Every early-stage digital-asset founder eventually faces the same collision: the company is incorporated, the tech is live, the first customers are waiting – and the bank account application is rejected before onboarding even begins. Without fiat rails (the banking and payment infrastructure that converts crypto value into spendable money), a crypto business cannot pay staff, settle counterparties or receive client funds. That is not a compliance technicality. It is an existential operating risk. This page explains why the problem arises, how the process actually works, and what a structured legal approach changes.
Corporate bank account opening for early-stage founders in the digital-asset sector is a multi-layered legal and commercial problem. The answer sits at the intersection of corporate bank account opening, EMI onboarding (access to a licensed electronic money institution), and the regulatory profile that a bank or payment institution sees when it reviews the business. Getting that profile right – before submitting any application – is the single most impactful step a founder can take.
Why does banking fail for early-stage crypto companies?
Banks decline crypto businesses primarily because the compliance cost of onboarding one exceeds the revenue it generates at the early stage. This is a documented industry posture, not a rumour. The Financial Action Task Force (FATF) Recommendation 15 requires financial institutions to treat virtual asset service providers as obliged entities carrying heightened money-laundering risk. Every bank that reads that guidance knows that a crypto client brings extra due diligence, extra transaction monitoring and extra regulatory scrutiny. For a startup generating modest volume, that equation rarely favours approval.
The compliance team at a correspondent bank applies the same calculus one tier up. If the bank's correspondent network is US-dollar denominated, the correspondent will apply FinCEN, OFAC and Bank Secrecy Act standards to every institution that routes through it. A small crypto company with a thin compliance programme is a liability the correspondent bank is not paid to carry. The application dies before it reaches a relationship manager.
In our practice, we see three patterns that account for the majority of early-stage rejections. First, the corporate structure is ambiguous – the operating entity, the token-holding entity and the IP entity are not clearly separated, so the bank cannot identify what it is actually onboarding. Second, the regulatory status is incomplete – the company has incorporated in a favourable jurisdiction but has not yet registered or licensed under the local VASP (virtual asset service provider) regime, leaving the bank with an unregulated counterparty. Third, the business model narrative is weak – the founder submits a pitch deck rather than a compliance-grade description of product, users and transaction flows.
Operating without the right licence risks enforcement, frozen rails and lost banking. That risk is not theoretical at the early stage. Several regulators in leading hubs have issued warnings or orders against businesses that continued to accept client funds before their registration was complete. Banking de-risking at that point is not the worst outcome – regulatory enforcement is.
If your first banking application was rejected or your account was recently closed, that event creates a disclosure obligation with the next institution you approach. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis.
For a scoped assessment of your banking and regulatory profile, contact OBOLUS at info@oboluslaw.com before you approach another institution.
What regulatory profile does a bank actually assess?
A bank's financial crime compliance team builds a risk profile from four sources: the corporate structure, the regulatory status of the entity, the AML/KYC programme documentation, and the expected transaction profile. All four must be coherent and credible before the relationship proceeds to pricing or account terms.
Corporate structure. The bank wants a clean, documented ownership chain from the ultimate beneficial owner (UBO) to the operating entity. For a digital-asset business, this usually means a licensed or registered operating company – typically in a jurisdiction with a recognised VASP or payment regime – with subsidiary or holding entities documented and explained. Jurisdictions commonly used at the early stage include Lithuania under the Bank of Lithuania's VASP regime (transitioning to MiCA CASP authorisation), the BVI under the VASP Act 2022, and Malta under the MFSA's VFA framework, now transitioning to MiCA. The choice among these turns on where the users are, where banking partners are available, and what the regulator in the user-base jurisdiction expects to see.
Regulatory status. Banks consistently distinguish between a company that is merely incorporated and one that has completed registration or licensing. A registered entity under the Bank of Lithuania, the BVI FSC or the MFSA is a regulated counterparty. An unregistered entity in the same jurisdiction is not. That distinction drives the difference between approval and rejection in a large share of the cases we review.
AML/KYC programme. The bank will expect a written AML policy, a designated Money Laundering Reporting Officer (MLRO), a customer due-diligence procedure, and a transaction monitoring approach that fits the volume and risk profile of the business. For an early-stage company, this does not need to be a 200-page manual. It needs to be coherent, proportionate, and signed by someone with authority.
