Glossary

The language of
high-risk banking.

169+ terms covering licences, regulators, AML/KYC, payment processing, crypto, corporate structures, and trade finance. No jargon, no fluff.

A–ZA B C D E F G H IJK L M N O PQR S T U V WXYZ

§01 · Licences & regulators

Licences & regulators.

The agencies that licence high-risk operators and the international bodies whose rules banks enforce.

22 terms

MGAMalta Gaming Authority: The MGA is Malta's gambling regulator and the gold-standard licence for European iGaming operators. An MGA licence opens doors to most EU-licensed banks and EMIs that engage with iGaming, and is the benchmark most banking partners reference when evaluating licensed gambling clients.
UKGCUK Gambling Commission: The UKGC regulates all gambling activity in Great Britain, from online casinos to lotteries. A UKGC licence is one of the most demanding in the world and is required to accept UK-resident players, with strict rules on marketing, affordability checks, and player protection.
Curaçao eGaming: Curaçao eGaming offers the cheapest and fastest-issued iGaming licence, historically issued under four master licences. Following the 2024 LOK reform, licences are now issued directly by the new Curaçao Gaming Authority (CGA), tightening AML and player-protection requirements.
Kahnawake Gaming Commission: A First Nations gambling regulator based in the Kahnawake Mohawk territory in Quebec, Canada, operating since 1999. It licences online casinos, poker rooms, and sportsbooks aimed primarily at North American markets where US-state-level licensing is impractical.
CySECCyprus Securities and Exchange Commission: CySEC regulates investment firms, forex brokers, and crypto-asset providers in Cyprus. It is one of the most popular EU jurisdictions for licensing forex and CFD brokers due to relatively accessible capital requirements and EU-passporting rights under MiFID II.
FCAFinancial Conduct Authority: The FCA is the UK's financial conduct regulator overseeing banks, EMIs, payment institutions, and crypto-asset firms. FCA authorisation is a high bar and is widely respected internationally, but the FCA has tightened its stance on high-risk verticals including crypto since 2020.
ASICAustralian Securities and Investments Commission: ASIC regulates financial services, markets, and corporations in Australia. ASIC-licensed forex brokers were historically attractive due to flexible leverage rules, though leverage caps introduced in 2021 brought Australia closer to EU and UK norms.
FINMASwiss Financial Market Supervisory Authority: FINMA is the Swiss financial regulator overseeing banks, insurers, and crypto-asset firms. Switzerland's FINMA-supervised crypto banks (e.g., SEBA, Sygnum) are among the few globally that openly bank licensed crypto businesses, making FINMA highly relevant to crypto founders.
MASMonetary Authority of Singapore: MAS is Singapore's central bank and integrated financial regulator, also responsible for licensing payment service providers and crypto firms under the Payment Services Act. A MAS Major Payment Institution licence is highly respected and a strong signal for Asian banking partners.
FATFFinancial Action Task Force: The FATF is the intergovernmental body that sets global AML and CFT standards. Its 40 Recommendations are not law but are implemented domestically by virtually every major jurisdiction, and its grey/blacklists directly affect which jurisdictions banks will engage with.
FinCENUS Financial Crimes Enforcement Network: FinCEN is the bureau of the US Treasury responsible for AML enforcement and collecting suspicious activity data. US-touching businesses, including crypto MSBs and payment firms, must register with FinCEN and file SARs, making it a critical regulator for any USD-denominated activity.
OFACUS Office of Foreign Assets Control: OFAC administers and enforces US economic and trade sanctions, including the SDN list. Even non-US banks routinely screen against OFAC lists because correspondent USD clearing exposes them to US jurisdiction, making OFAC compliance effectively global.
