De-risking – the decision by a bank or electronic money institution (EMI, a regulated payments provider that issues e-money and holds client funds on behalf of customers) to refuse or terminate a business relationship – is the single fastest route from operating crypto company to stranded fiat operation. For an early-stage founder, a closed account is not an inconvenience. It is an existential event: payroll stops, customer withdrawals stall, investor wires bounce. The legal and structural causes of de-risking are well-documented, and the remedies are available – but they require action before the termination notice arrives, not after.
This page sets out how OBOLUS approaches account closure defence and de-risking mitigation for early-stage digital-asset businesses: the regulated basis for a bank's right to exit, the structural errors that trigger it, and the cross-border considerations that determine where fiat rails can realistically be anchored.
Why Banks and EMIs Exit Crypto Business Relationships
De-risking is a commercial decision driven by regulatory cost, not a finding of wrongdoing. A bank or EMI that holds accounts for a VASP (virtual asset service provider) faces heightened scrutiny under anti-money-laundering regimes in every major jurisdiction – from the Financial Action Task Force (FATF) Recommendations, which classify VASPs as obligated entities requiring enhanced due-diligence treatment by their correspondent institutions, to the Money Laundering Regulations enforced by the FCA in the United Kingdom and equivalent regimes across the EU under the applicable directives. The compliance cost of a crypto client frequently exceeds the revenue that client generates, particularly at the early stage when transaction volumes are low but the document burden is high.
The calculation is not always irrational from the institution's side. A newly incorporated entity, operating with a minimal-viable-product exchange or custody product, generates audit exposure. Without a clear licence, a clear compliance programme and a clean counterparty map, the institution cannot satisfy its own regulators. The FATF framework explicitly requires financial institutions to apply risk-based due diligence to VASP customers. When the VASP cannot demonstrate its own AML posture – its travel-rule compliance, its transaction-monitoring vendor, its sanctions screening – the institution's default response is exit.
In our practice, the most common immediate triggers for account closure are three: an undisclosed change of business activity (the account was opened for a software company and is now processing crypto exchange flows), transaction monitoring hits that the client cannot explain in writing within the institution's internal SLA, and a regulatory action – even in a different jurisdiction – that the institution reads as sector-wide reputational risk.
Bridge: The standard account-opening path works for the founders who have already mapped their regulatory position. If you are still working out where the entity sits, what licence it needs, and how the compliance architecture connects to the banking relationship, that analysis needs to happen first.
For a scoped assessment of your entity's banking risk before you receive a closure notice, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. Map your options
What Is the Legal Basis for a Bank's Right to Exit?
A financial institution's contractual right to terminate a payment account or EMI relationship without stated cause is almost always present in the master agreement – typically on notice of between 30 and 90 days, and sometimes immediately where the institution identifies a material compliance concern. That contractual right does not mean the exit is unreviewable. Several structural challenges are available, depending on jurisdiction, and counsel's job is to assess them quickly.
In the United Kingdom, the Payment Services Regulations impose an obligation on payment service providers to deal with customer complaints within defined timescales, and the Financial Ombudsman Service provides a remedy route for eligible complainants. The FCA's approach to de-risking of legitimate crypto businesses has been publicly noted as a supervisory concern – though the FCA's remit over individual account decisions is limited. Under the EU Payment Services Directive regime, similar baseline protections apply in member states, and under MiCA (the Markets in Crypto-Assets Regulation, the EU's direct regulatory framework for crypto-asset service providers), a CASP authorised in one member state carries passporting rights that a compliant banking partner in that state is expected to recognise. This does not guarantee a banking relationship, but it changes the risk calculus for the institution.
In the UAE, VARA-licensed entities in Dubai and FSRA-regulated entities in the Abu Dhabi Global Market (ADGM) benefit from operating inside recognised regulatory perimeters. UAE domestic banks and EMIs are increasingly familiar with VARA and FSRA authorisation as a credible compliance signal. That does not eliminate de-risking risk; it reduces it materially when the structure is correctly presented.
