Institutional digital-asset businesses face a specific and damaging failure mode: a compliant exchange or custodian, properly licensed in its home jurisdiction, discovers that its banking partner has terminated the account with thirty days' notice and no stated reason. The fiat rails go dark. Settlement fails. Clients withdraw trust before the next audit. The business that survived a licence application cannot survive a debanking event if it has no alternative. That is the operating reality we manage for clients across more than seventy licensing jurisdictions.
Fiat on/off-ramp banking for institutional digital-asset businesses means securing and maintaining the regulated payment infrastructure that converts between crypto assets and sovereign currency at scale. It sits at the intersection of VASP (virtual asset service provider) licensing, EMI (electronic money institution) onboarding, and traditional correspondent banking – and each layer carries its own compliance burden. This page sets out the legal regime, the practical process, the common points of failure, and how OBOLUS structures the engagement.
We address the on-ramp (client deposits fiat, buys or settles in crypto) and the off-ramp (client sells or redeems crypto, withdraws fiat) as a single banking architecture problem, because banks and EMIs price and gate-keep both directions together.
Why Fiat Rails Are the Hardest Problem in Crypto Infrastructure
A licence does not guarantee a bank account. That sentence summarises years of institutional frustration, and it is the first thing we tell founders and general counsel who contact us after their home regulator has issued an authorisation. Regulators grant licences; commercial banks decide whether to hold the deposits that make those licences operational.
The banking problem is structural. Most commercial banks are regulated under traditional anti-money-laundering regimes that pre-date the FATF Recommendation 15 standards on virtual assets. Their compliance teams apply a blanket elevated-risk classification to digital-asset businesses. The result is that even fully licensed VASPs regularly face account refusals or closures from banks that cannot absorb the audit cost of onboarding a crypto client. In our cross-border practice, we have seen licensed exchanges wait months for a single working fiat account while carrying full regulatory overhead. The compliance cost runs ahead of revenue.
The cross-border dimension makes this harder. An exchange licensed in, say, the EU under MiCA (the Markets in Crypto-Assets Regulation) may operate an entity in Lithuania or Malta, bank through an EMI in another member state, and serve clients across eight additional jurisdictions. Each hop introduces a new set of correspondent-banking relationships, each with its own due-diligence expectation. The jurisdictions that matter most here include the EU under ESMA and the national competent authorities, the UAE under VARA, Singapore under the Monetary Authority of Singapore's Payment Services Act regime, Hong Kong under the SFC, and the UK under the FCA's Money Laundering Regulations registration framework.
What Is the Regulated Basis for Fiat On/Off-Ramp Services?
The regulated basis depends on whether the business is providing the fiat conversion itself or accessing a third-party provider's rails – and that distinction determines whether a payment licence or EMI authorisation is required in addition to the VASP licence.
Where a digital-asset business operates its own fiat accounts and settles client obligations through those accounts, it is, in most leading jurisdictions, conducting a payment or e-money activity. Under MiCA and the applicable EU payment services regime, this requires either an EMI authorisation or a partnership with an authorised payment institution. Under the VARA regime in Dubai, the transfer-and-settlement activity licence covers certain fiat-related operations, but the holding of client fiat may still require a separate instrument. The MAS Payment Services Act in Singapore draws a clear line between digital payment token services and the fiat settlement layer that supports them.
The practical effect is that institutional digital-asset businesses operating in the leading hubs almost always require a stacked licence set – a VASP or CASP authorisation for the crypto activities, and either a payment institution registration, an EMI authorisation, or a formal banking relationship with a partner that holds the licence. The mistake we see most frequently is building the crypto stack first and treating banking as a later problem. It is not. The banking layer determines the go-live date.
The Travel Rule (the FATF obligation to pass originator and beneficiary data with a virtual-asset transfer) intersects directly with on/off-ramp banking. Banks and EMIs onboarding a VASP increasingly require evidence that the VASP has deployed a Travel Rule solution and that its on-chain transfers carry the required data. Failure to demonstrate this compliance is, in our experience, one of the leading stated grounds for EMI account refusal in 2024 and into the current period.
