A high-risk merchant account is a payment setup for businesses exposed to elevated fraud, chargeback, regulatory, AML, reputational, or prohibited-flow risk. In crypto and iGaming, this means that a bank, acquirer or PSP does not assess only the website, turnover and product category. It reviews licensing status, ownership, source of funds, transaction monitoring, card-scheme rules, MCC, chargeback controls, player or customer geography and compliance maturity. This guide is written for crypto exchanges, OTC desks, gambling operators, wallets, crypto payment providers and hybrid fiat/crypto businesses preparing for merchant onboarding in 2026.

For these sectors, payment infrastructure is often as important as licensing. A company may have a crypto license, gambling license or legal opinion, but still fail PSP onboarding if the transaction flow is unclear or the target markets are restricted. Banks and acquirers want to understand who the merchant is, what activity is processed, where customers are located and how financial crime, fraud and consumer complaints are controlled. The practical goal is not to “get any account”, but to build a payment setup that can survive due diligence, monitoring and scaling.

Why crypto and iGaming merchants are treated as high risk

Crypto and iGaming merchants are treated as high risk because several risk categories overlap. Both industries commonly involve cross-border transactions, online customer onboarding, fast settlement, complex ownership structures and sensitive regulatory questions. iGaming adds gambling restrictions, bonus abuse, affiliate traffic, responsible gambling and chargeback exposure. Crypto adds digital-asset flows, wallet screening, sanctions exposure, blockchain analytics and travel rule readiness.

This does not mean that every crypto or gambling merchant is unacceptable. It means that the provider needs more evidence before opening and maintaining the account. A well-prepared merchant can often explain the risk in a structured way. A weak merchant account crypto or gambling application usually fails because it leaves the PSP guessing.

Regulatory risk

Regulatory risk is the first concern. A PSP will ask whether the merchant is licensed, registered, exempt, or operating under a defensible legal opinion. It will also ask whether the license actually matches the processed activity. A gambling merchant account for an offshore casino is different from a payment account for a licensed local operator. A crypto exchange is different from a software-only wallet or a token information platform.

Target-market legality is equally important. A merchant may be licensed in one jurisdiction but still prohibited from targeting players or customers in another. Banks and PSPs do not want to process restricted flows that create enforcement risk. This is why a target-market memo can be as important as the license certificate.

AML and source-of-funds risk

Crypto and iGaming both create AML concerns because funds may move quickly, across borders and through multiple payment methods. In crypto, the PSP may ask about blockchain analytics, source of funds, sanctions screening and exposure to mixers, darknet markets or high-risk wallets. In iGaming, the provider may ask about player KYC, affordability signals, suspicious betting patterns and withdrawal controls. The merchant must show that AML is operational, not just written in a template.

Source of funds also applies to the company itself. PSPs examine shareholders, UBOs, directors and group funding. If the merchant cannot explain how the business is financed, due diligence may stop before product review begins. Opaque ownership is a major rejection factor.

Chargeback and fraud risk

Chargebacks are a central concern for high-risk payment processing. iGaming merchants may face disputes connected with bonuses, withdrawals, self-exclusion, unauthorized transactions, or unclear terms. Crypto merchants may face disputes where customers claim they did not understand conversion, settlement, or irreversible crypto transfers. If the provider expects high dispute levels, it may reject the application or impose rolling reserves.

Fraud risk also depends on the merchant’s controls. Banks and PSPs want to see fraud tools, velocity limits, device checks, account monitoring and a clear dispute workflow. A merchant with no chargeback history may still be considered risky if the product design encourages disputes. A merchant with processing history should prepare clean ratios and explanations for spikes.

Reputational and card-scheme risk

Card schemes, acquirers and PSPs protect their payment networks from illegal, misleading or reputationally harmful activity. Crypto and gambling are not automatically prohibited, but they are monitored closely. A merchant may be rejected if the website suggests anonymous payments, illegal gambling, misleading bonuses, fake licensing claims or prohibited jurisdictions. MCC classification, descriptor accuracy and transaction transparency matter because they show what is really being processed.

Public complaints also shape reputation. If players cannot withdraw winnings or crypto customers cannot access funds, PSPs may treat the merchant as a complaints risk. The provider wants to avoid becoming the payment channel for a problematic business. Clear terms, support processes and withdrawal rules reduce that risk.