CIMACayman Islands Monetary Authority: CIMA regulates banking, securities, insurance, and trust services in the Cayman Islands. While Cayman is a major offshore fund domicile, CIMA-licensed banks have become more selective post-CRS and FATCA, and Cayman remains a frequently scrutinised jurisdiction.
FSA Seychelles / IFSC Belize / FSC BVI: Three commonly used offshore financial regulators: the FSA Seychelles licences forex and securities firms cheaply and quickly; the IFSC Belize licences forex brokers and money lenders with light-touch supervision; the FSC BVI regulates funds and corporate services in the British Virgin Islands. All three are popular for cost reasons but increasingly difficult to bank.
Isle of Man GSCGambling Supervision Commission: The Isle of Man Gambling Supervision Commission has licensed online gambling since 2001. As a Crown Dependency it sits outside both the EU and the UK tax system but maintains UK-aligned legal standards. Its licensees — including PokerStars and Kindred Group — enjoy strong EMI access and favourable 0% corporate tax on non-Isle-of-Man-source income.
Gibraltar GBDGibraltar Gambling Division: The Gibraltar Gambling Division issues Remote Gambling Licences to operators including bet365, William Hill, and 888 Holdings. Gibraltar offers UK-level credibility at a 10% corporate tax rate. FCA-authorised UK payment institutions treat Gibraltar-licensed operators comparably to UKGC licensees, giving them access to the same processing infrastructure.
AGCO / iGaming OntarioAlcohol and Gaming Commission of Ontario: The AGCO is Ontario's gaming regulator; iGaming Ontario (iGO) is its commercial subsidiary and the single counterparty for all private operators in Canada's first regulated competitive iGaming market, launched April 2022. Operators pay a CAD $100k annual fee plus 20% GGR revenue share to iGO. Despite full regulation, AGCO-registered operators cannot open accounts at Canada's Big Five banks due to US correspondent banking constraints.
Tobique Gaming CommissionTGC: The Tobique Gaming Commission issues licences under the authority of the Tobique First Nation in New Brunswick, Canada. Comparable legal standing to Kahnawake under Canadian constitutional law, with a faster application timeline (10–16 weeks) and lower fees (CAD $15k–$25k). Recognition among EMIs and offshore banks is growing and now broadly comparable to Kahnawake.
Anjouan Gaming CommissionAGC: The Anjouan Gaming Commission is the gaming regulatory authority of the Autonomous Island of Anjouan within the Comoros Union. It is the fastest-growing offshore iGaming regulator, positioning as a cheaper and faster alternative to the post-2023 reformed Curaçao framework. Application costs USD $12k–$20k; timeline 4–8 weeks. FATF-aligned AML requirements; growing but not yet universal EMI acceptance.
FINTRACFinancial Transactions and Reports Analysis Centre of Canada: FINTRAC is Canada's financial intelligence unit, responsible for collecting and analysing financial transaction reports to detect money laundering and terrorist financing. iGaming operators with an iGO operating agreement are classified as Money Service Businesses (MSBs) and must register with FINTRAC, file suspicious transaction reports, and maintain five-year KYC records.
AUSTRACAustralian Transaction Reports and Analysis Centre: AUSTRAC is Australia's AML/CTF regulator and financial intelligence unit. It supervises reporting entities including banks, remittance providers, crypto exchanges, and gambling businesses operating in Australia. AUSTRAC's enforcement actions — including record fines against Westpac and CBA for AML failures — have significantly raised global awareness of gaming and crypto compliance obligations.
PMLPersonal Management Licence: A PML is required by the UKGC for key individuals managing licensed gambling operations in Great Britain, including CEOs, CFOs, MLROs, and compliance officers. The UKGC assesses PML applicants' integrity, competence, and financial soundness independently of the operator licence, creating personal accountability at the executive level.