For a scoped assessment of your fiat-rail architecture, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking counterparty – change the analysis materially.
How Does EMI Onboarding Work for a VASP?
EMI onboarding for a VASP is a structured due-diligence process, not a standard account-opening form. The EMI's compliance team conducts an enhanced review of the VASP's AML/CFT programme, its licence status, its transaction monitoring capability, its Travel Rule implementation, and the jurisdictions from which its clients are drawn.
The process typically proceeds in three phases. The first is a pre-qualification exchange: the VASP submits a business overview, its regulatory licence, a summary of its AML programme, and an outline of anticipated transaction volumes and corridors. The EMI uses this to decide whether to proceed to formal due diligence. The second phase is full KYC/KYB – know-your-customer and know-your-business – documentation: constitutional documents, UBO disclosure, source-of-funds for operating capital, and a demonstration of the VASP's own client onboarding standards. The third phase is a compliance call or questionnaire covering specific risk areas: geographic exposure, PEP and sanctions screening protocols, on-chain analytics tooling, and incident-response procedures.
In our experience, VASPs that prepare a structured EMI-ready compliance pack before approaching a provider shorten the onboarding timeline considerably. VASPs that approach cold, with only their licence certificate and a website, are routinely declined even where they are technically compliant. The EMI is not evaluating the licence; it is evaluating the risk it absorbs by holding the VASP's client funds.
The cross-border complexity is acute here. A VASP licensed in Malta under the transitional MFSA regime, seeking an EMI relationship in another EU member state, carries a different risk profile than the same business would carry after full MiCA CASP authorisation. The EMI's appetite is calibrated to the credibility and stability of the licensing regime, not only to the face of the licence. We structure pre-onboarding presentations to address this directly.
What Do Banks Actually Require from Crypto Businesses?
Banks applying standard enhanced due-diligence protocols to a crypto business will require, at minimum, a clear licence from a recognised regulator, a documented AML/CFT programme with named compliance officers, a full corporate ownership structure to ultimate beneficial owner level, audited financials or a credible financial model for early-stage entities, evidence of transaction monitoring software, and a written description of the client base and the primary use cases.
Beyond the document pack, banks assess three things that are harder to document: the quality of the compliance team, the quality of the regulator that issued the licence, and the trajectory of the jurisdiction. A VASP licensed by the SFC in Hong Kong carries different weight with a European correspondent bank than the same business licensed in a jurisdiction the bank's compliance team has not modelled. The AIFC/AFSA regime in Kazakhstan, the ADGM/FSRA framework in Abu Dhabi, and the BVI FSC's VASP Act 2022 registration are all legitimate structures – but they require a more deliberate presentation to bank compliance teams that have not encountered them before.
We advise clients to treat the bank relationship as a second regulatory relationship. The bank has its own supervisory risk if it mis-onboards a high-risk client. Demonstrating that you have already solved the problems the bank's compliance team would ask about – AML, Travel Rule, sanctions exposure, on-chain analytics – is more persuasive than any introductory letter.
What Are the Most Common Mistakes in Fiat-Rail Structuring?
The most damaging mistake is single-rail dependency: one bank account, one EMI, one payment corridor. When that relationship terminates – and in crypto banking, terminations are frequent and rarely forewarned – the business has no operational fallback. We routinely advise clients to establish a minimum of two independent banking or EMI relationships before going live, even where one is clearly preferred.
The second common mistake is mismatching the entity structure to the banking need. A holding company in the BVI with an operating subsidiary in Lithuania does not have its banking problem solved by the Lithuanian VASP registration if the BVI entity is the counterparty to client agreements. The bank sees the BVI entity. The due-diligence burden falls on the least transparent structure in the chain.
The third mistake is treating payment licences and VASP licences as substitutes. They are not. A payment institution licence covers fiat settlement activity; a VASP or CASP licence covers virtual-asset services. Operators that hold only one sometimes discover, during a bank review, that an unlicensed activity has been running under the wrong regulatory cover. That finding can accelerate a debanking event and trigger a regulatory referral.
