Banking onboarding for regulated digital business: why banks say no

Almost every regulated digital business we work with has been declined by a bank, and almost all of them believe the decline was about what they do. In most cases it was not. It was about six questions a compliance officer is required to close, and a file that did not close them.

What a decline actually means

Banks do not refuse businesses. They refuse files. A compliance officer reviewing an application is working against an internal policy that lists what must be evidenced before an account can be opened. If an item cannot be evidenced, the officer's only safe decision is to decline — and, critically, they are usually not permitted to tell you which item failed.

This produces the familiar experience: a polite refusal with no reason, and a founder concluding that the sector is unbankable. The sector is not unbankable. Applications from it are usually under-documented, because founders prepare the file a bank asks for rather than the file a bank needs.

The distinction matters, because the application form is a fraction of what the decision rests on.

The six questions

Across institutions and jurisdictions the list is remarkably stable.

1. Who owns this, exactly?

An unbroken chain from the applicant entity to natural persons, with documents at every step. Not an org chart — registry extracts, share registers, trust deeds where relevant. Where a nominee or a corporate services provider appears in the chain, expect the question to sharpen rather than stop.

2. Where did the money come from?

Two separate things that are constantly conflated. Source of funds is the origin of the money entering the account. Source of wealth is how the beneficial owners came to have money at all. A file that documents the first and asserts the second is the single most common failure we see.

3. What does the business actually do?

In operational terms: who pays whom, for what, through which rails, in which currencies, at what frequency and volume. A pitch-deck description of the product does not answer this. A flow-of-funds diagram with narrative does.

4. Is it licensed, and for what?

The authorisation, its scope, its conditions and — if the activity is regulated and you are not licensed — why not. “We do not need one” is an acceptable answer only when accompanied by the reasoning.

5. What prevents this being used for money laundering?

A summary of your AML framework written for a reader who will not read the full policy: risk assessment, onboarding standard, screening, monitoring, who the MLRO is. Two pages, specific to you.

6. What should we expect to see?

Expected volumes, counterparties, geographies and transaction patterns, stated in advance. This one is under-appreciated: it is how the bank calibrates its monitoring, and an account whose activity matches what was predicted generates far fewer reviews than one that does not.

Building the file

The onboarding pack that answers all six runs to twenty or thirty pages and takes days rather than weeks to assemble, if the underlying documents exist. It typically contains:

• Corporate documents for every entity in the chain, current and certified where required
• Ownership chart to natural persons with supporting registry evidence
• Identification and address verification for owners, directors and authorised signatories
• A source of funds and source of wealth narrative with documentary support — sale agreements, tax returns, audited accounts, whatever actually exists
• Licence or authorisation documents, or a written analysis of why none is required
• A description of the business model with a flow-of-funds diagram
• An AML framework summary and the MLRO's appointment
• Expected activity: volumes, currencies, counterparties, geographies
• Existing banking relationships and, where applicable, references

Choosing where to apply

Applying broadly is the most expensive mistake available in this area, for a reason that is not obvious: declines are recorded, and later applications ask whether you have been refused before. Ten scattered applications do not increase your chances; they build a history that makes the eleventh harder.

A better sequence is to shortlist institutions whose stated risk appetite covers your activity, confirm through the relationship channel rather than the public website that the appetite is current, and then apply to two or three with a complete file. Where the activity is genuinely high-risk, expect to combine a primary banking relationship with specialised payment providers rather than to find one institution that does everything.

After a refusal

A refusal is recoverable, but not by reapplying to the same institution with the same file. The sequence that works is to identify the probable gap — the pack above makes this a short exercise — to close it with evidence, and to approach a different institution with the refusal disclosed rather than discovered.

Disclosure is counterintuitive and it is correct. A prior refusal that appears in your file with an explanation is a fact. The same refusal discovered during review is a credibility problem, and credibility problems are not remediable within a single application.

Where to start

If accounts have been declined and you do not know why, the useful first step is a review of the file against the six questions. It usually identifies the gap within a day. See banking onboarding for how we run it, or describe the situation and we will tell you what we would look at first.

Where a refusal has been accompanied by an account freeze or a restriction in Ukraine, that is a different problem with a different route — see lifting seizures and restrictions on accounts on our Ukrainian-language site.