A crypto exchange that processes millions in monthly volume can find its fiat rails severed overnight. One compliance review by an acquiring bank, one flagged transaction pattern, one unanswered KYB request – and the account is suspended, the card flows stop, and the business is effectively offline. For digital-asset firms, a PSP and acquiring agreement (the contract that gives a business access to card networks and settlement infrastructure) is not a back-office formality. It is the commercial lifeline connecting on-chain activity to the real economy. Losing it – or never securing it on defensible terms – is an existential risk.
Legal counsel on PSP and acquiring agreements for digital-asset firms must bridge two worlds simultaneously: the regulatory expectations of payment processors and card schemes on one side, and the compliance posture of a VASP (virtual asset service provider) or EMI (electronic money institution) on the other. At OBOLUS, we map that intersection across licensing, contract negotiation, and cross-border structure before the agreement is signed – because the terms embedded in a first contract tend to govern the relationship for years.
This page sets out what the service covers, the regulated basis for acquiring and PSP relationships in digital-asset contexts, the typical process, common structural mistakes, cross-border realities, and the decision framework operators should apply when building or rebuilding fiat rails.
What PSP and Acquiring Agreement Counsel Covers for Crypto Firms
Digital-asset businesses need PSP and acquiring counsel because the standard payment contract was not written with crypto in mind. The service covers the full lifecycle of the relationship: assessing whether the entity's regulatory status and business model are acceptable to an acquirer, preparing the commercial and compliance documentation that supports onboarding, reviewing and negotiating the agreement itself, and advising on the ongoing obligations that govern account conduct.
In practice, this means four distinct work streams. First, a pre-engagement assessment – confirming that the entity's licence, AML/KYC programme, and business description will meet the underwriting criteria of the target acquirer or PSP. Second, documentation preparation – KYB packs, AML policy summaries, ownership and control charts, and a regulatory status letter that explains the entity's position under the applicable regime. Third, contract review and negotiation – identifying the provisions that most expose a crypto firm, including unilateral termination rights, reserve and rolling-holdback mechanics, liability caps, and acceptable-use clauses that define what payment flows the processor will and will not handle. Fourth, ongoing advisory – responding to enhanced due diligence requests, managing relationship reviews, and advising on what changes to the business model require prior notification to the processor.
Each work stream matters. In our practice, the firms that face mid-contract account closures almost always failed at the first or third stage: they did not confirm regulatory acceptability before onboarding, or they signed an agreement without understanding the unilateral exit rights the processor retained.
For a scoped assessment of your payment infrastructure exposure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity type, the user base geography, the transaction volumes and the business model – change the analysis materially.
The Regulated Basis for Acquiring and Payment Processing in Digital-Asset Contexts
A PSP or acquirer operating in a regulated jurisdiction is not a neutral infrastructure provider – it is itself a regulated entity, and it carries regulatory risk for every merchant it onboards. Understanding this is the starting point for any serious approach to securing fiat rails for a crypto business.
Under MiCA (the EU's Markets in Crypto-Assets Regulation, supervised by ESMA and national competent authorities), a firm providing services connected to crypto-assets may be required to hold CASP (Crypto-Asset Service Provider) authorisation. That authorisation changes the risk profile the business presents to an acquirer significantly. An acquirer operating under the Payment Services Directive regime in the EU, or under FCA authorisation in the UK, must conduct risk-based due diligence on merchants. A CASP authorisation is one of the strongest signals a crypto firm can present: it demonstrates that a competent authority has reviewed the firm's governance, AML programme, and operational controls. It does not guarantee onboarding, but it removes the largest category of refusal.
In the UAE, a firm licensed by VARA (the Virtual Assets Regulatory Authority) or operating under the ADGM/FSRA framework in Abu Dhabi operates within a recognised regime. That recognition matters to Gulf-based and international acquirers whose underwriting teams now map crypto clients to specific regulatory registries. In Singapore, a payment service provider relationship typically requires demonstrating MAS (Monetary Authority of Singapore) licensing or a credible path to it under the Payment Services Act.