Transaction profile. The single clearest predictor of a failed application is a mismatch between the declared business model and the expected transaction flows. A business that says it is a software platform but describes high-frequency crypto-fiat conversions for retail clients will generate a compliance escalation. The profile must be consistent across every document the bank receives.
How does EMI onboarding give a crypto business access to fiat rails?
EMI onboarding – the process by which a crypto business establishes a relationship with a licensed electronic money institution – is frequently the most practical route to fiat rails at the early stage, precisely because licensed EMIs are designed to serve regulated and semi-regulated businesses that traditional banks decline.
An electronic money institution holds an authorisation under a relevant payments regime (in the EU/EEA, the relevant framework is the E-Money Directive and now its successor; in the UK, the FCA's EMI authorisation). The EMI issues electronic money against received funds and provides payment accounts, IBAN issuance and SEPA or SWIFT access. For a VASP, this means a functioning bank-like account without the full correspondent-bank relationship.
The compliance logic from the EMI's perspective mirrors the bank's: the EMI is itself regulated and must satisfy its own AML/CFT obligations. A VASP seeking EMI onboarding must therefore present the same quality of documentation it would bring to a bank. The difference is appetite. Many EMIs have built specific onboarding processes for regulated crypto businesses, understanding the transaction flows and calibrating their monitoring accordingly.
In our cross-border practice, we advise clients to treat the EMI relationship as a bridge – not a permanent substitute for a bank – while they build the volume and compliance track record that a tier-one bank will require at the growth stage. That sequencing is intentional. A six-month clean compliance record at an EMI, with documented transaction reporting and no suspicious-activity flags, is a material asset when approaching a bank.
The cross-border interaction matters here. An EMI authorised under MiCA in Lithuania can, under the passporting rules, serve clients across the EU/EEA. A VASP incorporated in the BVI but serving EU users will want a European EMI relationship specifically to handle euro-denominated flows. A business serving users in the DIFC or ADGM free zones may seek an EMI or banking relationship through a UAE-licensed institution to handle dirham-denominated flows. The entity structure and the EMI choice must be aligned from the start.
What are the most common mistakes early-stage founders make in the banking process?
The most costly mistake is submitting a banking or EMI application before the regulatory profile is clean. An application that generates a suspicious-activity report or a compliance escalation creates a negative record that follows the business. Some institutions share that information within their compliance networks.
The second most common mistake is structuring the entity for tax efficiency first and banking access second. A zero-tax jurisdiction with no recognised VASP regime may save a small amount of corporate tax in year one. It will cost the business its banking relationships and, frequently, its operating capacity. In our experience, the founders who make this trade-off always regret it. Tax efficiency should follow a structure built for banking, not precede it.
A third pattern is the use of a single offshore entity to serve a geographically diverse user base. A common assumption in the early-stage crypto community is that a single offshore licence is enough to serve clients globally. It is not. Regulators in the EU, the UK, the UAE and Singapore each have their own perimeter rules. A business serving EU retail users must be prepared to demonstrate that it either holds a MiCA CASP authorisation or is within a transitional period. A business serving UAE residents is within VARA's reach if it is active in Dubai, or the FSRA's reach if it operates within ADGM. Banking and EMI partners in those jurisdictions will ask the same question the regulator would.
Fourth – and frequently overlooked – is the failure to plan for client-money safeguarding (the regulatory obligation to hold client funds separately from operating capital, typically in a designated account at a credit institution or in qualifying money-market instruments). EMIs that onboard VASPs will expect to see a safeguarding account structure before they process client-facing flows. Setting that structure up after the EMI relationship is established adds delay and re-work.
Which banking approach fits which operator profile?
Early-stage digital-asset businesses are not a homogeneous group. The right banking and EMI approach depends on the regulatory profile, the user geography and the transaction structure.
Profile A – Token issuer at formation stage. The company has incorporated, the token is not yet issued, and there is no user-facing transaction flow yet. The immediate need is an operational account for salaries, legal fees and infrastructure costs. The right instrument here is typically a business account at an EMI that is comfortable with crypto-adjacent clients, combined with a clean corporate structure and a documented AML policy. The timeline to first account is measured in weeks, not months, if the documentation is complete. The key risk is premature disclosure of the token structure before the issuer has assessed whether the token is a financial instrument under the applicable regime.