§02 · AML / KYC / Compliance

AML / KYC / Compliance.

The vocabulary banks use to describe how they identify customers, screen for risk, and report suspicious activity.

22 terms

KYCKnow Your Customer: KYC is the process by which financial institutions verify the identity of individual customers, typically using passport, proof of address, and selfie checks. It is the bedrock of AML compliance and the first hurdle any new account opening must clear.
KYBKnow Your Business: KYB is the corporate equivalent of KYC: verifying a legal entity's registration, structure, directors, and beneficial owners. For high-risk verticals, KYB onboarding routinely takes 4–12 weeks and requires apostilled corporate documents, licences, and source-of-funds evidence.
AMLAnti-Money Laundering: AML is the framework of laws, regulations, and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income. Banks operationalise AML through KYC, transaction monitoring, sanctions screening, and SAR filing, all overseen by an MLRO.
CFTCounter-Financing of Terrorism: CFT comprises laws and controls designed to prevent funds from reaching terrorist organisations or financing terrorist acts. CFT is almost always paired with AML in regulation (often as AML/CFT) and is enforced via sanctions screening, transaction monitoring, and reporting obligations.
CDDCustomer Due Diligence: CDD is the standard set of checks performed on every customer at onboarding and periodically thereafter, including identity verification, beneficial ownership, and risk profiling. It is the baseline level of scrutiny required by AML regulation for low-risk relationships.
EDDEnhanced Due Diligence: EDD is a heightened level of scrutiny applied to high-risk customers, including PEPs, high-net-worth individuals, and businesses in sectors like iGaming, crypto, and adult. EDD typically requires source-of-funds and source-of-wealth evidence, ongoing monitoring, and senior management approval.
MLROMoney Laundering Reporting Officer: The MLRO is the designated officer at a regulated firm responsible for AML compliance, including reviewing internal suspicious activity alerts and filing SARs with the FIU. Most jurisdictions require licensed PSPs, EMIs, and crypto firms to appoint an MLRO with personal accountability.
SARSuspicious Activity Report: A SAR is a confidential report filed by a financial institution with its national FIU when it suspects money laundering, fraud, or other financial crime. Filing a SAR does not require proof, only reasonable suspicion, and tipping off the customer is itself a criminal offence.
STRSuspicious Transaction Report: STR is the term used in many non-US jurisdictions for what the US calls a SAR: a regulator-mandated report flagging a specific transaction or pattern as potentially illicit. Functionally identical to a SAR, with the same confidentiality and tipping-off rules.
PEPPolitically Exposed Person: A PEP is an individual entrusted with prominent public functions (heads of state, ministers, judges, senior military, state-owned enterprise executives) plus their immediate family and close associates. PEP status automatically triggers EDD and ongoing enhanced monitoring throughout the banking relationship.
UBOUltimate Beneficial Owner: The UBO is the natural person who ultimately owns or controls a legal entity, typically defined as holding 25% or more of shares or voting rights. Banks require UBO disclosure during KYB and most jurisdictions now maintain UBO registries to combat shell-company abuse.
Source of FundsSoF: Source of Funds refers to the origin of the specific money being deposited or transacted, evidenced by salary slips, sale contracts, dividend statements, or invoices. Banks require SoF documentation for any unusual or large transaction, especially in high-risk verticals.
Source of WealthSoW: Source of Wealth refers to the origin of a customer's overall net worth, not just the funds in question, and is typically requested for HNW individuals, PEPs, and EDD cases. Acceptable evidence includes business sale documents, inheritance records, multi-year tax returns, or audited financials.
Travel Rule: The FATF Travel Rule requires VASPs to share originator and beneficiary information for crypto transfers above a threshold (typically $1,000 or €1,000). Implementation varies by jurisdiction and creates significant operational complexity for crypto exchanges and custodians processing cross-border transfers.
FATF Greylist / Blacklist: The FATF greylist names jurisdictions with strategic AML deficiencies under increased monitoring, while the blacklist names those subject to active countermeasures. Greylisted jurisdictions face heightened scrutiny from correspondent banks; blacklisted ones (currently North Korea, Iran, Myanmar) are effectively cut off from the global banking system.
Sanctions screening: Sanctions screening is the automated comparison of customer and transaction data against sanctions lists (OFAC SDN, EU consolidated, UK OFSI, UN). Banks screen at onboarding and continuously, and a positive match typically freezes the account pending investigation, with reporting obligations to the relevant authority.
MATCH List / TMFMember Alert to Control High-Risk Merchants / Terminated Merchant File: The MATCH list (also called TMF — Terminated Merchant File) is Mastercard's database of merchants whose acquiring relationships were terminated for cause, including excessive chargebacks, fraud, or AML violations. Being MATCH-listed effectively bars a merchant from obtaining card processing with any standard acquirer for five years. Removal is only possible if the listing was made in error.
Risk-based approachRBA: The risk-based approach (RBA) is the FATF-recommended framework under which institutions allocate AML resources proportionate to the risk each customer and relationship poses. Higher-risk customers receive EDD; lower-risk ones receive standard CDD. The RBA replaced the outdated "tick-box" compliance model and is now the global standard expected by regulators and bank auditors alike.
Adverse media / negative news screening: Adverse media screening is the systematic search of news databases, court records, and regulatory announcements for negative information about a customer or UBO, including fraud allegations, criminal proceedings, regulatory sanctions, and association with illicit activity. Banks and EMIs run adverse media checks at onboarding and on a periodic basis, and a hit typically escalates the relationship to EDD.
4AMLD / 5AMLD / 6AMLD: The EU Anti-Money Laundering Directives progressively tightened AML obligations across member states. 4AMLD (2017) mandated UBO registers and risk-based CDD. 5AMLD (2020) extended AML to crypto exchanges and custodian wallets, widened PEP definitions, and expanded UBO register public access. 6AMLD (2021) harmonised predicate offences and criminal liability, making non-compliance a corporate criminal matter across all member states.
CTRCurrency Transaction Report: A CTR is a mandatory report filed in the US with FinCEN for any cash transaction over $10,000, or multiple related transactions totalling more than $10,000 in a single day (structuring). Unlike SARs, CTRs are not confidential — they are routine regulatory filings triggered purely by transaction size. Canada's FINTRAC and most FATF-member jurisdictions have equivalent large-cash-transaction reporting obligations.
Periodic KYC review: Periodic KYC review (also called KYC refresh) is the scheduled re-verification of customer identity and risk profile after the initial onboarding check. Review frequency is risk-proportionate: EDD customers may be reviewed annually or on trigger events; standard CDD customers every 2–5 years. Banks increasingly use document expiry, adverse media alerts, and transaction anomalies as triggers for out-of-cycle reviews.