A fourth pattern we have seen in recent matters involves the use of personal or nominee accounts at the early stage. Some founders, unable to open a business account quickly, route client fiat through personal arrangements while the main account is pending. This creates AML attribution problems that are extraordinarily difficult to remediate after the fact. Banks that discover historical co-mingling of personal and business flows rarely continue the relationship.
In a recent matter, a licensed exchange in the EU reached us after its primary EMI terminated the account following an internal risk review. We mapped the existing compliance documentation, identified three gaps the EMI had flagged internally but not disclosed, restructured the AML programme presentation, and introduced the business to two alternative EMI providers already familiar with its licence category. The business restored settlement capability within a commercially acceptable period.
If a prior banking relationship stalled or an account was closed, a second read can surface the structural reason and the route back. Contact OBOLUS at info@oboluslaw.com.
Decision Matrix: Which Banking Profile Fits Your Business?
The right banking architecture depends on the business profile, the operating jurisdictions, and the client base. The following matrix describes the principal paths.
Profile A – EU-licensed exchange or custodian under MiCA: The primary instrument is a CASP authorisation under MiCA with passporting rights across the EU/EEA. Banking should be sought from an EMI or payment institution also authorised in the EU, ideally in the same member state as the CASP. The key risk is the EMI's own appetite for crypto clients; a regulated but crypto-averse EMI is not an acceptable solution. Timeline to banking relationship from CASP authorisation varies by EMI, and preparation of the compliance pack is the critical path item.
Profile B – Exchange or fund operating from the DIFC or VARA-licensed entity in Dubai: The VARA regime covers the crypto-activity side. The fiat-settlement question turns on whether the business needs to hold client fiat directly or can route through a DFSA-regulated bank or payment institution. For institutional clients with high-value settlement needs, a direct relationship with a UAE-licensed bank is typically required. The ADGM/FSRA framework in Abu Dhabi offers an alternative hub. Cross-border USD settlement remains the critical constraint – correspondent banking access to the dollar system requires an entity with sufficient AML credibility to satisfy US dollar-clearing banks.
Profile C – Global exchange with multiple operating licences (SFC in Hong Kong, MAS in Singapore, BVI FSC for fund structures): This profile requires a banking architecture that is genuinely multi-jurisdictional. The Singapore entity banks through a MAS-supervised institution; the Hong Kong VATP entity through an HKMA-supervised bank; the BVI holding structure through a relationship bank in a third jurisdiction. The compliance documentation for each relationship must be consistent but tailored. The Travel Rule solution must operate across all three. Consolidation of treasury through a single hub is attractive operationally but creates single-point-of-failure risk.
Profile D – Early-stage VASP seeking a first regulated banking relationship: The priority is a regulated EMI in a jurisdiction where the EMI market has some crypto appetite – the EU market, particularly among newer EMIs focused on fintech clients, is more accessible than traditional bank routes. The FINMA-regulated environment in Switzerland offers bank-like structures for specific asset profiles. The FCA's MLR registration in the UK is a prerequisite for UK-facing activity and affects EMI appetite in the UK market. Timeline from initial approach to live account varies widely and should be stress-tested in the business plan.
How Do Cross-Border Banking Structures Interact with Tax and Licensing?
The cross-border angle in fiat-rail structuring is not purely a banking problem. The entity that holds the bank account, the entity that contracts with clients, and the entity that holds the VASP licence must be aligned in the tax structure. A mismatch – for instance, a licence held in one jurisdiction and revenue booked through an entity in another without a credible transfer-pricing arrangement – creates both a regulatory and a tax exposure.
In our cross-border practice, we see this most acutely in structures where founders have optimised for the cheapest or fastest licence without modelling the banking and tax consequences. A VASP licensed in a low-tax jurisdiction that processes client settlements through an EU-based EMI may find that the EU entity has created a taxable nexus in the EU, irrespective of where the licence sits. The applicable corporate tax treatment varies by jurisdiction and requires specific local analysis, but the principle that substance follows function applies in every regime we work across.