Profile B – VASP at early registration stage. The company is applying for registration under a national VASP regime (for example, under the Bank of Lithuania or the BVI VASP Act 2022) and needs banking and payment access during the application period. The right instrument is an EMI relationship established in parallel with the regulatory application. The EMI will onboard the VASP as a regulated-entity-in-process, with enhanced monitoring until the licence is granted. The timeline and the monitoring intensity both depend on the jurisdiction and the EMI's own risk appetite. The key risk is that the EMI's onboarding timeline and the regulator's authorisation timeline do not align, leaving the business in a gap period.
Profile C – Cross-border operator with multi-jurisdiction users. The company already has some user traction, possibly under a legacy or transitional registration, and is now formalising its structure for a MiCA CASP authorisation or a VARA licence. The banking need is more complex: separate accounts for operating capital, client money safeguarding and treasury. The right instrument is a combination of a regulated bank (for safeguarding account purposes, since most EMIs do not themselves qualify as credit institutions for safeguarding) and an EMI for operational flows. The timeline is longer and the documentation burden is higher. The key risk is that the business continues to accept client funds through informal arrangements while the formal structure is being built, creating a regulatory exposure that undermines the authorisation application.
If a prior application stalled, an account was closed, or you are managing a gap between your regulatory status and your banking access, a second read of the structure can surface both the cause and the route forward. Write to OBOLUS at info@oboluslaw.com or message us at t.me/oboluslaw.
How do cross-border regulatory differences affect banking access?
The cross-border dimension of corporate banking for crypto businesses is where the complexity concentrates. A business incorporated in one jurisdiction, regulated in a second and serving users in a third faces banking scrutiny from all three directions simultaneously.
Consider a company incorporated in the BVI, registered under the BVI VASP Act 2022, and serving EU retail users through a platform hosted in Lithuania. The BVI entity may be clean from the FSC's perspective. But the bank or EMI that provides euro-denominated accounts will apply the standards of its own regulator – in this case, the Bank of Lithuania or another EU-based competent authority. Under MiCA, the company serving EU users must hold or be progressing toward a CASP authorisation. Without that EU-level regulatory footing, the EMI is onboarding an entity that appears unregulated from the perspective of the jurisdiction where the users sit. That is a material compliance risk for the EMI, and it will decline the application or add conditions that make the relationship unworkable.
The same dynamic plays out in the UAE. A business serving clients in Dubai is within VARA's perimeter. A business operating within the DIFC or ADGM financial free zones is within the FSRA's perimeter. Banking institutions in the UAE – whether conventional banks or licensed payment service providers – will expect to see the appropriate VARA or FSRA registration before they process client-facing flows. The entity structure must reflect this reality from the start.
In our cross-border practice, we regularly advise clients on building what we call the licence, banking and tax stack together: the regulatory authorisation, the banking and EMI relationship, and the corporate structure are planned simultaneously, not sequentially. When they are planned sequentially, the last step is always harder and more expensive because the first two have already constrained the available options.
Where a business has users in a jurisdiction where OBOLUS does not hold a local admission, we work with allied counsel in the relevant jurisdiction to confirm the local regulatory perimeter before any application is submitted.
How a structured approach changed the outcome: a recent matter
In a recent onboarding matter, a token-issuer client approached us after two successive bank rejections in the same calendar quarter. The company was incorporated in a recognised jurisdiction and held a preliminary registration. But the compliance documentation was incomplete, the UBO chain included an intermediate holding entity with no documented purpose, and the transaction profile described in the business plan was inconsistent with the declared user base. We restructured the corporate narrative, completed the AML policy to a standard consistent with the applicable VASP regime, and identified an EMI with documented appetite for that licence category. The client received its first euro IBAN within weeks of the revised application. The bank relationship followed in the subsequent quarter, anchored by the EMI's clean transaction record.
A common assumption about offshore licensing and global access
A common assumption among early-stage founders is that a single offshore licence – a BVI, Cayman or Marshall Islands registration, for instance – provides sufficient regulatory cover to open banking and serve clients globally. The assumption is understandable. Those jurisdictions offer streamlined registration, low capital requirements and fast timelines. But the assumption is wrong in a specific and important way.
