How to Open a Bank Account for a Crypto/VASP Company in 2026

Most founders treat authorisation as the finish line. In practice, the hardest part of running a regulated crypto-asset business is not getting the licence. It is opening, and then keeping, the operating, safeguarding, and inbound-deposit accounts at institutions that will not de-risk the firm twelve months later. A crypto bank account for a VASP is won through preparation, not paperwork alone.

This guide walks through the full path: why banks are wary of crypto, why your licence has to come first, how a bank differs from an e-money institution and a payment institution, how segregated client accounts work, exactly what documents a bank wants to see, and a realistic step-by-step timeline. If you have not yet secured authorisation, start with our guide on how to get a crypto licence, then come back here, because banking should be planned alongside the licence, not after it.

For a working list of the institution categories that actively onboard regulated crypto firms, pair this guide with our crypto-friendly banks guide. Together they cover the strategy and the targets.

Understanding why banks hesitate is the first step to changing the answer. De-banking is rarely about a VASP doing something wrong. It is usually about the bank's risk appetite changing, often for reasons outside the client's control. Three structural pressures drive it.

Correspondent banking exposure. Most banks rely on larger correspondent partners to settle cross-border payments. When a single correspondent line decides crypto is too risky, the smaller bank can be forced to drop its entire crypto portfolio overnight to keep that line open. This happened across the Baltics in 2018 and 2019 and again at several US mid-tier banks in 2023.

Capital charges. Under the Basel framework, operational accounts linked to client crypto proceeds attract conservative risk weights, which raises the capital a bank must hold against the deposit. A low-margin crypto client can therefore consume more balance-sheet capacity than a far larger conventional one.

AML bandwidth. A single crypto-asset service provider can generate several times the suspicious-activity alert volume of an equivalent non-crypto business. For an understaffed compliance team, one VASP can absorb the monitoring capacity of many ordinary clients. Our explainer on AML and KYC shows where that alert load comes from.

The takeaway is that the bank is managing its own supervisory and commercial risk. Your job as a VASP is to make yourself the lowest-friction crypto client a bank could accept, so the risk-appetite calculation lands in your favour.

There is a hard sequencing rule in crypto banking: the licence comes before the account. Tier-1 banks and major payment processors will not open operating or safeguarding accounts for unlicensed crypto businesses, full stop. A valid VASP or CASP licence is a prerequisite, not a differentiator. If you are still defining your model, our overview of the VASP licence sets out what authorisation actually involves.

Just as important, the brand of the licence matters more than its type. A crypto-asset service provider authorisation from a respected EU regulator opens doors that a legacy registration from a lighter-touch jurisdiction does not. Bankers read the issuing regulator as a proxy for supervisory quality, so where you license shapes who will bank you.

This effect is sharpening in 2026. With the EU's older VASP registration regimes sunsetting as MiCA takes hold, banks increasingly treat pre-MiCA registrations as expiring credentials and ask pointed questions about a firm's transition plan. Choosing a durable, well-regarded authorisation is now part of your banking strategy, not just your compliance one.

Crypto banking access is not one product. A resilient VASP combines several account types, each doing a different job. Confusing them is one of the most common and costly mistakes founders make, because an e-money institution and a credit institution are not interchangeable.

A bank, or credit institution, can hold client safeguarding deposits as bank money, issue correspondent banking sponsor letters, and extend treasury and FX lines. It is the slowest to onboard but the strongest relationship. An e-money institution (EMI) is much faster and excellent at issuing virtual IBANs for inbound client deposits and clearing SEPA payments, but it cannot hold MiCA-grade safeguarding deposits the way a bank can, cannot issue correspondent letters, and offers no treasury lines. A payment or specialist institution typically focuses on FX and settlement. Our hub on crypto banking goes deeper on how these licences themselves work.

The practical rule: use an EMI as the rail for inbound client deposits, never as the only banking layer. Safeguarding belongs at a bank.

If your VASP touches client money, segregation is not optional. A segregated client account is a named, ring-fenced account that holds customer funds entirely separate from the company's own operating cash. Under MiCA, crypto-asset service providers must safeguard client funds in exactly this way, and the requirement is one of the first things a bank checks before opening an account behind your licence.

In practice, a safeguarding account is held at a credit institution, distinct from your day-to-day operating bank, and is treated as the customers' property rather than the company's. This is precisely the function an EMI cannot perform under MiCA, which is why the safeguarding layer almost always sits at a bank even when the inbound rail runs through an e-money institution.

The detailed rules show the same pattern worldwide. When Pakistan re-opened banking access for licensed VASPs in 2026, for example, regulators required separate client money accounts that are non-remunerative, prohibit cash deposits and withdrawals, cannot be used as collateral, and must never commingle client and company funds. The labels change by jurisdiction, but the principle, that client money is protected and visibly separate, is now a global baseline.

Onboarding diligence at a crypto-friendly bank looks more like investment-banking due diligence than retail account opening. Expect six to ten weeks of preparation before you even file. The stronger and more complete your pack, the faster the committee can say yes. Banks consistently ask for the following.

Corporate and ownership

A cover memo mapping your services to your licence, a corporate structure diagram showing the full ultimate beneficial owner chain with any nominees disclosed, and audited financial statements. Undisclosed offshore entities in the structure are a fast route to decline.

AML programme and the MLRO

A detailed, crypto-specific AML programme covering transaction monitoring and typologies, plus governance: a regulator-approved Money Laundering Reporting Officer, an independent compliance officer, and resident directors where the licence requires them. Banks inherit their clients' AML risk, so they need to see that you will catch and report suspicious activity before it reaches their books. Our AML and KYC service builds this end to end.

Vendors and source of funds

Named contracts with a blockchain analytics provider and a Travel Rule provider, not in-house promises. A twelve-month customer-geography and volume forecast. And source-of-funds evidence: bank statements and records proving where operating capital came from, confirming it is not tied to undisclosed entities or sanctioned parties.

From first pitch to a funded operating account, a Tier-1 EEA bank typically takes four to seven months, with diligence alone running eight to sixteen weeks. The five stages below describe the path. Warm introductions consistently beat cold applications, which banks tend to deprioritise. Need help with the introductions and the file? Talk to our team.