What banks and PSPs check before approval

A high-risk merchant account application is not a generic onboarding form. It is a practical due diligence file. The provider wants to understand the legal status, business model, ownership, website, customer journey, transaction flow, and compliance controls. The stronger the file, the less time is spent answering repeated questions.

The review usually combines KYB, AML, underwriting, technical and commercial checks. Different providers ask different questions, but the logic is similar. They need enough evidence to justify onboarding the merchant internally. If the business model is high risk, the documentation must be stronger than for a normal e-commerce merchant.

Licensing and target-market legality

The provider checks the license certificate, regulator, permitted activities, license expiry date and target countries. For iGaming payment processing, this includes whether the gambling license covers casino, sportsbook, B2B, white-label or crypto gambling activity. For crypto merchants, it includes whether the business is a licensed or registered exchange, broker, wallet, payment provider or other regulated entity. If the merchant relies on a legal opinion, the opinion must be current and specific.

Target markets are often the real issue. A license from one country does not permit processing from every country. PSPs may ask for a list of accepted, restricted and blocked jurisdictions. Geoblocking and customer-location controls should match that list.

Corporate structure and UBO transparency

The KYB pack must explain who owns and controls the merchant. PSPs review incorporation documents, shareholder registers, UBO passports, proof of address, group charts, director CVs and source-of-funds evidence. If the structure includes offshore companies, trusts, nominees or recent ownership changes, extra questions should be expected. A complex structure is not automatically a problem, but it must be explainable.

UBO transparency is especially important for high-risk sectors. Banks and PSPs want to know whether owners have relevant experience, regulatory history or sanctions exposure. They may also review previous brands, disputes, insolvencies or license actions. A founder should prepare this before approaching providers.

Website, terms, refund and complaints policies

The website is part of the due diligence file. Providers check whether the site shows the correct legal entity, license details, terms, privacy notice, refund or withdrawal rules and complaints process. They also check whether marketing claims match the license scope. If the site promises “anonymous betting” or “instant crypto cashout” without controls, the application may be rejected.

Refund and complaints policies are particularly important for gambling merchant account applications. Players need clear rules on deposits, bonuses, withdrawals and account closures. Crypto merchants need clear risk disclosures on volatility, settlement and irreversible transactions. Ambiguous terms often lead to disputes.

AML/KYC procedures and transaction monitoring

A PSP will expect AML/KYC procedures that match the merchant’s risk profile. For crypto, this may include wallet screening, sanctions screening, blockchain analytics, transaction monitoring and travel rule processes where applicable. For iGaming, this may include age verification, player KYC, risk scoring, responsible gambling triggers and suspicious-activity escalation. The provider may also ask who owns compliance internally.

A template policy is not enough. The merchant should show how customers are screened, when enhanced due diligence applies and what happens when alerts appear. Transaction monitoring should cover both fiat and crypto flows where relevant. The process must be documented and operational.

Processing history, chargeback ratio and fraud tools

If the merchant has processing history, the provider will request statements, chargeback ratios, refund levels, decline rates and fraud reports. If the merchant is new, it may ask for projections, expected average ticket size, monthly volume and risk assumptions. High-risk providers may start with lower limits and increase them after stable processing. This is normal and should be expected.

Fraud tools should match the channel. Useful controls may include device fingerprinting, velocity checks, IP analysis, BIN controls, suspicious login detection and manual review. iGaming operators should also show controls around bonus abuse and multiple accounts. Crypto merchants should show controls around suspicious wallets and high-risk counterparties.

MCC, descriptor, geographies and prohibited flows

MCC and descriptor accuracy are critical. The MCC should reflect the real merchant activity, and the descriptor should help customers recognize the transaction. Misclassification can create scheme, acquirer and dispute risk. If a merchant processes gambling or crypto flows under a misleading category, the provider may terminate the account.

Prohibited flows must also be mapped. These may include sanctioned countries, blocked player markets, anonymous transactions, third-party payments, or activity outside the license. A provider may ask for a flow-of-funds diagram to confirm that processed transactions match the approved model. Hidden crypto conversion or undisclosed offshore settlement is a major red flag.

