Your business can be completely legal, profitable and tax-compliant, and still be classified as high risk by a bank.
High risk does not mean criminal.
A high-risk client may still be accepted, but the onboarding will usually take longer, require more evidence and documents and involve closer and more frequent monitoring once the relationship is established.
“But everything I do is legal. Why is Compliance asking me all this?”- is a typical question from a client who is not familiar with modern compliance requirements and protocols.
Compliance requirements in the European Union are highly stringent, complex, and comprehensive, particularly for licensed financial institutions. Such institutions are subject to extensive regulatory obligations and rigorous compliance standards designed to ensure transparency, integrity, and effective risk management.
Banks and payment institutions are required to conduct appropriate customer due diligence by assessing each client and identifying and evaluating the risks associated with the customer and the nature of the business relationship. The level and extent of KYC and ongoing monitoring measures should be proportionate to the level of risk identified.
Higher-risk customers are therefore subject to enhanced due diligence and more stringent monitoring, while lower-risk customers may be subject to simplified measures, where permitted by the applicable regulatory framework.
Amongst other things, banks need to understand:
- who ultimately owns and controls the business;
- how the beneficial owner accumulated their wealth;
- where the money entering the account comes from;
- why funds move through particular countries and counterparties;
- whether the expected transactions make commercial sense.
There Is No Single Definition of a “High-Risk Client”
There is no universally applicable definition or fixed set of criteria that automatically determines whether a client should be classified as “high risk.” While regulatory frameworks establish general risk factors and minimum requirements that financial institutions must consider, the assessment of a client’s overall risk is ultimately based on the institution’s own risk-based approach, policies, procedures, and risk assessment methodology.
Banks, payment institutions, corporate service providers, and other regulated entities typically develop and maintain their own customer risk-rating models. These models may take into account a combination of factors, including the customer’s identity and background, country of residence or incorporation, nature of business activities, ownership and control structure, source of funds and wealth, expected transaction activity, delivery channels, geographic exposure, and any relevant adverse information or sanctions-related concerns.
As a result, the same customer may receive different risk classifications from different institutions.
Which individuals may be treated as higher risk?
Politically exposed persons
Politically exposed persons, commonly known as PEPs, receive enhanced scrutiny because their position may expose them to corruption, bribery or misuse of public funds. The same applies to certain family members and known close associates.
Being a PEP does not mean that the person has done anything wrong. It does mean that the institution will normally ask for more information, including stronger evidence of source of wealth and source of funds, and may require senior management approval.
Clients with high-risk geographical connections
Compliance does not look only at a passport. It may consider the client’s citizenship, residence, place of business, source of wealth, bank accounts, major customers, suppliers and countries through which payments will pass.
Connections to countries subject to sanctions, serious corruption concerns, weak beneficial ownership transparency or strategic AML deficiencies will increase scrutiny. Even if the client lives in the EU, income earned or funds held in a higher-risk jurisdiction increases the level of risk.
Clients whose wealth is difficult to verify
High net worth is not automatically high risk. Unexplained wealth is.
Problems arise when the declared financial position does not match the person’s professional history, tax records, company accounts or supporting evidence. Sudden wealth, large undocumented loans, informal family transfers and income received through multiple companies will usually trigger further questions.
Clients linked to adverse media or regulatory concerns
Reliable reports involving fraud, corruption, tax crime, sanctions evasion, organised crime, insolvency abuse or financial misconduct can materially affect a client’s risk rating, even where there has been no conviction.
Compliance should assess the credibility, seriousness and relevance of the information. An old minor allegation should not be treated in the same way as recent, repeated reporting from reliable independent sources. The FIAU expressly expects this distinction to be made.
Clients who are inconsistent or unwilling to cooperate
Sometimes the main risk is not the industry or country. It is the client’s behaviour.
Changing explanations, missing documents, unexplained urgency, reluctance to identify counterparties or refusal to disclose the true beneficial owner are serious red flags.
Which corporate structures might be seen as high risk?
Complex ownership without a clear commercial reason
A holding company, trust, foundation or multi-level international structure can be entirely legitimate. Complexity becomes a problem when nobody can clearly explain why each entity exists, who controls it and how money moves through the group.
Regulators treat opaque and complex structures without legitimate justification as a higher-risk factor. Multiple ownership layers and undisclosed nominee arrangements can be used to obscure beneficial ownership.
Companies with limited operational substance
A registered office and incorporation certificate do not prove that a real business exists.
Banks may ask where management decisions are made, who performs the work, where employees or contractors are based, where contracts are negotiated and why the account is needed in that particular jurisdiction.
A Malta company with no clear connection to Malta, no operational resources and no convincing commercial purpose may face a difficult onboarding.
Newly incorporated or previously dormant companies expecting large volumes
A new company projecting substantial turnover is not automatically problematic, but the figures must be credible. Compliance will compare expected activity with the owners’ experience, available capital, signed contracts, team, website and operating model.
Sudden activity in a company that has been dormant for years also requires a clear explanation.
Companies used mainly to receive and forward funds
Banks pay close attention to pass-through activity: money enters the account and is quickly transferred elsewhere, while the company retains only a small margin.
