rate.

Card acquiring runs in parallel. Specialist high-risk acquirers price at 4.5%–8% all-in with rolling reserves of 10%–20% held for 90 to 180 days; setup fees are typically €5,000–€10,000. Chargeback-management tooling (real-time dispute resolution, alerts, and compelling-evidence packages) is now operational standard: the VAMP ratio excludes disputes resolved through pre-dispute solutions and fraud reports that qualify for Compelling Evidence 3.0, in both cases subject to the timing of Visa’s data extract, so deploying these tools materially affects whether the merchant breaches the 1.5% Excessive threshold (live in the EU, US, Canada, and Asia-Pacific from 1 April 2026; 1.5% in LAC; 2.2% in CEMEA, under the acquirer-status conditions below).^[1] These Visa merchant thresholds apply where the acquirer is neither Above Standard nor Excessive; Visa’s public fact sheet excludes Brazil, Chile, and India; their programmes are announced separately. Monthly floors are 1,500 fraud-and-dispute events, or in CEMEA at least 150 events and USD 75,000.

Mastercard’s ECP fee escalation reaches USD 100,000 per month from month 19 of continuous breach.^[2] Experienced operators size the rolling-reserve impact on cash flow before signing the merchant agreement: a 15% reserve held 180 days on a €3 million monthly card book locks up €2.7 million of working capital at steady state, which is the operational figure that determines whether the acquirer pricing is acceptable, not the headline processing rate.

Ongoing Compliance

Ongoing compliance is a permanent operating cost, not a one-time licensing event. For a high-risk operator in 2026 the compliance perimeter runs across AML and CFT obligations under the new EU Anti-Money Laundering Package, activity-specific overlays (Online Safety for adult, MiCA Travel Rule for crypto, ESMA conduct for forex, Responsible Gambling for gaming), card-scheme programme management (VAMP, ECP, VIRP, BRAM), and ongoing prudential and supervisory reporting cycles.

Regulation (EU) 2024/1624 (AMLR) applies generally from 10 July 2027. Article 90 defers the Article 3(3)(n) and (o) categories to 10 July 2029. The 2029 exception covers football agents and the specified professional-football-club transactions, not crypto sectors. The beneficial-ownership threshold becomes “25% or more”, with provision for lower thresholds in specified higher-risk categories. The Directive component, Directive (EU) 2024/1640 (AMLD6), restructures the Member States’ institutional framework.^[20]

Twenty-three AMLA Level-2 and Level-3 measures were due by 10 July 2026, which makes 2026 the year operators must complete gap-assessment work rather than wait for the regime’s headline application date.

The EU Travel Rule (Regulation (EU) 2023/1113) has applied since 30 December 2024: CASPs and obliged entities must collect originator and beneficiary data on every crypto-asset transfer, with no de-minimis threshold; transfers above €1,000 to or from a self-hosted wallet additionally trigger wallet-ownership verification. Operators running crypto OTC desks or stablecoin off-ramps as part of a high-risk business stack are inside this perimeter.

For UK-facing adult platforms, the HEAA duties that OFCOM enforces under the Online Safety Act 2023 took effect on 17 January 2025 for services that publish their own pornographic content (Part 5) and on 25 July 2025 for Part 3 services, such as user-to-user platforms that allow pornography. Approved methods include Open Banking, photo-identification matching, facial age estimation, credit-card check, digital identity services, mobile-network-operator authentication, and email-based estimation; self-declaration is explicitly insufficient. Maximum penalty under the Online Safety Act 2023 (Qualifying Worldwide Revenue) Regulations 2025 (in force 8 October 2025) is £18 million or 10% of qualifying worldwide revenue, plus business-disruption orders.^[17]

OFCOM’s enforcement under the Act includes a £1.35 million penalty on 8579 LLC (23 February 2026) for failing to implement age assurance, plus £50,000 for failing to respond to a statutory information request.

Gambling operators carry their own ongoing compliance burden: AML and CFT programmes calibrated to the licensing jurisdiction’s expectations (Malta MGA, Curaçao CGA, Gibraltar GC, Cyprus NBA), responsible-gambling tooling, source-of-funds checks where enhanced due diligence is triggered, on top of transaction-based customer due diligence (in the UK, for example, casinos must apply customer due diligence to transactions of £2,000 or more under regulation 27(5) of the Money Laundering Regulations 2017^[22]), and ongoing system and compliance audits.

Forex operators carry MiFID II conduct overlays (best execution, suitability, and appropriateness, inducement rules), CySEC quarterly returns and audited financials, ESMA reporting, DORA ICT risk management since 17 January 2025, and AMLA-readiness from 2026 onwards.

Frame compliance as a recurring fraction of revenue, not a project line. For a mid-sized high-risk operator (gambling or forex), a planning estimate for the annual cost, quoted per case, is €150,000–€600,000 across the money-laundering reporting officer and compliance team, transaction monitoring, AML, and KYC tooling, card-scheme programme management, audit, and regulatory levies.

Budget for ongoing compliance as well as initial authorisation. Regulator requests, card-scheme remediation or enforcement can create additional work and costs.

Realistic Timeline and Costs

The realistic end-to-end timeline from formation to operational launch is 5 to 12 months for an offshore gambling build (Curaçao under LOK), 6 to 14 months for a Malta or Gibraltar gambling build, and 6 to 15 months for a regulated forex build (Cyprus CIF, ADGM, or DFSA). The priced phases run €27,000 to €155,000 in professional fees, and complex mandates have reached €250,000 once pre-launch readiness is added, depending on jurisdiction mix, business model complexity, and the parent-company structure. Capital, banking float, and ongoing operating expenditure sit outside that figure.

End-to-End Timeline and Cost Range

What compresses the envelope: pre-qualified banking before capital is locked, pre-drafted compliance documentation (AML/CFT manual, governance policies, MLRO appointment, responsible-gambling policy for gaming or best-execution policy for forex), a clean fit-and-proper file for directors and substantial shareholders, and a chosen regulator with a published throughput record.

What expands it: regulator workload (the Curaçao CGA’s licensing and supervision caseload; CySEC’s MiCA and CIF workload), banking sequenced after licensing rather than in parallel, a parent-company structure the regulator decides to assess for indirect substance, and an MLRO appointed late.

The realistic envelope expands when banking is treated as a downstream task and contracts when it runs in parallel with capital deposit and file drafting. In our experience, operators that start the banking conversation early enough to surface the institutions’ appetite before the licence file is filed shorten the path to live trading by six to ten weeks, because the regulator’s banking question is answered when the file is read, not after.

Frequently Asked Questions

References