High risk merchant account approval checklist

The table below shows the core areas banks and PSPs usually check before approving a high-risk merchant account for crypto or iGaming. It can also be used by legal, sales, and compliance teams before contacting payment providers. The goal is to reduce avoidable friction and identify gaps before the underwriter does. A complete file does not guarantee approval, but it improves the quality of the review.

This checklist should be adapted to the product. A crypto exchange will need more technical and blockchain-monitoring evidence than a standard merchant. A sportsbook will need stronger player, bonus, and affiliate controls. A hybrid crypto casino may need both sets at the same time.

Crypto merchant account readiness checklist

A crypto merchant account review starts with the exact activity. Crypto payments, crypto exchange, brokerage, custodial wallet, OTC desk, fiat ramp and token sale are not the same risk. A merchant account is not a substitute for a crypto license or registration. It is a payment layer that must fit the legal and operational structure.

The merchant should explain whether it receives fiat, receives crypto, converts assets, holds customer funds, or only provides technology. It should also explain whether the customer is retail, institutional or merchant-facing. These facts determine how the PSP views the risk. They also determine which documents should be prepared first.

Crypto licensing or registration evidence

If the business is regulated, the merchant should provide the license or registration evidence. If it is outside scope, it should provide a legal opinion explaining why. The document should identify the entity, services, jurisdiction, target customers and limitations. A generic statement that “crypto is not regulated here” is usually not enough.

The provider will also check whether the license covers the processed activity. For example, a VASP or CASP permission for one service may not cover fiat payment processing or token issuance. If fiat rails are involved, payment-services analysis may also be needed. Licensing and payment architecture should be reviewed together.

Blockchain analytics and travel rule readiness

Crypto merchants should be ready to explain blockchain analytics. PSPs may ask how the merchant screens wallets, identifies high-risk exposure and escalates suspicious transactions. They may also ask about travel rule readiness where the merchant is a VASP or deals with regulated virtual-asset transfers. This is especially relevant for exchanges, custodians and transfer services.

The merchant should also explain vendor selection. If it uses a blockchain analytics provider, it should show how alerts are handled. If it performs screening manually, the process should be documented. A provider will not accept “we check wallets when needed” as a mature control.

Wallet screening and transaction risk scoring

Wallet screening should cover deposits, withdrawals and high-risk events. Risk scoring may consider sanctions exposure, darknet markets, mixers, stolen funds, fraud clusters, high-risk exchanges and unusual transaction patterns. The merchant should define when a transaction is blocked, delayed or escalated. The policy should match the real customer journey.

For custodial or OTC models, source-of-funds review is also important. Large transactions, new wallets and complex chains may require enhanced due diligence. The merchant should show who reviews these cases and how decisions are recorded. This reduces uncertainty during underwriting.

Stablecoins, conversions and settlement risk

Stablecoins can reduce price volatility, but they do not remove regulatory or AML risk. PSPs may ask who issues the stablecoin, where redemption occurs, who handles conversion, and whether the flow resembles money transmission or payment services. They may also review liquidity providers and settlement accounts. If the merchant settles merchants or customers in fiat, additional payment licensing questions may appear.

Conversion risk should be transparent. Hidden crypto-to-fiat conversion is a common rejection reason. The flow diagram should show where conversion happens, who owns the assets at each point, and which counterparties are involved. A clean diagram can prevent many PSP questions.

Gambling merchant account readiness checklist

A gambling merchant account review depends on license, player geography, responsible gambling, age verification, affiliate traffic, chargeback management, and prohibited jurisdictions. PSPs know that iGaming can produce complaints, disputes and regulatory exposure. They therefore review the operating model more deeply than a normal digital service. Good documentation can make the review faster and more predictable.

The merchant should prepare both legal and operational evidence. A license certificate alone is not enough. The PSP wants to know who the players are, where they are located, how they are verified and how withdrawals are handled. It also wants confidence that the operator does not target prohibited markets.

Gambling license and permitted markets

The merchant should provide the gambling license, license scope, permitted verticals and target-market memo. The memo should list accepted, restricted and prohibited countries. It should also explain geoblocking, advertising restrictions and affiliate controls. If the license is offshore, the target-market review becomes especially important.

A PSP may reject a merchant if the license is weak or does not match the player geography. For example, an offshore license may not support UK, EU or other locally regulated markets. The provider does not want to process flows that create enforcement exposure. Operators should verify this before investing in traffic.