This may be commercially normal for a trading company, agent or marketplace. However, the institution will need to understand the company’s exact role, pricing model, contractual responsibility and relationship with each side of the transaction.
Structures involving third-party funding or payments
Payments made by or to persons who are not parties to the underlying contract are a common red flag.
The same applies where shareholders, related companies or “business partners” fund operations without documented loans, capital contributions or commercial agreements. Supporting documentation for all transactions is extremely important for the banks.
Which business activities are commonly treated as higher risk?
The following sectors and industries are often seen as high risk:
Financial and transaction-heavy activities
- payment services, money remittance and foreign exchange;
- fintech, crowdfunding and certain lending models;
- crypto-assets and virtual asset services;
- gambling and gaming;
- businesses handling client money or processing payments for third parties.
- Oil, gas sector
- Trading in precious metals
- Trading in weapons and ammunition
- Adult entertainment services
Cash-intensive and high-value sectors
- hospitality, retail and other businesses receiving substantial cash;
- construction and certain property-related activities;
- precious metals and stones;
- luxury goods, art and high-value vehicles;
- real estate investment and development.
Cross-border trade and sensitive goods
- international trading and trade finance;
- commodities, mining and extractive industries;
- shipping and businesses using complex logistics routes;
- arms, defence products and dual-use goods;
- trade involving sanctioned or higher-risk markets.
In these sectors, banks often need to review the goods, shipping route, end user, counterparties and purpose of the transaction, not merely the invoice.
Business models that are difficult to evidence
Consulting, online marketing, software licensing, IP structures, affiliate models, dropshipping and intermediary services are not automatically high risk.
The difficulty is that the service can be intangible and the commercial value harder to verify.
A consulting company earning millions from several countries, with no employees, generic contracts and payments from unrelated third parties, will be difficult to explain even if “consulting” itself is perfectly legal.
Charities and cross-border non-profit activity
Charitable and non-profit organisations may receive closer scrutiny when collecting funds internationally or sending money to conflict areas and higher-risk jurisdictions.
The concern is possible misuse, not the legitimate purpose of the organisation.
Geographical Risk
Geographical risk should not be assessed solely by reference to the country in which a company is incorporated. A comprehensive geographical risk assessment should consider the broader geographic footprint of the customer, its beneficial owners, business activities, sources of funds and wealth, counterparties, and transactional relationships.
At the time of writing, August 2026, the FATF jurisdictions subject to a call for action are the Democratic People’s Republic of Korea, Iran and Myanmar.
FATF also maintains a separate list of jurisdictions under increased monitoring, commonly called the grey list.
The EU maintains its own list of high-risk third countries. The EU and FATF lists are not identical and do not always change at the same time.
For example, Russia entered the EU list on 29 January 2026. Bolivia and the British Virgin Islands were added at the same time.
Banks may also use sanctions lists, national risk assessments, corruption indicators and their own internal country classifications. A country’s absence from a public high-risk list does not automatically make every connection to it low risk.
What happens when a client is classified as high risk?
Usually, the institution applies enhanced due diligence. This may include:
- additional identification and corporate documents;
- deeper verification of source of wealth and source of funds;
- detailed information on customers, suppliers and payment routes;
- enhanced transaction monitoring and requests for supporting documents.
High-risk status should not automatically lead to rejection.
However, if the particular risk or combined risk is outside the institution’s risk appetite, it may still refuse or terminate the relationship. This is why the same client may be accepted by one bank and declined by another.
What other red flags a compliance team would be cautious about?
- a vague business description or generic website;
- expected turnover that does not match the team, capital or track record;
- invoices with descriptions such as “consulting services” and no supporting detail;
- payment routes that do not match the stated business model;
- frequent third-party payments;
- rapid movement of funds with little commercial value retained by the company;
- unexpected cash or crypto exposure;
- constant changes to the explanation provided during onboarding;
- documents produced only after repeated requests and contradicting earlier information.
How to make your onboarding with the bank smooth?
The best time to prepare for Compliance is before the application is submitted.
Start with a clear file containing:
- A short and specific explanation of the business model or a business plan
- A complete ownership chart showing every level up to the ultimate beneficial owners.
- Evidence of source of wealth and the source of funds to be used.
- Expected account activity, including volumes, currencies, countries and main counterparties.
- Contracts, invoices, licences and proof of previous trading history.
- Evidence of operational substance and the commercial reason for the chosen structure.
- A transparent explanation of any PEP status, adverse media, sanctions exposure or unusual transaction pattern.
Do not try to disguise anything from the bank. It is always better to give information to the bank yourself, than them finding out later and asking the obvious question: why haven’t you informed us about it?
If your profile includes a complex ownership structure, sensitive jurisdiction, regulated activity, crypto exposure, international trading or an unusual source of wealth, review it before approaching a bank or service provider.
At 1st Step Solution, we assess the structure from a practical compliance perspective, identify the points likely to trigger questions, help to prepare all documents and assist with approaching the financial institutions that we know would be the best fit for a particular client.