The banking layer is also the layer that most regulators examine first in a compliance review. A regulator reviewing a VASP's compliance with AML obligations under the applicable regime – whether MiCA under ESMA, the VARA rulebook, or the MAS Payment Services Act – will look at the banking records as the primary evidence of transaction flow. A VASP that cannot produce clean, attributable banking records for every fiat-to-crypto conversion is not compliant, regardless of the quality of its on-chain analytics.
Self-Assessment Checklist: Is Your Fiat-Rail Architecture Ready?
Before approaching a bank or EMI, the following items should be in place. They are not exhaustive, but a business that cannot confirm each of these is likely to fail the EMI's due-diligence process at the pre-qualification stage.
- A current regulatory licence or registration from a recognised regulator, with no open enforcement actions.
- A documented AML/CFT programme, reviewed within the past twelve months, with named compliance officers and a clear escalation structure.
- A deployed Travel Rule solution, with evidence of operational testing across the primary counterparty corridors.
- A full UBO register and corporate structure chart, current and certified.
- Source-of-funds documentation for operating capital, sufficient to satisfy enhanced due-diligence standards.
- A transaction monitoring system with documented alert thresholds and case-management records.
- Sanctions screening covering all applicable lists, with a written policy for correspondent-jurisdiction lists.
- A written policy for accepting or declining clients from higher-risk jurisdictions.
- A client agreement that accurately describes the fiat-settlement mechanics and the entity counterparty.
We map the licence stack across operating, custody, and payment layers before a client commits to an approach. That mapping exercise surfaces gaps that would otherwise appear during due diligence – at a cost in time and credibility that is far higher than the cost of addressing them in advance.
Related at OBOLUS
- Banking, Payments & EMI Onboarding for Digital-Asset Businesses – the practice overview covering all payment-layer legal services for crypto operators.
- EMI Onboarding for VASPs: A Cross-Border Perspective – detailed analysis of EMI due-diligence and multi-jurisdiction EMI selection.
- Fiat On/Off-Ramp Banking for Early-Stage Founders – a practical guide for pre-institutional businesses building their first regulated banking relationship.
FAQ
Why do banks close crypto company accounts?
Banks close crypto company accounts primarily because their internal compliance frameworks classify digital-asset businesses as elevated-risk clients. The cost of the enhanced due-diligence a bank must conduct to hold such an account often exceeds the revenue the account generates. Regulatory uncertainty in the bank's home jurisdiction, exposure to a VASP's higher-risk client jurisdictions, and the absence of a credible Travel Rule solution are the most frequently stated reasons in formal closure notices. Banks rarely explain debanking decisions in full, but the pattern is consistent across the EU, the UK, and the major offshore hubs.
How can a VASP onboard with an EMI?
A VASP seeking to onboard with an EMI should prepare a structured compliance pack before making first contact. That pack should include the current licence certificate, a summary AML/CFT programme, a UBO structure chart, operating financials or projections, a Travel Rule solution description, and a transaction-volume and corridor forecast. EMIs that serve fintech and crypto clients will conduct a formal enhanced due-diligence review. The key to shortening the timeline is demonstrating that the VASP has already solved the compliance problems the EMI would otherwise need to investigate itself. Pre-qualifying two or three EMI candidates simultaneously reduces single-point-of-failure risk.
What does client-money safeguarding require?
Client-money safeguarding requires that fiat funds held on behalf of clients are segregated from the firm's own operating funds and held with a regulated credit institution or used to purchase qualifying liquid assets. Under the EU payment services and e-money regimes, safeguarding is an ongoing obligation with daily reconciliation and periodic regulatory reporting requirements. Under the applicable provisions in the UK, the FCA's client-money rules impose comparable obligations. The practical effect is that a VASP holding client fiat must either hold a payment institution or EMI licence itself, or contract with a licensed partner that assumes the safeguarding obligation. Failure to safeguard correctly is an enforcement risk in every leading jurisdiction.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We advise crypto exchanges, custodians, token issuers and funds across more than seventy licensing jurisdictions – and we map the licence, banking and payment stack before clients commit to a structure. To discuss your fiat-rail architecture, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Victor Olsen, Regulatory & Compliance Analyst – specialising in VASP licensing, AML programme design and cross-border banking onboarding for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.