Player KYC, age verification and responsible gambling

Player verification is a central control. Operators should show how age, identity and location are verified before play or withdrawal, depending on the applicable rules. Responsible gambling controls should include limits, self-exclusion, monitoring, customer interaction and escalation processes. These controls are also important for reputation and complaint reduction.

The PSP may ask whether high-risk players are reviewed. It may also ask how the operator identifies unusual deposits, rapid losses or risky betting patterns. Responsible gambling is not only a regulator issue; it also affects payment risk. Poor controls can lead to complaints and disputes.

Bonus rules, withdrawals and complaints

Bonuses are a common source of chargebacks and complaints. The merchant should make wagering requirements, withdrawal limits, bonus restrictions and account closure rules easy to understand. If customers feel misled, disputes increase. PSPs often review these terms before approving a merchant.

Withdrawal policy is equally important. Operators should not delay withdrawals because KYC was ignored earlier. If additional checks may be required, the rules should be clear and legally justified. A fair complaints process supports both compliance and payment stability.

Affiliate traffic and geoblocking controls

Affiliates can create serious risk if they bring traffic from prohibited markets or use misleading advertising. Operators should maintain affiliate terms, monitoring, approval workflows and enforcement rights. They should also review landing pages and promotional claims. A PSP may ask how the operator controls third-party marketing.

Geoblocking should be more than a checkbox. The operator should use IP checks, document checks, payment method controls, and manual review where needed. If the business relies heavily on affiliate traffic, these controls become even more important. Uncontrolled acquisition channels can undermine the entire merchant application.

Why merchant account applications get rejected

Most rejections are predictable. A merchant either cannot prove legal status, cannot explain ownership, cannot control target markets, or cannot show mature AML and dispute processes. Sometimes the product itself is acceptable, but the documentation is not. In other cases, the jurisdiction, activity, or customer geography falls outside the provider’s risk appetite.

The best response is preparation, not pressure. A founder should not send incomplete applications to many providers at once. This can create a negative history and inconsistent disclosures. A better approach is to build one strong file and match it with providers that actually support the sector.

Weak or mismatched license

A license is weak if it is expired, unverifiable, issued by an unclear authority, or unrelated to the processed activity. It is mismatched if the merchant processes crypto exchange but holds only a general company registration, or targets gambling markets not covered by its license. PSPs are likely to reject such cases. Legal status should be checked before the application is submitted.

Hidden UBOs or unclear source of funds

Opaque ownership is a major red flag. PSPs may reject structures involving unexplained nominees, undisclosed controllers, complex offshore chains, or unclear source of wealth. The merchant should prepare a clean ownership chart and evidence of funding. If the UBO story is incomplete, the provider may not continue the review.

Uncontrolled affiliates and misleading advertising

Advertising risk is especially relevant for iGaming and crypto investment-like products. Affiliates may promise bonuses, returns or market access that the merchant cannot lawfully provide. PSPs may review ads, landing pages and affiliate terms. Misleading claims can create consumer complaints and card-scheme concerns.

High chargebacks or poor refund process

High chargebacks show that customers are unhappy, confused, or possibly fraudulent. A poor refund or withdrawal process makes the problem worse. PSPs may impose reserves or reject the merchant entirely. The merchant should prepare dispute data, root-cause analysis and remediation measures.

Targeting blocked countries

Targeting blocked countries is one of the fastest ways to fail underwriting. The provider may compare traffic, player data, website language, payment methods, and affiliate sources with the permitted country list. If the merchant claims to block a market but public advertising says otherwise, the application loses credibility. Legal and marketing teams should align before submission.

No documented AML or transaction monitoring

A merchant with no documented AML or transaction monitoring will struggle in crypto and iGaming. PSPs expect risk assessment, customer screening, sanctions controls, and escalation procedures. The program does not need to be unnecessarily complex, but it must match the business. A policy that no one implements is not enough.

Documents to prepare before applying to a PSP

A strong PSP pack saves time for the merchant and the provider. It should be organized, consistent, and easy to review. Sales teams should not send partial documents while legal and compliance are still building the story. The provider should see a coherent business, not fragments.

The pack should be updated before each application. If the website, license, countries, or payment flows have changed, the documents should change too. Inconsistency is often treated as a risk signal. Preparation is especially important for startups with no processing history.