The practical lesson: a licence from a recognised regulator – MiCA/ESMA, VARA, MAS, the FCA, the SFC – does not guarantee banking access, but it provides a foundation on which the legal argument for continued service can be built. Without it, the institution has no obligation to stay.
What Structural Errors Put a Crypto Founder's Banking at Risk?
The structural errors that expose an early-stage founder to de-risking are predictable, and most are avoidable if the entity design precedes the account application. We see four recurring patterns.
First, entity-activity mismatch. The holding company or operating entity is incorporated in a jurisdiction that does not align with the activity it is conducting. A BVI entity – regulated under the BVI FSC's VASP Act 2022 – running a European customer-facing exchange creates immediate MiCA exposure and is an obvious de-risking target, because the institution cannot map the entity to a recognised local regime. The VASP Act 2022 in the BVI provides a registration framework, but it does not substitute for an EU CASP authorisation when the customers are European.
Second, AML programme opacity. Institutions apply enhanced customer due diligence to VASPs. When the VASP's own AML manual, transaction-monitoring system and sanctions-screening vendor cannot be described clearly in a single document pack, the institution's compliance team cannot close its risk assessment. The account stays on a watch list and exits on the next review cycle.
Third, the travel-rule gap. The Travel Rule – the obligation to pass originator and beneficiary identification data with a virtual-asset transfer – is now active in the EU under MiCA, in Singapore under the MAS Payment Services Act regime, in the UK under FCA rules and in many other jurisdictions. An early-stage VASP that cannot demonstrate travel-rule compliance is structurally non-compliant in multiple major markets. Banks and EMIs treating that VASP as a customer face their own supervisory exposure if they facilitate transfers that breach the Travel Rule.
Fourth, undisclosed jurisdictional creep. The business began serving one geographic market and expanded, without updating the compliance programme or the account documentation, to serve customers in jurisdictions where it has no licence. This is the scenario that most reliably triggers a Suspicious Activity Report from the institution and a subsequent account freeze, rather than a clean termination.
How Does Account Closure Defence Work in Practice?
Account closure defence is time-compressed legal and compliance work. The typical sequence moves from the receipt of a notice (or the detection of a freeze) to a formal response within days, not weeks, and the legal strategy runs in parallel with a structural remediation that addresses the root cause.
The immediate steps are: obtain and document the notice in its exact form; identify whether it is a contractual termination, a freeze pending investigation, or a regulatory direction to the institution; and assess whether any internal escalation or complaints process is available and worth using. In our practice, we have seen institutions reverse a termination notice when the VASP was able to demonstrate, within the institution's own review window, that the triggering concern was resolved – a completed KYC file, an updated AML policy, a clarified structure chart.
Where the notice cannot be reversed, the parallel work is rebanking: identifying an alternative EMI or bank, in a jurisdiction where the entity's licence and structure will be recognised, and preparing the onboarding pack to that institution's standards before the current account closes. This is a document-intensive process. A well-prepared founder can move to a new banking relationship within weeks; an unprepared one faces months of disruption.
A micro-matter illustrates the point. In a recent matter, a payments technology company had its primary EMI account suspended mid-quarter following a transaction-monitoring alert on a single high-value transfer. The institution had not issued a termination notice but had frozen outgoing payments unilaterally. We mapped the transaction against the company's customer KYC file and AML policy, prepared a structured response to the institution's compliance team, and simultaneously identified two alternative EMI providers with a track record of onboarding regulated VASPs in the same jurisdiction. The suspension was lifted within two weeks, and the company entered the parallel onboarding process as a risk-mitigation measure. No guarantees were made about outcome; the work was structural and documented.
If an account has been frozen or a closure notice has arrived, reach our banking desk now at info@oboluslaw.com. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back. Map your options
Why Does the Cross-Border Structure Determine Banking Access?
