Why Banks Reject Crypto Companies (and How to Fix It)

Crypto companies are still treated as higher-risk bank customers. There is no reliable public EU-wide bank rejection rate for crypto company account applications. What is documented is the underlying risk concern: FATF notes that many virtual asset service providers are perceived as "risky business" and denied access to bank accounts, while the EBA warns that de-risking whole customer categories without looking at the individual risk profile can be unwarranted.

The pattern is familiar across jurisdictions. You register your company, build your product, apply for a bank account -- and get a polite rejection, a long list of follow-up questions, or no clear explanation.

But here is the thing: many rejections are not only about the business model. They are about whether the bank can evidence that it understood and controlled the risk. A complete AML, sanctions, KYC, travel-rule, and transaction-monitoring file does not guarantee approval, but it gives the bank's compliance team something concrete to assess.

---

What are the 7 reasons banks reject crypto companies?

For EU and Cyprus CASPs, the same due diligence gaps repeatedly create delays or rejections. Here is each one, and how to fix it.

1. Opaque ownership structure

   Banks must identify your Ultimate Beneficial Owners (UBOs) and anyone else who ultimately controls the company. The practical threshold often starts with direct or indirect ownership around 25%, but control can matter even below that level. If your corporate structure involves multiple holding companies, nominee directors, or jurisdictions with limited ownership transparency, the bank's compliance team may not be able to complete due diligence.

   Fix: Prepare a clear ownership chart showing every entity from you to the top. Include passport copies, proof of address, and source of wealth documentation for each UBO. If your structure is genuinely complex, write a one-page narrative explaining why -- and make sure it is not just tax optimization.

2. Missing or pending MiCA authorisation

   Under MiCA, firms providing crypto-asset services in the EU need CASP authorisation unless a specific exemption applies. The EU transitional period for firms that were already operating under national law ended on 1 July 2026. ESMA has called on unauthorised CASPs to wind down EU activity, and CySEC stated that Cyprus national-regime CASPs could continue only until authorisation was granted or refused, or until 1 July 2026, whichever came first.

   Fix: If you have a MiCA authorisation, lead with it. Put the licence status, regulator, register link, and permitted services on page one. If your application is still pending after 1 July 2026, be explicit whether you are pre-operational, outside EU scope, or winding down. A pending application can support context, but it is not a substitute for authorisation to keep serving EU clients after the transition.

3. No documented AML/KYC framework

   "We do KYC" is not an AML framework. Banks commonly ask for a board-approved AML/CFT policy, written KYC procedures with risk scoring methodology, customer onboarding workflows, and ongoing monitoring processes. If you cannot produce these documents, the bank cannot assess the control environment.

   Fix: Write your AML/CFT policy before you apply. It does not need to be long, but it needs to cover your risk appetite, customer due diligence procedures, enhanced due diligence triggers, suspicious transaction reporting process, record-keeping standards, and Travel Rule controls under TFR. Board-approve it. Date it. Reference the current rules you operate under, including MiCA, Regulation (EU) 2023/1113, your national AML law, and your plan for the AMLR/AMLD6 framework whose main application and transposition date is 10 July 2027.

4. Unclear source of funds and liquidity

   Where does the money come from? For crypto companies, this question has layers: where does the company's operating capital come from (investment, revenue, personal funds), and where do your customers' funds originate? If you cannot clearly answer both, the bank cannot assess your money laundering risk.

   Fix: Document your funding history -- investment rounds with term sheets, revenue with invoices, personal capital with bank statements showing the transfer. For customer funds, describe your source-of-funds verification process: what documentation do you require, at what thresholds do you escalate, how do you handle crypto-to-fiat conversions.

5. High-risk jurisdiction connections

   If your company, its UBOs, or significant portions of your customer base are connected to jurisdictions on the FATF high-risk or increased-monitoring lists, or to jurisdictions, persons, sectors, or activity covered by applicable EU, UN, or national restrictive measures, expect enhanced questioning. This can apply even when the connection is indirect -- a subsidiary, a concentrated customer base, or repeated flows involving higher-risk jurisdictions.

   Fix: You cannot change your geography, but you can demonstrate that you manage the risk. Show your jurisdiction risk assessment. Document your enhanced due diligence procedures for high-risk connections. If you have exited or restricted services to certain jurisdictions, document that decision and when it was made. Proactive risk management is what banks want to see.

6. No evidence of sanctions screening

   This is one of the gaps that can stop an application without much explanation. EU financial institutions and CASPs must be able to comply with applicable Union and national restrictive measures, and EBA guidelines set expectations for PSPs and CASPs on KYC, screening, and due diligence when performing transfers. For an EU-only CASP, the legal anchor is EU and national restrictive measures, with UN sanctions implemented through EU or national law. OFAC or other third-country lists may be a practical bank or correspondent requirement where there is a relevant nexus, USD flows, group policy, or specific bank policy; they are not a universal MiCA mandate.

   Fix: Implement sanctions screening and document it against the lists that apply to your business and payment rails. Show the bank recent screening reports -- not just "we use tool X," but actual evidence: screening logs, list sources, match handling procedures, false positive resolution records, and escalation records. The bank's compliance team needs to see that screening is active, ongoing, and auditable.