The regulatory basis also determines the AML obligations the entity owes. The Travel Rule (the FATF obligation to pass originator and beneficiary data with a virtual asset transfer) is increasingly a screening criterion: acquirers whose compliance teams understand Travel Rule compliance will use its absence as a ground for refusal. Demonstrating a documented, operational Travel Rule programme is now a standard expectation in any well-prepared KYB pack directed at a serious processor.
How Does PSP Onboarding for a Crypto Firm Typically Work?
The onboarding process for a digital-asset firm seeking an acquiring or PSP relationship runs in predictable stages, even though the timeline varies significantly by processor and by the entity's regulatory status at the outset.
The first stage is pre-qualification. The prospective client contacts the acquirer's merchant services team (or, more often, a specialist intermediary). The acquirer's underwriting desk applies a first-pass screen: Is the business model in scope for the processor's programme? Is the entity registered or licensed in a recognised jurisdiction? What are the anticipated monthly volumes? Many crypto firms are declined at this stage – not because of any specific legal deficiency, but because the processor's programme simply does not cover the activity type or the jurisdiction. Identifying the right acquirer before approaching is therefore a critical pre-step, not an afterthought.
The second stage is KYB (Know Your Business) submission. This is the fulcrum of the process. The quality of the KYB pack – its completeness, its legal accuracy, and the credibility of the regulatory narrative it presents – determines whether the relationship proceeds. A well-constructed pack typically includes corporate structure charts, beneficial ownership declarations, regulatory status documentation, an AML/KYC policy summary, a financial crime risk assessment, audited or management accounts, and a detailed business description. For a crypto firm, it will also include a description of the on-chain activity types, the fiat/crypto flow mechanics, and the Travel Rule compliance approach.
The third stage is underwriting review and negotiation. Once the KYB is accepted in principle, the processor's legal team issues draft terms. This is where counsel adds immediate commercial value. Acquirer agreements for crypto firms routinely contain provisions that a well-advised operator would seek to negotiate: unilateral termination rights exercisable without cause and on short notice; rolling reserves of a percentage of settlement that the processor holds for a defined period; broad acceptable-use restrictions that could encompass future business activities; and liability structures that cap the processor's exposure while leaving the merchant exposed.
The fourth stage is ongoing relationship management. The contract signed is not the relationship ended. Processors conduct periodic reviews. Business model changes – new product lines, new geographies, significant volume increases – can trigger enhanced due diligence or a contractual notification obligation. Failing to manage these triggers is a leading cause of mid-contract account suspension for firms that started the relationship on solid terms.
What Are the Most Common Mistakes Crypto Firms Make with PSP Agreements?
Structural errors in PSP and acquiring relationships for digital-asset firms fall into a recognisable pattern. In our cross-border practice, we see the same mistakes recur, regardless of the firm's size or sophistication in its core crypto activity.
The first and most damaging mistake is entity-level mismatch. The entity contracting with the PSP is not the same entity that holds the licence or the regulatory permission. This creates an immediate problem: the acquirer's underwriting approved a regulated entity, but settlement flows through an unregulated holding company or a shell. When the processor's compliance team identifies the mismatch – and they typically do, within the first review cycle – the account is suspended and the relationship re-evaluated from scratch, often at a worse commercial point.
The second mistake is incomplete disclosure at onboarding. A crypto firm that describes itself as a "payments company" or a "software provider" in the initial KYB, omitting the fact that it facilitates virtual asset transactions, is building the relationship on a misrepresentation. The agreement's acceptable-use provisions will almost certainly contain language that treats misrepresentation as a default event. The acquirer holds the right to terminate immediately and to retain reserves. The legal position of the merchant is then very weak.
The third mistake is failing to read the reserve mechanics. A rolling reserve provision that holds back a percentage of each settlement for an extended period is a material cash-flow constraint. For a crypto firm with a high-volume, low-margin model, a large reserve can be operationally crippling. We have seen clients sign agreements without fully modelling the reserve impact on their treasury – and then face a liquidity crisis within the first quarter of operation.
The fourth mistake is single-processor dependency. Operating with a single acquirer or PSP, without a backup relationship, is a concentration risk that sits at the business level. When – not if – the primary processor conducts a periodic review, having no fallback means a review that results in enhanced monitoring can halt operations entirely. Operators we advise routinely maintain at minimum a secondary relationship in an active state.