§03 · Banking infrastructure & rails

Banking infrastructure & rails.

The plumbing through which money actually moves between banks, currencies, and countries.

13 terms

IBANInternational Bank Account Number: An IBAN is a standardised international bank account format used across Europe and many other regions, encoding country, bank, and account number into a single string. IBANs enable straight-through processing on SEPA and SWIFT and are the default identifier for euro-area transfers.
SWIFT / BIC: SWIFT is the global messaging network used by banks to send payment instructions, identified by an 8- or 11-character BIC code. SWIFT is not a settlement system; actual money movement happens via correspondent banking, which is why SWIFT transfers can take 1–5 days and accumulate fees.
SEPASingle Euro Payments Area: SEPA is the EU-wide euro payments area covering 36 countries, enabling cheap or free euro transfers between member-state IBANs. SEPA Instant settles within seconds 24/7, while SEPA Credit Transfer settles within one business day, and SEPA membership is a major selling point for any EU-licensed EMI.
ACHAutomated Clearing House: ACH is the US batch-processing payment network for domestic USD transfers, used for payroll, bill payments, and B2B settlements. ACH is cheap (often a few cents per transfer) but slow, with same-day, next-day, and two-day settlement tiers, and it is reversible for up to 60 days for consumer transactions.
CHAPSClearing House Automated Payment System: CHAPS is the UK's same-day high-value GBP payment system, used primarily for property purchases and large interbank settlements. Unlike Faster Payments there is no transaction cap, but each CHAPS payment typically costs £20–£35 to the sender.
Faster Payments / FPS: Faster Payments is the UK's real-time GBP payment scheme, settling within seconds 24/7 with a per-transaction limit of £1 million (raised from £250k in 2022). Most UK fintechs and EMIs offer FPS as standard, and it is the default rail for retail and small-business GBP transfers.
Correspondent banking: Correspondent banking is the arrangement by which one bank holds an account with another (usually in a different country) to facilitate cross-border payments and FX. The number of correspondent relationships has shrunk dramatically since 2010 due to derisking, making it harder for high-risk businesses to send and receive international wires.
Nostro / Vostro account: A nostro account is "our account with you" held by a domestic bank at a foreign bank, while a vostro account is "your account with us" held by a foreign bank at a domestic bank. The two terms describe the same account from opposite sides of a correspondent banking relationship.
Multi-currency account: A multi-currency account holds balances in several currencies under a single account or set of linked sub-accounts. Common at EMIs and challenger banks, multi-currency accounts let high-risk businesses receive payments and hold reserves without forced conversion, often with separate IBANs per currency.
De-risking: De-risking is the practice by which banks terminate or restrict relationships with entire categories of client — including MSBs, crypto firms, gambling operators, and remittance companies — rather than managing them on a risk-based basis. Driven by regulatory pressure, correspondent banking liability concerns, and profitability calculus, de-risking has cut off large segments of legitimate high-risk business from mainstream banking since 2012.
IBAN discrimination: IBAN discrimination is the refusal by a payment recipient, employer, or service provider to accept IBANs from certain EU member states or EMI-issued IBANs on the grounds that they are "not local." It is explicitly prohibited under SEPA Regulation 260/2012, which requires any SEPA-reachable IBAN to be accepted for euro payments throughout the eurozone. High-risk businesses with Lithuanian or Irish EMI IBANs occasionally encounter IBAN discrimination from EU payors unfamiliar with the regulation.
TARGET2 / T2: TARGET2 is the European Central Bank's real-time gross settlement system for large-value euro payments between eurozone banks and central banks. Replaced in 2023 by T2 (an enhanced version), it processes the backbone of interbank euro transfers and is the system through which EMIs ultimately settle their SEPA transactions via sponsor banks.
Fedwire: Fedwire is the US Federal Reserve's real-time gross settlement system for same-day, irrevocable USD transfers between US-domiciled financial institutions. Used for large corporate and interbank settlements where speed and finality are critical, Fedwire processes trillions of dollars daily and is the backbone of US-dollar clearing.