7. Describing yourself as a "crypto company"

   This one is not about hiding the business model -- it is about framing the regulated activity accurately. If the application starts and ends with "crypto," the relationship manager may not see the authorisation status, customer profile, services, jurisdictions, and controls needed to route the file to compliance.

   Fix: Lead with your regulatory status, services, and controls, not the technology label alone. You are a "MiCA-authorised crypto-asset service provider" or a "regulated digital-asset service provider" if that is true. Open with your licence status, AML framework, sanctions controls, Travel Rule process, and transaction monitoring. This is not deception -- it is accurate positioning.

---

What do banks actually want to see?

Here is a practical bank-onboarding checklist for crypto companies. This is not a statement that every item is legally required for every CASP; it is the evidence banks commonly need to complete a risk-based review.

---

What is the compliance evidence package approach?

There is a gap in the market for crypto founders applying for bank accounts. On one side: screenshots and informal explanations that produce no reliable documentation trail. On the other: a full regulatory advisory project that may be more than a narrow bank onboarding file needs.

The compliance evidence package approach sits in between. The idea is simple: assemble a structured collection of documents that shows your company actively manages AML, KYC, and sanctions risk -- and present it as a single package with your bank application.

A strong compliance evidence package includes:

• AML/CFT policy -- board-approved, dated, referencing applicable regulations
• KYC procedures -- customer onboarding flow, risk categorization, EDD triggers
• Sanctions screening reports -- recent checks against applicable EU, UN, national, and bank-required lists, with timestamps and results
• Transaction monitoring methodology -- how you detect suspicious patterns, escalation thresholds, reporting procedures
• Risk assessment -- your products, customer segments, jurisdictions, and how you mitigate identified risks
• Post-transition migration evidence -- if customers migrated from an unauthorised VASP after 1 July 2026, include individual customer risk assessments, CDD refresh evidence, transaction-monitoring capacity checks, and the rationale for any EDD or exits
• MLRO appointment -- formal designation with reporting lines and authority
• Training records -- evidence that staff are trained on AML obligations

The goal is to give the bank's compliance team enough evidence to assess the application without basic follow-up gaps. When a compliance officer opens your application and finds a complete, well-organized evidence package, the first review can focus on real residual risk rather than missing documents.

---

Which banks are more likely to accept crypto companies?

Not all banks treat crypto the same way. There is no official EU list of banks that accept crypto companies, and institution policies change. In practice, the landscape broadly breaks into three types:

MiCA gives banks a clearer authorisation status to review, but it does not force any bank to open an account. The EBA's de-risking guidance says rejecting whole customer categories without considering individual risk profiles can be unwarranted, while still allowing banks to refuse or exit relationships where the risk cannot be managed. A MiCA CASP authorisation helps the diligence file; it does not create an acceptance rate or an entitlement to banking.

---

Frequently asked questions

Why do banks reject crypto company applications?

Banks usually reject or pause crypto company applications when they cannot complete risk-based due diligence. Common gaps include opaque ownership structures, no current CASP authorisation for EU activity after the 1 July 2026 MiCA transition, no documented AML/KYC framework, unclear source of funds and liquidity, high-risk jurisdiction exposure, weak sanctions controls, and positioning the business as "crypto" without explaining the regulated service and control framework.

What documents do crypto companies need to open a bank account?

Banks commonly ask for a compliance evidence package including: certificate of incorporation and corporate registry extract, ownership and control chart, UBO documents, current CASP authorisation or clear pre-operational/pending-application status, board-approved AML/CFT policy, documented KYC procedures with risk scoring methodology, sanctions screening evidence for applicable EU, UN, and national restrictive-measures lists, a risk assessment covering products and customer base, MLRO or compliance-owner appointment, source-of-funds evidence, transaction-monitoring methodology, and recent financial statements where available.

How should crypto companies position themselves when applying for a bank account?

Lead with regulatory status, services, customer types, jurisdictions, and controls. Do not hide that the business involves crypto-assets, but describe it as a MiCA-authorised or otherwise regulated digital-asset service provider if that is true. Open with your licence status, AML framework, sanctions controls, Travel Rule process, and transaction-monitoring evidence.

Which banks accept crypto companies in the EU?

There is no official EU list of banks that accept crypto companies. Bank appetite varies by institution, country, licence status, customer profile, payment flows, and correspondent-banking constraints. A MiCA CASP authorisation helps the bank complete due diligence, but it does not guarantee account approval.

What is a compliance evidence package for bank applications?

A compliance evidence package is a structured collection of documents that shows how your company manages AML, KYC, travel-rule, transaction-monitoring, and sanctions risk. It includes your AML/CFT policy, KYC procedures, sanctions screening reports showing recent checks, transaction monitoring methodology, risk assessment, MLRO or compliance-owner appointment, and training records. It is a practical onboarding tool, not a legal guarantee.

---

Bottom line

Banks do not need a perfect story. They need a file they can assess. Crypto company applications fail when the bank cannot verify ownership, authorisation, source of funds, customer risk, sanctions controls, travel-rule controls, and transaction monitoring.

The fix is practical: document your compliance framework, produce sanctions screening evidence, lead with your regulatory status, and present a complete application that lets the bank complete its risk review. Most of the 7 rejection reasons above are solved by preparation, not by changing your business.

The companies with the strongest banking conversations are the ones that look like regulated financial institutions because their evidence is organised, current, and specific.