Corporate and ownership pack

This pack should include incorporation documents, good standing certificate, group chart, shareholder register, director and UBO documents, proof of address, source-of-funds evidence and company profile. It should also include licenses or registrations of group entities where relevant. The goal is to show who owns, controls and finances the business. A clean KYB file is the base layer of payment onboarding.

License and legal opinion pack

This pack should include license certificates, regulator links, permission scope, renewal status and legal opinions. For crypto, it may include VASP, CASP, MSB or other license evidence. For iGaming, it may include operator, supplier, white-label or B2B permissions. The legal opinion should address target markets and processed activities.

AML/KYC and sanctions pack

This pack should include AML/KYC policies, sanctions policy, risk assessment, monitoring procedure, escalation workflow, and responsible compliance officer details. Crypto merchants should add blockchain analytics and wallet screening procedures. iGaming merchants should add player KYC and responsible gambling documents. The PSP should understand how suspicious activity is detected and handled.

Website compliance pack

This pack should include terms and conditions, a privacy policy, a refund or withdrawal policy, a complaints process, a prohibited country list, and a responsible gambling page where relevant. Screenshots may help if the website is not yet public. The legal entity and license information should be visible and accurate. The website should not overpromise services.

Processing, fraud and chargeback pack

This pack should include current or projected volumes, average transaction value, payment methods, historical processing statements, chargeback ratios and fraud tools. If the merchant had previous issues, it should explain what happened and what changed. A transparent remediation story is better than hiding problems. PSPs value merchants that understand their own risk.

Payment architecture options for crypto and iGaming

A merchant account is only one layer of payment infrastructure. The full architecture may include an acquiring bank, PSP aggregator, payment gateway, crypto payment provider, EMI or PI rails, settlement accounts, reserve accounts and monitoring tools. The right structure depends on jurisdiction, activity, currencies, customer countries and risk appetite. A business may need several providers to support different flows.

Payment architecture should be designed before launch. If the model requires crypto conversion, fiat settlement, player withdrawals and cross-border processing, the legal and technical flow must be mapped. Payment partners should not discover hidden elements after onboarding. That usually leads to freezes or termination.

Direct acquiring vs PSP aggregator

Direct acquiring can provide stronger control and clearer relationships, but it is harder for high-risk merchants to obtain. PSP aggregators may be more accessible and faster, but they add another risk layer and may have stricter internal rules. Some merchants start with an aggregator and later move to direct acquiring. The right route depends on maturity, volume, licensing and risk profile.

Fiat-only vs crypto-enabled flows

Fiat-only flows are not automatically low risk, especially in gambling. However, crypto-enabled flows add wallet, conversion and sanctions questions. A crypto merchant account may require blockchain monitoring, conversion records and clearer settlement controls. Hybrid models should show exactly where fiat becomes crypto and where crypto becomes fiat.

EU, UK, US vs offshore processing

Processing geography matters. EU, UK and US providers often apply stricter regulatory and card-scheme controls. Offshore providers may accept higher-risk models but can be more expensive or less stable. The merchant must match customer geography with provider capability. A provider that accepts the merchant technically may still be unsuitable for long-term scaling.

Reserve, rolling reserve and settlement delays

High-risk merchants should expect reserves and settlement delays. A rolling reserve protects the provider against chargebacks, refunds, fraud and regulatory issues. The percentage and duration depend on risk, volume and history. Operators should model cash flow with reserves included, not treat them as a surprise.

How Manimama helps prepare high-risk merchants for PSP onboarding

Manimama helps crypto and iGaming businesses prepare for PSP onboarding by reviewing the legal, compliance and payment structure before the application. The focus is not on promising approval, but on reducing avoidable friction. A provider’s decision remains independent and depends on its risk appetite. However, a well-prepared merchant can present a stronger and more coherent case.

Support may include licensing assessment, payment flow review, AML/KYC documentation, legal opinions, terms and policies, source-of-funds documentation, website compliance, and PSP communication support. For wider payment infrastructure support, see Manimama’s payment services page. For iGaming compliance, Manimama’s iGaming legal support and AML requirements for casinos and online gambling operators may also be relevant.

