What makes a business high-risk in the eyes of banks and regulators

A company may operate legally and still be classified as high-risk by a bank. This assessment depends not only on its industry but also on payment geography, ownership structure, customer types and the quality of its compliance controls. For regulators, higher risk generally requires enhanced controls. For banks, it also involves operational costs, potential penalties and internal risk appetite limits. This article explains which factors increase a company’s risk rating, how assessments work and what businesses can do to reduce risk.

What “high-risk business” actually means

High-risk business is not a separate legal status or evidence of unlawful activity. It reflects an assessment of whether a company could be used for money laundering, terrorist financing, sanctions evasion, fraud or other financial crime.

Under the FATF risk-based approach, financial institutions must identify and assess risks and apply proportionate controls. Higher risk requires enhanced due diligence, while lower risk may permit simplified measures where allowed by law.

Banks and regulators assess risk from different perspectives:

• Regulators set mandatory licensing, AML/CFT, sanctions-control and reporting requirements;
• Banks assess each customer under their methodology, operational capabilities and risk appetite;
• Payment providers also consider chargebacks, fraud exposure and card-scheme rules;
• Correspondent banks may restrict transactions by country, currency or payment category.

A licensed company may therefore remain unacceptable to a particular bank. The reason may be monitoring costs, limited sector expertise or incompatibility with the institution’s strategy rather than misconduct.

However, industry or country risk should not automatically replace an individual assessment. The European Banking Authority stresses the need to prevent unwarranted de-risking. The assessment should consider all relevant factors and the measures used to control identified risks.

Which factors increase a company’s risk rating

A bank builds a company’s risk profile from multiple factors. Regulated activities, a complex ownership structure or foreign customers may increase scrutiny, but no single factor determines the final classification.

Key considerations include:

1. Business model. Risk rises where the company holds client funds, processes third-party payments, manages assets or enables rapid cross-border transfers.
2. Industry. Gaming, crypto, forex, payment services and other regulated sectors require specific licences, transaction monitoring and specialist banking expertise.
3. Geography. Banks consider the countries of incorporation and management, UBO residence, customer locations and payment destinations. Sanctioned territories and jurisdictions under increased FATF monitoring receive particular attention.
4. Ownership and control. Multi-layered structures, trusts, nominee shareholders and frequent ownership changes increase risk where their economic purpose is unclear.
5. Customer profile. PEPs, non-residents, intermediaries and customers without a clear source of funds require additional checks.
6. Products and delivery channels. Anonymous or remote services, rapid transfers and products allowing third-party withdrawals complicate oversight.
7. Transaction pattern. High turnover inconsistent with the stated activity, unexplained payments and transactions departing from the business plan are red flags.

Banks also assess risk management. Weak AML/KYC procedures, inadequate compliance personnel or inconsistencies between the website, contracts and onboarding forms can increase the rating even in a relatively low-risk sector.

The assessment is not permanent. It is reviewed when ownership, markets, products, turnover or transaction patterns change. Banks therefore monitor both the company at onboarding and whether subsequent activity matches its declared profile.

Industries commonly treated as high-risk

Industry classification is an initial factor, not a final conclusion about a company. Higher risk commonly arises from rapid fund flows, remote services, cross-border transactions or the ability to transfer value between multiple parties.

Banks often apply enhanced due diligence to:

1. Gaming and betting. Risks include numerous deposits and payouts, multiple payment methods, chargebacks and players across several countries.
2. Crypto and virtual asset services. Relevant factors include transfer speed, self-hosted wallets, cross-chain transactions and jurisdictions with limited VASP supervision. Specific measures are outlined in the FATF guidance on virtual assets.
3. Forex, CFDs and investment platforms. Banks examine licences, client-money arrangements, sources of trading volume and liquidity-provider relationships.
4. Payment services and money remittance. These businesses process third-party funds and may serve many senders and recipients whom the bank does not verify directly.
5. Adult entertainment. Relevant issues include AML risk, chargebacks, age verification, content legality and card-scheme rules.
6. Pharmaceuticals and regulated goods. Firms must evidence authorisations, product origin, lawful cross-border sales and end buyers.
7. Charities and non-profit organisations. Donations and transfers to conflict zones or regions with limited financial transparency attract greater scrutiny.