If a prior application stalled or an account was suspended, OBOLUS can review the structural position and identify the route back. Write to info@oboluslaw.com. If a second read can surface the structural reason, we will tell you so at the outset.
Cross-Border Considerations: Fiat Rails and Multi-Jurisdiction Payment Stacks
A digital-asset business operating across jurisdictions – which describes most serious operators – does not face one PSP and acquiring question. It faces a layered set of them, and the answers in each jurisdiction affect the others.
The first cross-border reality is that acquiring relationships are jurisdiction-specific. A UK-authorised EMI that provides payment accounts to crypto firms is operating under FCA supervision. The same EMI may be a useful partner for EUR settlement, but it cannot act as the acquiring relationship for a business whose primary card-not-present flows originate from users in a jurisdiction where the EMI has no establishment or passporting permission. Card scheme rules – particularly those of Visa and Mastercard – impose their own geographic and category restrictions on acquirers, independent of local regulatory requirements.
The second cross-border reality is that regulatory status in one jurisdiction does not translate automatically into commercial acceptability in another. A firm holding a VARA licence in Dubai is well-positioned with Gulf-based payment infrastructure. That same licence may carry limited weight with a European acquirer whose underwriting team is mapping clients to MiCA-authorised CASPs or FCA-registered firms. The solution is not to abandon the VARA structure – it may be the optimal regulatory home for the business – but to build the payment stack with partners whose risk appetite aligns with that structure, or to secure a complementary EU or UK regulatory footprint for the European payment layer.
The third cross-border reality concerns the Travel Rule and its interaction with fiat onboarding. Several EMIs and payment institutions now require, as part of onboarding, that a VASP counterparty demonstrate Travel Rule compliance as a condition of the payment relationship. This is not a legal requirement imposed on the EMI in every jurisdiction, but it has become a market standard among the more sophisticated payment institutions operating in the digital-asset space. A VASP that cannot demonstrate a credible, operational Travel Rule programme will face a narrower field of willing payment partners.
The fourth cross-border reality is that sanctions and restricted-jurisdiction exposure must be disclosed and documented. A firm that processes transactions involving users in a jurisdiction subject to financial sanctions – even if those transactions are facilitated by a chain of licensed intermediaries – represents a material risk for an acquirer. The acquirer's OFAC or sanctions screening programme will identify the exposure. The question is whether the firm has documented its controls in advance. In our cross-border practice, we build the sanctions control narrative into the KYB pack as a matter of course, rather than leaving it to be discovered during underwriting.
Decision Matrix: Which Payment Structure Fits Which Operator Profile?
The right payment and acquiring structure depends on the business model, the regulatory footprint, and the volume and geography of the fiat flows. There is no single correct answer. The following profiles illustrate the primary decision axes.
Profile A – EU-Licensed Exchange or Custodian. A firm holding CASP authorisation under MiCA, passporting across the EU/EEA, should build its payment stack around an EU-regulated EMI or payment institution with explicit crypto-merchant category approval. The acquiring relationship should be structured at the entity level that holds the CASP – not at a parent or subsidiary – to avoid entity-level mismatch. The timeline to onboarding with a well-matched EMI, assuming a complete KYB pack, is typically a matter of several weeks to a small number of months. The key risk is the acceptable-use clause: negotiate the scope of permitted virtual asset types before signing.
Profile B – VARA or ADGM-Licensed Firm with Gulf and International Flows. This profile typically requires a dual payment stack: a Gulf-oriented relationship with a local or regional payment institution comfortable with the VARA or FSRA framework, and a secondary EU or UK relationship for cross-border EUR and GBP settlement. The key risk is the entity used for each layer. Processors will scrutinize beneficial ownership for UAE-domiciled entities closely. The KYB pack must present the ownership structure with precision.
Profile C – Early-Stage or Pre-Licence Firm. A firm that has not yet obtained its primary regulatory licence is in the weakest negotiating position for PSP onboarding. Some processors will onboard a pre-licence firm that holds a credible regulatory roadmap – a pending application with a named competent authority – but the commercial terms will reflect the higher risk. The practical advice is to initiate the licence process first and approach acquiring partners once at minimum conditional approval is in hand. Operating on a compressed timeline with a payment partner that holds a broad unilateral exit right is a structural fragility.
