Bank accounts for crypto businesses: what banks check before onboarding a VASP
Before a bank opens an account for a VASP, it checks the licence, the owners and managers, the AML programme, monitoring and the Travel Rule, the expected flows and how client money is kept apart.
A bank opens an account for a crypto business, a virtual asset service provider (VASP), only after it has assessed the risk of that one customer. It checks seven things: the licence, who owns and runs the firm, its AML programme, how it monitors transactions, how it applies the Travel Rule, what money it expects to move, and how it keeps client money apart from its own. After that, it keeps watching.
Why a bank looks harder at a VASP
To a bank, a crypto business is a customer whose own customers it cannot see. The European Banking Authority's guidelines on ML/TF risk factors, as amended for crypto in EBA/GL/2024/01, say a crypto-asset service provider is exposed to risk because its technology "allows them to transfer crypto-assets instantly across the world and onboard customers in different jurisdictions" (Guideline 21.1).
That is no reason to refuse the sector. The FATF's updated guidance on virtual assets and VASPs (2021) says banks should evaluate each relationship and "do not resort to the wholesale termination or exclusion of business relationships within the VASP sector without an appropriately-targeted risk assessment" (paragraph 23). The question is whether this firm's risks can be understood and managed.
The EBA's sector guideline for retail banks puts the order plainly for crypto providers outside MiCA: "Banks should carry out the ML/TF risk assessment of these customers prior to establishing a business relationship with them" (Guideline 9.20). A MiCA-licensed CASP is still assessed, under the guidelines' general rules. The seven checks below are what it usually covers.
What a bank checks before opening a bank account for a VASP
1. The licence, and what it covers
The first question is whether the firm may do what it does. In the EU, the Markets in Crypto-Assets Regulation (MiCA) says a person "shall not provide crypto-asset services, within the Union" unless authorised as a crypto-asset service provider (CASP) or allowed to as a bank, investment firm or other listed entity (Article 59(1)). Outside the EU, the FATF's standard is that VASPs are licensed or registered at least where they are created.
The bank does not stop at "licensed". For crypto providers outside MiCA, the EBA's minimum list for banks includes determining "whether the services provided by the customer fall within the scope of the registration or licence", and whether it provides services beyond it (Guideline 9.21). A firm licensed for exchange that also runs an unlicensed lending product will be asked about it.
2. Who owns it, who runs it, and where the money came from
Next come the people. The bank identifies the ultimate beneficial owners and, under the same guideline, carries out "due diligence on senior management to the extent that they are different, including consideration of any adverse information". Expect sanctions and adverse media checks on directors and significant shareholders.
Source of funds is the other half: where the share capital came from. A founder who made money in crypto will be asked to show the trail, from the original holdings to the bank account that funded the company.
3. The AML/CFT programme, tested rather than read
Every applicant sends policies; the bank wants to know whether they work. The EBA's correspondent guideline, for banks serving other financial firms, asks for "a qualitative assessment of the respondent's AML/CFT control framework, not just obtain a copy of the respondent's AML policies and procedures" (Guideline 8.17).
A bank typically asks for the firm's business-wide risk assessment, its customer due diligence and KYB procedures, who the compliance officer is and to whom they report, staff training, and the last independent audit with how its findings were closed. The KYC, AML and Travel Rule guide covers what that programme contains.
4. Transaction monitoring and blockchain analytics
A crypto business has two flows to watch: money through the bank and coins on public blockchains. The EBA expects a CASP to have "suitable and effective monitoring tools in place, including transaction monitoring tools and advanced analytics tools", scaled to the nature and volume of its business and the crypto-assets it offers (Guideline 21.11).
The second needs blockchain analytics: tools that score an address by tracing where its coins came from. The EBA says they matter "particularly" for transactions involving self-hosted addresses, because they allow the CASP "to trace the history of transactions and to identify potential links with criminal activities, persons or entities" (Guideline 21.13). A bank will ask which rules the firm's transaction monitoring runs, how alerts are worked, and what wallet screening does before a deposit is credited.
5. The Travel Rule
In the EU, the Travel Rule is set by the Transfer of Funds Regulation. The sender's CASP "shall ensure that transfers of crypto-assets are accompanied by" the originator's name, address and account details, and the beneficiary's (Regulation (EU) 2023/1113, Article 14). For a transfer of more than 1,000 euros to a self-hosted address, the CASP must take adequate measures to assess whether that address is owned or controlled by the originator, its own customer (Article 14(5)).
A bank checks that this is working, not planned: what share of transfers arrive without complete information, and whether they are held, returned or rejected.
6. The business model and the flows it expects
A bank cannot monitor an account without knowing what normal looks like, so the firm declares it. The EBA tells correspondent banks to understand the respondent's customer base and "the type of crypto-assets the respondent CASP will transact through the correspondent account" (Guideline 8.17).