Licensing and regulatory assessment

Manimama can assess whether the merchant’s license, registration or legal opinion matches the processed activity. This may include crypto licensing, gambling licensing, payment services and target-market review. If gaps exist, the business can address them before PSP submission. This is usually easier than explaining them after rejection.

Payment flow and prohibited-flow review

The team can map fiat and crypto flows, settlement, conversion, merchant category, customer geography, and prohibited flows. This helps identify hidden risks before the provider does. It also creates a clearer explanation for underwriters. A flow map is often one of the most useful onboarding documents.

AML/KYC, terms and website compliance

Manimama can prepare or review AML/KYC policies, sanctions procedures, responsible gambling documents, terms, privacy, complaints, and refund or withdrawal policies. These documents should match the real product and website. If the website says one thing and the policies say another, the PSP may reject the case. Consistency is critical.

PSP communication support

The application process often involves detailed follow-up questions. Manimama can help prepare answers, organize documents, and explain the legal structure. This support is especially useful for crypto, iGaming and hybrid businesses with multiple jurisdictions. The goal is to make the provider’s review easier and reduce avoidable misunderstandings.

FAQ

What is a high-risk merchant account?

A high-risk merchant account is a payment account for businesses that create elevated regulatory, chargeback, fraud, AML or reputational risk. Crypto and iGaming are often treated as high risk because they involve cross-border payments, restricted products, online onboarding and complex transaction flows. Approval depends on the provider’s risk appetite and the merchant’s documentation.

Why are crypto and iGaming businesses considered high-risk by PSPs?

They are considered high-risk because of licensing complexity, AML exposure, customer geography, chargebacks, fraud, sanctions, wallet screening, gambling restrictions and reputational concerns. PSPs also review card-scheme rules, MCC classification, descriptors and prohibited flows. A strong compliance file can reduce friction, but it does not guarantee approval.

What documents do PSPs request before approving a merchant account?

PSPs commonly request corporate documents, UBO/KYB files, a license or legal opinion, a target-market memo, AML/KYC policies, sanctions procedures, website terms, refund or withdrawal policy, processing history, chargeback data, and flow-of-funds diagrams. Crypto merchants may also need blockchain analytics evidence. iGaming merchants may need responsible gambling and age-verification controls.

Can a crypto business get a merchant account without a crypto license?

It depends on the business model, jurisdiction, and provider risk appetite. A software-only or non-custodial product may rely on a legal opinion if it is outside licensing scope. A crypto exchange, broker, OTC desk or fiat ramp will usually face licensing or registration questions. A merchant account should not be treated as a substitute for required authorization.

What chargeback ratio is dangerous for iGaming merchants?

There is no universal safe number because acquirers, PSPs and card schemes use their own monitoring rules. In practice, rising dispute ratios, repeated player complaints, bonus abuse or unclear descriptors can trigger reserves, limits or termination. iGaming merchants should track chargebacks monthly and prepare root-cause analysis before problems escalate.

How can a business improve approval chances with banks and PSPs?

A business can improve its position by preparing a complete due diligence pack before applying. This includes license evidence, target-market analysis, ownership documents, source-of-funds evidence, AML/KYC policies, website compliance, chargeback controls and a clear payment-flow map. It should also approach providers that actually support crypto or iGaming, rather than sending generic applications.

Conclusion

A high-risk merchant account for crypto or iGaming is not just a payment tool. It is a due diligence process that tests whether the business is licensable, bankable and operationally controlled. Banks, acquirers and PSPs check licensing, target markets, ownership, source of funds, AML/KYC, chargebacks, fraud tools, MCC, descriptors, website compliance and prohibited flows. A license may help, but it does not guarantee onboarding.

The strongest approach is to prepare before launch or scaling. Crypto and iGaming merchants should map payment flows, verify target-market legality, align the website with the license, document AML controls and build a PSP-ready file. Manimama can help assess the legal and compliance position, prepare the documentation and support communication with payment providers before avoidable issues block onboarding.

Our Contacts

If you would like to become our client or partner, please do not hesitate to contact us at support@manimama.eu.

Alternatively, you can use our Telegram @ManimamaBot, and we will respond to your inquiry.

We also invite you to visit our website.

Join our Telegram to receive news in a convenient way: Manimama Legal Channel.

This is a general guide and not a substitute for professional legal or tax advice. Please consult qualified specialists.