For a digital-asset business, the entity jurisdiction, the banking jurisdiction, the user jurisdiction and the licence jurisdiction are frequently four different places. Each of those misalignments is a potential de-risking trigger. Managing them requires an integrated structural view, not a single offshore licence.
The most common structural mistake we see in early-stage founders is the assumption that a single licence – typically an offshore or lightly regulated jurisdiction registration – provides sufficient cover for a global user base. It does not. A Cayman Islands or BVI VASP registration provides a regulated baseline in those jurisdictions. It does not extend to the EU, the UK, Singapore, Hong Kong or the US. Serving customers in those markets without the applicable local authorisation – MiCA CASP for the EU, FCA registration for the UK, MAS DPT licensing for Singapore, SFC VATP licensing for Hong Kong – creates enforcement risk in each market and is a categorical de-risking trigger for any institution that identifies the geographic mismatch.
The cross-border banking reality is equally fragmented. An EU-authorised CASP operating under MiCA and passporting across the EU/EEA is more bankable in European EMIs than an entity with equivalent economic activity but no EU nexus. A VARA-licensed entity in Dubai is more bankable in UAE-based institutions that operate within VARA's perimeter. A MAS-licensed DPT service provider in Singapore has access to a banking environment that has developed VASP-specific onboarding procedures. The licence is not a guarantee of banking; it is the threshold below which banking is unavailable from any reputable institution.
For a founder building across jurisdictions, the structural question is which licence to obtain first, where to domicile the operating entity, and how to sequence the banking approach to match. We map that stack – operating licence, custody licence, payment or EMI licence, and banking relationship – before the client commits capital to any single jurisdiction.
What Are the Most Common Mistakes That Accelerate De-risking?
A common assumption in the early-stage digital-asset market is that de-risking is an arbitrary or discriminatory banking practice that cannot be mitigated through legal or structural means. That assumption is incorrect, and acting on it – by passively accepting account closure and attempting to rebank without addressing the root cause – reproduces the same outcome at the next institution.
The mistakes that accelerate de-risking follow a recognisable pattern. Founders apply for a business account before the compliance programme is documented. They open accounts in a jurisdiction without a licence in that jurisdiction. They allow transaction patterns to develop that diverge from the account's stated purpose without updating the institution. They respond to information requests from the institution's compliance team late, or incompletely, or through a channel that does not create a documented record.
Each of these errors is correctable. The correction requires a disciplined approach to the institution relationship: treating it as a regulated counterparty that has its own AML and supervisory obligations, not as a service provider. The legal work in de-risking defence is largely documentation work – structuring the business's compliance architecture so that it can be presented to an institution's risk committee in a format the committee can approve.
The second category of mistake is timing. Once a Suspicious Activity Report has been filed by the institution – which the institution is prohibited from disclosing to the account holder under tipping-off provisions in most jurisdictions – the available legal responses narrow sharply. Acting on the first signal of discomfort, rather than waiting for the termination notice, is consistently the more effective approach.
Which Banking Path Fits Which Founder Profile?
The right banking structure depends on the entity's licence position, its user geography, and the stage of its compliance programme. The following profiles capture the most common early-stage situations we advise on.
Profile A – Pre-licence, EU-targeted product. The entity is building a product for European retail or institutional users. It has not yet obtained a MiCA CASP authorisation. The appropriate path is to apply for CASP authorisation – either in a member state with an efficient licensing process or through a jurisdiction where the founder already has operational infrastructure – before approaching any EMI or bank for a primary account. EMI onboarding at this stage should be targeted at payment-focused EMIs in the same member state as the intended CASP licence, to minimise the jurisdictional gap. Timeline for this path is measured in months from application to licence, with banking onboarding running in parallel from the point of licence application confirmation.