§04 · Payment processing & merchant services

Payment processing & merchant services.

Everything between the customer's card and your bank account, plus the metrics and codes that decide whether a merchant gets banked.

28 terms

PSPPayment Service Provider: A PSP is a third-party company that processes card and alternative payments on behalf of merchants, typically aggregating multiple acquirers, payment methods, and risk tools. High-risk PSPs specialise in iGaming, adult, forex, and crypto and charge significantly higher fees and reserves than standard PSPs.
MSBMoney Service Business: An MSB is the US regulatory category for businesses transmitting money, exchanging currency, or dealing in crypto, requiring FinCEN registration and state-by-state money transmitter licences. MSBs face high banking friction in the US because banks see them as introducing third-party AML risk into their book.
EMIElectronic Money Institution: An EMI is an EU/UK-licensed institution authorised to issue e-money and provide payment services without a full banking licence. EMIs (Wise, Revolut Business, ClearJunction, etc.) are the de facto banking solution for many high-risk businesses that cannot get a traditional bank account but need IBANs and SEPA access.
PIPayment Institution: A PI is an EU/UK-licensed entity authorised to provide payment services such as money remittance, acquiring, and account information services, but unlike an EMI it cannot issue e-money or hold customer balances long-term. PIs are common for acquiring-only and remittance-only business models.
MCCMerchant Category Code: An MCC is a four-digit code assigned by Visa and Mastercard to classify a merchant's line of business. The MCC drives interchange rates, chargeback risk classification, and whether issuers will allow transactions, making MCC selection a critical setup decision for high-risk merchants.
MCC 7995: MCC 7995 covers betting, lottery, casino gaming, and online gambling. Most issuing banks block MCC 7995 by default for cardholders in restricted jurisdictions (US, parts of Asia), and acquiring under this MCC requires a licensed gambling operator and a high-risk acquirer that explicitly supports gaming.
MCC 5967: MCC 5967 covers direct marketing of inbound teleservices, in practice used for adult chat, cam sites, and adult content subscriptions. Adult MCCs face the highest chargeback rates in card processing, mandatory adult-content registration with Visa/Mastercard, and very limited acquirer choice.
MCC 6051: MCC 6051 covers quasi-cash transactions including money orders, foreign currency, and crypto purchases. Many issuers treat MCC 6051 as a cash advance, applying higher fees and immediate interest, and several jurisdictions and issuers block it entirely for retail crypto purchases.
Chargeback: A chargeback is a forced reversal of a card transaction, initiated by the cardholder via their issuing bank, typically for unauthorised use, non-delivery, or dispute over goods. Each chargeback costs the merchant the transaction amount plus a fee of $15–$50, and excessive chargebacks lead to processor termination.
Chargeback ratio: The percentage of card transactions disputed by customers and reversed. Visa and Mastercard flag merchants as high-risk above 0.9% and may terminate above 1.8%, which is the threshold most card-acquiring banks use when deciding whether to retain a merchant account.
Rolling reserve: A rolling reserve is a percentage of a merchant's sales (typically 5–15%) held by the acquirer for a defined rolling period (typically 90–180 days) to cover chargebacks and refunds. Rolling reserves are standard for high-risk merchants and substantially affect cashflow, especially in the first year of processing.
Static reserve: A static reserve is a fixed sum held by the acquirer for the duration of the merchant relationship, often required up-front or built up from initial sales. Unlike a rolling reserve, the static portion does not release back to the merchant until account closure and full chargeback runoff.
Refund ratio / dispute ratio: The refund ratio is the percentage of transactions refunded by the merchant directly, while the dispute ratio includes chargebacks. Visa's Dispute Monitoring Program escalates merchants above 0.9% disputes, and high refund ratios alone can trigger acquirer review even without chargebacks.