Profile D – Firm Rebuilding After Account Closure. This is a recovery situation, not a greenfield one. The primary task is diagnosing the reason for closure – compliance failure, AML flag, entity-level mismatch, or policy change at the processor level – before approaching new partners. Approaching a new processor with the same structure and documentation that caused the first closure will produce the same outcome. In a recent matter, we advised a payments-focused digital-asset firm that had lost its primary acquiring relationship following an undisclosed change in its business model. We identified the disclosure gap, restructured the entity's compliance documentation, and supported onboarding with two alternative processors within a period of several months. Both accounts remained active at the conclusion of the engagement.
Self-Assessment: Is Your PSP and Acquiring Structure Sound?
A firm should conduct an honest assessment of its payment structure before approaching new processors or before a scheduled processor review.
The following questions identify the most common structural gaps. The contracting entity is the same entity that holds the relevant licence or regulatory permission. The KYB pack accurately and completely describes the business model, including all virtual asset activity types. The Travel Rule programme is documented and operational. The acceptable-use provisions in any existing agreement cover the full scope of current and planned business activities. The reserve mechanics have been modelled against treasury forecasts. A secondary or fallback acquiring relationship exists in an active state. Business model changes have been notified to processors where the agreement requires it. Sanctions exposure has been documented and the controls are current.
If any of these points cannot be answered affirmatively, the structure carries a risk that a processor's compliance review will surface – usually at the worst commercial moment.
We have seen firms pass years of successful operation with a structural gap in the payment layer, only to have it identified during a routine annual review at precisely the moment a business-critical volume spike made the account most valuable. The exposure does not diminish with time. It compounds.
Related at OBOLUS
- Banking, Payments and EMI Onboarding for Digital-Asset Businesses – the full practice overview covering the licence, banking and payment stack for operators across jurisdictions
- Fiat On/Off-Ramp Banking in the United Kingdom – FCA-regulated payment access, EMI onboarding and UK fiat rail strategy for crypto firms
- Fund Manager Licensing in Panama – licensing and structuring for asset managers with digital-asset exposure seeking a Latin American base
FAQ
Why do banks close crypto company accounts?
Banks and payment institutions close crypto company accounts primarily because the risk profile of the business was not adequately disclosed or documented at onboarding, because the business model changed without notification, or because the processor's own risk appetite changed following a regulatory or compliance review. AML deficiencies, entity-level mismatch between the contracting entity and the licensed entity, and the absence of a credible Travel Rule programme are the most common specific causes we see in practice. In most cases the closure was predictable from the structure.
How can a VASP onboard with an EMI?
A VASP seeking to onboard with an EMI must present a KYB pack that accurately describes its business model, demonstrates its regulatory status under an applicable regime such as MiCA, VARA, the FCA's MLR registration, or the MAS Payment Services Act, and shows a documented, operational AML and Travel Rule programme. The EMI will conduct enhanced due diligence on the VASP as a higher-risk merchant category. The process is manageable with preparation. The most common failure point is an incomplete or inaccurate business description at the initial submission stage.
What does client-money safeguarding require?
Client-money safeguarding – the obligation to hold customer funds in segregated accounts or in qualifying liquid assets separate from the firm's own funds – is a core requirement under most regulated payment and EMI regimes, including the EU's Payment Services Directive framework and its national equivalents. For a digital-asset firm, the interaction between fiat safeguarding obligations and the custody of virtual assets requires careful structural analysis. The safeguarding obligation typically applies to the fiat leg of any transaction; the virtual asset leg is governed by the applicable custody regime in the firm's licensing jurisdiction.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than 70 jurisdictions, on disputes and on-chain asset recovery across more than 25 forums, and on the tax, banking and compliance structures that sit around them. Digital assets are the whole of our practice. We map the licence, banking and payment stack across operating, custody and payment layers before you commit – so structural gaps are identified before they become enforcement events. We advise crypto exchanges, custodians, token issuers and funds across more than 70 licensing jurisdictions. To discuss your situation, contact info@oboluslaw.com or reach us via t.me/oboluslaw.
By Victor Olsen, Regulatory & Compliance Analyst – specialist in the regulatory positioning of digital-asset firms within payment and acquiring relationships across EU, Gulf and common-law jurisdictions.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.