Regulatory coverage is determined by where the users are and where the activity occurs, not only by where the company is incorporated. A BVI-incorporated VASP serving EU retail users is, from the perspective of any EU-based bank or EMI, an unregulated entity offering services in its jurisdiction without the required CASP authorisation. The offshore incorporation is a necessary condition for the business, not a sufficient one for banking access in the jurisdictions where the users sit.
The practical correction is a layered structure: an offshore holding entity for asset protection and tax planning purposes, combined with a regulated operating entity in a jurisdiction with a recognised VASP or payment regime that is accepted by the banking partners the business needs. That structure is more complex to build at the outset. It is significantly less expensive than rebuilding it after the banking rejections have accumulated.
Self-assessment: is your banking application ready?
Before submitting a corporate banking or EMI application, an early-stage founder should be able to answer each of the following affirmatively.
First: the corporate structure is clean, documented and consistent across all application materials, including a complete UBO chain with no unexplained intermediate entities.
Second: the operating entity holds a current registration or licence under the applicable VASP, payment or EMI regime in the jurisdiction where the activity is regulated – or is within a documented transitional period with a confirmed timeline to full authorisation.
Third: a written AML/KYC policy is in place, signed by a named MLRO, and calibrated to the actual risk profile of the user base and the transaction types.
Fourth: the transaction profile described in the application materials is consistent with the business model, the user geography and the regulatory status. There are no material inconsistencies between the pitch deck, the website and the compliance documentation.
Fifth: the client-money safeguarding structure has been considered and a plan for its implementation is ready to present if the bank or EMI asks.
Sixth: the cross-border regulatory picture is clear – the business understands which regulators govern its activity in each user jurisdiction and can document its compliance position in each.
If any of those items is uncertain, the application is not ready. Submitting before they are resolved increases the risk of a rejection that creates a negative record.
Related at OBOLUS
- Banking, Payments & EMI Onboarding practice – full overview of payment infrastructure legal services for digital-asset businesses
- How to respond to a de-risking account closure – step-by-step guide for businesses facing unexpected account termination
- Crypto holding structure in Turkey – jurisdiction analysis covering holding, custody and payment structures in Turkey
FAQ
Why do banks close crypto company accounts?
Banks close crypto company accounts primarily because the AML compliance cost of maintaining the relationship exceeds the commercial return at the existing transaction volume. Under FATF Recommendation 15, banks must treat VASPs as high-risk counterparties requiring enhanced due diligence. When a crypto client's transaction monitoring generates escalations, the compliance overhead increases. If the client's revenue to the bank does not justify that overhead, the bank exits the relationship. The trigger is usually a change in the bank's own regulatory posture, a change in the client's transaction profile, or a compliance escalation that the bank cannot resolve.
How can a VASP onboard with an EMI?
A VASP seeking EMI onboarding must present its regulatory registration or licence, a complete AML/KYC policy, a documented UBO chain, and a transaction profile consistent with the declared business model. Many EMIs have specific onboarding processes for regulated crypto businesses and will conduct enhanced due diligence before approving the account. The timeline from application to account activation varies by EMI and by the completeness of the documentation. The relationship begins with enhanced monitoring and typically normalises as the VASP builds a clean transaction record. Jurisdiction matters: the EMI will apply the standards of its own regulator, not the VASP's home regulator.
What does client-money safeguarding require?
Client-money safeguarding requires that funds received from clients are held separately from the firm's own operating capital. Under most applicable payment and EMI regimes, this means a designated safeguarding account at a recognised credit institution or investment in qualifying liquid assets. The specific requirements – account structure, reporting obligations, timing of segregation – depend on the applicable regime. For early-stage businesses, establishing the safeguarding structure before accepting client funds is both a regulatory obligation and a practical prerequisite for onboarding with most EMIs. Failure to segregate is among the most common grounds for regulatory action against early-stage payment businesses.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit – so that the banking and EMI relationships are built on a structure that the institutions you approach will actually approve. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst – specialises in VASP registration, MiCA CASP authorisation pathways and banking compliance documentation for early-stage digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.