Profile B – Licenced VASP, single jurisdiction, expanding user base. The entity holds a VASP registration or light-touch licence – BVI, Cayman or similar – and is beginning to attract users in regulated markets. The immediate risk is jurisdictional creep triggering de-risking at the current institution. The appropriate path is a geographic user-restriction policy that is enforced at the technical and compliance level, combined with a licence-sequencing plan that maps the next regulated market entry against the banking relationship. Where the expansion market is the EU or UK, a secondary operating entity in that market – with its own banking relationship – is typically the cleaner structure.
Profile C – Post-closure, seeking rebanking. The entity has received a termination notice or has had its account frozen. The immediate work is the root-cause analysis described above, followed by a remediation pack prepared to the standard of the target EMI's onboarding requirements. The rebanking process typically involves approaching multiple EMIs in parallel, with a structured disclosure document that addresses the closure proactively rather than leaving the institution to discover it through its own due diligence. Founders who disclose and explain a prior closure generally fare better than those who omit it – institutions run checks, and an unexplained prior closure is a more significant red flag than a disclosed and remediated one.
Self-Assessment: Is Your Banking Structure Defensible?
Before approaching a bank or EMI – or before a review cycle at the current institution – a founder should be able to answer the following questions with documented evidence.
Does the entity hold the applicable licence or registration for each jurisdiction in which it operates? Can the entity describe its AML programme – including its transaction-monitoring system, its sanctions-screening vendor, and its Travel Rule compliance mechanism – in a single document? Is the entity's corporate structure transparent, with beneficial ownership traceable and documented? Are the entities' permitted activities under its licence consistent with its actual transaction flows? Has the entity updated the institution on any material change in its business model, ownership or geographic scope since account opening?
If any of these questions cannot be answered with a yes supported by documentation, the banking relationship is vulnerable. The appropriate response is remediation before the next review cycle, not reactive defence after the fact.
We map the licence stack across operating, custody and payment layers before you commit – and we review the compliance architecture that the banking relationship will depend on. This is the work that shifts a founder from a high-risk institution relationship to a manageable one.
Related at OBOLUS
- Banking and EMI onboarding for digital-asset businesses – Full practice overview: fiat rails, account strategy and EMI selection across jurisdictions.
- Payment institution licensing for regulated entities – How to obtain and structure a payment licence that supports banking access.
- De-risking and account closure defence – legal counsel for digital-asset businesses – Specialist counsel for established digital-asset businesses facing institutional exit.
FAQ
Why do banks close crypto company accounts?
Banks and EMIs close crypto company accounts primarily because the compliance cost of maintaining the relationship exceeds the revenue it generates. VASPs require enhanced due diligence under FATF Recommendations and equivalent national AML regimes. When a VASP cannot clearly demonstrate its own AML programme, Travel Rule compliance, sanctions screening and licence status, the institution cannot satisfy its own regulators and its default response is exit. Undisclosed changes in business activity and transaction-monitoring alerts are the most common immediate triggers.
How can a VASP onboard with an EMI?
A VASP can onboard with an EMI by presenting a structured compliance package that addresses the EMI's enhanced due-diligence requirements: a current AML policy, a transaction-monitoring and sanctions-screening framework, a transparent corporate structure with documented beneficial ownership, and evidence of the applicable regulatory licence or registration. VASPs with a recognised authorisation – under MiCA, VARA, MAS or FCA registration – are materially more bankable than unregistered entities. Approaching the EMI in the same jurisdiction as the VASP licence reduces the compliance gap for the institution.
What does client-money safeguarding require?
Client-money safeguarding requires that funds held on behalf of customers are segregated from the firm's own funds and held in a designated safeguarding account or covered by an insurance or guarantee arrangement, in accordance with the applicable payments or e-money regime. Under MiCA and equivalent EU payment services rules, and under the FCA's payment services regime in the UK, the safeguarding obligation is a licensing condition. Failure to meet it is both a regulatory breach and a de-risking trigger for the institution holding the safeguarding account.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence, banking and compliance stack across operating, custody and payment layers before you commit capital to any single structure. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums. To discuss your situation, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst – specialising in VASP licensing, AML programme design and banking-access strategy for early-stage digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.