Risk may arise from the operating model rather than the industry itself. A software developer serving a gaming operator has different payment flows and regulatory exposure from a company accepting player bets.

Before bank onboarding, the company should define its role precisely. Describing the business as “IT services” does not reduce risk where its contracts and website show control over payments, customer accounts or a regulated platform. A mismatch between stated and actual activities is more serious than openly identifying a high-risk sector.

How banks assess high-risk customers

The assessment begins before account opening and continues throughout the customer relationship. The bank compares submitted documents with independent sources, expected activity and its restrictions on countries and sectors.

The review usually includes:

1. Identification and verification. The bank confirms the company’s registration details, address, directors, shareholders and ultimate beneficial owners. The ownership structure must be traced to the individuals who ultimately own or control it.
2. Purpose and nature of the relationship. The company explains why it needs the account, which services it provides, where funds originate and who will receive payments.
3. Licensing assessment. The bank verifies required authorisations and whether they cover the actual activity. It also reviews restrictions in target markets.
4. Source of funds and source of wealth. Business funding and owners’ wealth require separate evidence. Its scope depends on the capital structure and risk level.
5. Expected account activity. The banking profile records currencies, monthly turnover, average payment size, key countries and counterparty categories.
6. Sanctions, PEP and adverse media screening. The company, UBOs, management and related parties are screened. A name match requires analysis rather than an automatic conclusion.
7. Ongoing monitoring. Actual transactions are compared with the declared profile. Material deviations may prompt document requests, payment restrictions or a relationship review.

FATF Recommendation 10 requires customer due diligence when establishing business relationships and keeping the information obtained up to date.

Even a complete file does not guarantee approval. A bank may decline a customer if it cannot manage the risk effectively or the model falls outside its risk appetite. Incomplete forms, inconsistent figures and missing agreements will almost always complicate the review.

How regulators approach business risk

A regulator assesses not a customer’s commercial attractiveness but the company’s ability to meet applicable requirements and manage its operational risks. For licensed businesses, ownership, governance, funding sources, target markets and effective internal controls are central.

FATF Recommendation 1 requires a risk-based approach. Countries identify national threats, while regulated entities conduct business-wide risk assessments. These support customer risk categories and proportionate controls.

Regulators generally examine whether:

• The licence covers the actual products and services;
• Shareholders, UBOs and controlling persons are disclosed;
• Source of funds and source of wealth are evidenced;
• Country, customer, product and delivery-channel risks are addressed;
• Competent compliance officers and MLROs are appointed;
• Sanctions, PEP and adverse media screening operates effectively;
• Suspicious transactions are identified and documented;
• Outsourced providers remain under the company’s control.

High inherent risk does not necessarily prevent licensing. The key issue is whether controls reduce it to an acceptable residual level. Serving customers across several countries increases inherent risk, but market restrictions, enhanced KYC and transaction monitoring may make the model manageable.

If controls do not match the scale of operations, the regulator may request further documents, restrict permitted services or refuse authorisation. After approval, oversight continues through reporting, inspections and thematic reviews.

A bank may take a stricter position. A licence confirms regulatory status but does not require a bank to accept the company. The institution conducts its own assessment and may apply a narrower risk appetite than the law requires.

Red flags that trigger enhanced due diligence

Enhanced due diligence usually results not from one indicator but from inconsistencies between documents, the stated business model and actual transactions. The harder it is to explain the source of funds and economic purpose of the structure, the more likely further requests become.