A declared profile usually covers:
the services (exchange, custody, a broker app, OTC trades) and the crypto-assets listed;
who the customers are, retail or business, and which countries they live in;
expected money in and out each month, by volume and number of payments;
where coins go: to other regulated providers or to self-hosted addresses.
Some answers raise the risk. The EBA's correspondent guideline treats significant business for CASPs focused on certain products as a higher-risk factor (Guideline 8.6, citing 21.3(d)), a list that includes transfers to and from self-hosted addresses, decentralised platforms, mixers and crypto ATMs. In this guide's illustrative profile, a firm declares 2.4 million euros in each month, 2.1 million out, about 3,000 active customers, all resident in the EU, and roughly a fifth of crypto withdrawals to self-hosted addresses.
7. How client money is kept apart
The last check is where customers' euros sit. Under MiCA, a CASP that holds client funds other than e-money tokens must, "by the end of the business day following the day on which clients' funds other than e-money tokens were received, place those funds with a credit institution or a central bank", in "an account separately identifiable from any accounts used to hold funds belonging to the crypto-asset service providers" (Article 70(3)). Paragraphs 2 and 3 of the article do not apply to CASPs that are themselves credit institutions, e-money or payment institutions (Article 70(5)).
So the bank is usually asked for two kinds of account: an operating account for the firm's own money and a client funds account for customers', safeguarding in practice. Commingling the two is what the bank is looking for.
Two points from the EBA's guidelines shape this account. A pooled account that holds money for the customer's own clients draws "full CDD measures, including treating the customer's clients as the beneficial owners of funds held in the pooled account" (Guideline 9.16), so expect questions on how the firm can show whose money is whose. And an account that receives customers' euros in the name of a company that is neither the CASP nor known to be linked to it is a factor that may increase risk (Guideline 8.6).
The answer to both is a ledger that holds each customer's balance and a daily check of the client account against it. The double-entry ledger and reconciliation guide shows how that works.
After onboarding: the monitoring does not stop
Opening the account starts the bank's monitoring. It compares what moves with the declared profile, reviews the relationship periodically, and applies enhanced due diligence if the risk rises.
In the illustrative profile, four months sit close to the declared 2.4 million. In month five, 6.8 million arrives. That is not a breach on its own, but the bank will ask why, and the firm answers with its own data: which customers, countries and assets, and what changed. Banks usually expect to hear of a change to the business, new owners or a regulatory finding from the firm first.
How a CASP can prepare its file
A file that sends evidence, not promises, answers most of a bank's questions before they are asked. A complete one usually holds:
The licence and its scope, with the authority's register entry, and a list of services mapped to it.
The corporate structure to the beneficial owners, with IDs, CVs of the managers and the source of funds for the capital.
The AML/CFT programme: the business-wide risk assessment, policies, the compliance team, training records and the last independent audit.
Monitoring in practice: the rules, alert volumes, how alerts are closed, and sample sanctions and wallet screening results.
Travel Rule handling: how data is sent, received and checked, and what happens to incomplete transfers.
The declared profile: services, assets, customers, countries and expected monthly flows.
Client money: the account structure under Article 70, and a sample daily reconciliation of the client account against the ledger.
Software can produce much of that evidence; people still run the programme. You can see these controls in Marengo, our exchange, which has sanctions screening, the Travel Rule, transaction monitoring and a double-entry ledger with reconciliation built in. The licensed operator runs them and answers to its bank and its regulator.
None of this guarantees an account: the decision is the bank's, on its own risk appetite. The MiCA checklist covers the licence the file rests on. This is general information, not legal advice.
Frequently asked questions
Can a bank refuse a bank account to a VASP? Yes. The FATF asks banks to assess each relationship rather than exclude the whole sector, but a firm whose risks the bank cannot understand or manage can still be refused.
Does a MiCA licence guarantee a bank account? No. Authorisation answers the first check, the licence. The bank still reviews the owners, the AML programme, monitoring, the Travel Rule, the expected flows and client money.
Why does the bank ask about self-hosted wallets? Because the EBA lists transfers to and from self-hosted addresses among the factors that may increase risk. The bank wants to see them screened and covered by the Travel Rule.
What is a client funds account for a CASP? An account at a credit institution or a central bank that holds customers' money, separately identifiable from the firm's own accounts, as MiCA Article 70(3) requires for client funds other than e-money tokens.
Build the controls a bank will ask about
A bank's review is easiest to answer with a platform that records the evidence as it runs. See how our white-label crypto exchange is built and handed over to the licensed operator who runs it, read about the KYC and AML module, or open Marengo at marengo.paynoramic.com.