Common red flags include:

1. An ownership chain that does not identify the ultimate individual owner;
2. A nominee shareholder or director without a clear commercial rationale;
3. A UBO lacking proven experience or resources to fund the business;
4. Inconsistencies between the registered address, management location and declared operational presence;
5. A website offering products or serving countries outside the licence;
6. Actual turnover materially exceeding the banking profile;
7. Third-party payments unsupported by agreements or invoices;
8. Rapid transfers through several accounts without an economic purpose;
9. Payment descriptions inconsistent with the company’s activities;
10. Frequent changes to the structure, directors or bank details without a credible explanation.

Difficulty verifying beneficial ownership receives particular attention. FATF guidance requires adequate, accurate and up-to-date information on individuals who ultimately own or control a legal person.

A red flag does not prove misconduct. The bank should request documents, assess the explanation and determine residual risk. It may continue servicing the customer, impose restrictions, enhance monitoring or end the relationship.

The company should provide specific, documented answers. Descriptions such as “intragroup transfer” or “consulting fee” are insufficient without an agreement, invoice, service description and a clear connection to actual business activity.

How to reduce banking and regulatory risk

A company cannot eliminate its industry’s inherent risk, but it can reduce residual risk through a transparent structure and effective controls. Preparation should begin before account opening because changing the model during a bank review often causes further requests and delays.

Practical measures include:

1. Simplifying the ownership structure and explaining each holding company’s function;
2. Documenting the owners’ source of funds and source of wealth;
3. Obtaining licences before starting regulated activities;
4. Defining permitted and restricted markets;
5. Mapping contractual relationships and payment flows;
6. Implementing AML/KYC, sanctions and transaction monitoring procedures;
7. Appointing responsible staff with genuine authority;
8. Conducting due diligence on suppliers and other critical counterparties;
9. Aligning the website, contracts and banking application;
10. Establishing procedures for notifying the bank of material changes.

The company should prepare a consolidated banking file for onboarding. It usually includes corporate documents, an organisational chart, business plan, licences, financial projections, key agreements, UBO information and a description of the compliance framework. Turnover, currencies and payment routes should be supported by calculations rather than broad estimates.

Post-opening controls are equally important. The company should regularly compare actual transactions with its declared banking profile. Entering a new market, adding a payment provider or changing the customer base may require an updated risk assessment and bank notification.

Using several companies and accounts does not solve the problem if payments are divided without a clear commercial reason. It may instead raise concerns about pass-through transactions or concealed activity.

A strong compliance framework cannot guarantee account opening or continued service. It does, however, help the bank understand the model, verify funding sources and assess whether the customer can control its risks.

How Key2Law supports high-risk businesses

Key2Law team helps companies prepare for banking and regulatory reviews based on their industry, operational geography and payment structure. We align corporate documents, licences, contracts and compliance procedures with the actual business model.

The Key2Law team can:

1. Assess factors affecting the banking and regulatory risk profile;
2. Design transparent ownership and operational structures;
3. Identify required licences and target-market restrictions;
4. Prepare the business plan, financial projections and payment-flow description;
5. Organise owners’ KYC and source-of-funds documentation;
6. Develop or update AML/KYC and sanctions procedures;
7. Review agreements with payment, platform and other critical providers;
8. Prepare a complete banking file for account opening;
9. Support responses to bank compliance requests;
10. Establish controls for material changes after onboarding.

We cannot guarantee account opening or require a financial institution to accept a customer. The decision remains with the bank and depends on its risk appetite. Proper preparation instead removes inconsistencies, evidences funding sources and presents the business in a form suitable for a reasoned risk assessment.

If your company operates in gaming, crypto, forex, payments or another closely scrutinised sector, contact Key2Law team before submitting a banking application. We will help identify potential red flags, prepare supporting documents and establish an ongoing compliance process.

_____________________________________________________________________

This article is provided for general informational purposes and does not constitute legal, tax or financial advice. Applicable requirements depend on the jurisdiction and specific circumstances; professional advice should be obtained before making legal or business decisions.