3D Secure (3DS): 3D Secure is the card-network protocol that adds an authentication step (SMS code, biometric, app prompt) to online card transactions, shifting liability for fraud from the merchant to the issuer when authenticated. 3DS2 is now mandatory in the EU under PSD2 SCA and substantially reduces fraud-related chargebacks.
Card acquiring: Card acquiring is the service of accepting card payments on behalf of a merchant, performed by an acquirer that holds the merchant account and settles funds. High-risk acquiring is a specialist niche (Worldpay, Trust Payments, Praxis, etc.) with stricter underwriting, higher fees, and mandatory reserves.
Card issuing: Card issuing is the business of providing payment cards (debit, credit, prepaid) to end users, performed by an issuer (a bank or fintech via a sponsor bank/BIN sponsor). Modern issuing platforms (Marqeta, Stripe Issuing, Enfuce) let fintechs launch branded cards without obtaining their own BIN.
PCI DSS: PCI DSS (Payment Card Industry Data Security Standard) is the mandatory security framework for any entity that stores, processes, or transmits cardholder data. Compliance is tiered by transaction volume (Level 1 = >6M annually) and is enforced by acquirers; non-compliance can void merchant agreements and result in heavy fines.
APMAlternative Payment Methods: APMs are non-card payment methods including bank transfers, e-wallets (PayPal, Skrill, Neteller), open-banking pay-by-bank, vouchers, and crypto. APMs are critical for high-risk verticals where card acceptance is restricted or chargeback risk is high, and they often have lower fees and zero chargebacks.
MDRMerchant Discount Rate: The MDR is the total fee a merchant pays to its acquirer per card transaction, expressed as a percentage plus optional fixed component. MDR comprises interchange (paid to issuer), scheme fees (paid to Visa/MC), and acquirer margin; high-risk MDRs typically run 3.5–6% versus 1–2% for standard merchants.
Interchange fee: The interchange fee is the portion of MDR paid by the acquirer to the cardholder's issuing bank for each transaction. Interchange is set by the card networks and capped in some jurisdictions (EU caps consumer debit at 0.2% and consumer credit at 0.3%), but uncapped on commercial cards and cross-border transactions.
Chargeback representment: Chargeback representment is the merchant's formal dispute of a chargeback, submitted to the acquirer with evidence (transaction records, delivery proof, signed authorisation, communications) to contest the cardholder's claim. Successful representment reverses the chargeback and returns the funds, and is the primary tool for recovering revenue lost to friendly fraud. Chargeback management services like Chargebacks911 specialise in representment at scale.
Friendly fraud: Friendly fraud occurs when a cardholder makes a legitimate purchase but then disputes the charge with their bank, falsely claiming non-receipt, unauthorised use, or dissatisfaction. It is the single largest source of chargebacks for iGaming, subscription, and digital goods merchants. Unlike genuine fraud there is no stolen card — the cardholder is the actual customer, making it difficult to detect before a dispute is filed.
PayFacPayment Facilitator: A PayFac is a registered Visa/Mastercard entity that processes transactions on behalf of sub-merchants under its own merchant ID, accepting responsibility for their compliance and chargebacks. Unlike an ISO that refers merchants to acquirers, a PayFac takes on the risk itself. PayFac models are popular in SaaS and marketplace contexts but are generally unavailable to high-risk sub-merchants due to the chargeback and regulatory exposure they pass upstream.
ISOIndependent Sales Organisation: An ISO is a company registered with Visa or Mastercard to market and resell payment processing services on behalf of acquiring banks, typically to merchant types the bank does not reach directly. High-risk ISOs specialise in placing iGaming, adult, forex, and crypto merchants with suitable acquiring banks and earn a revenue share on processing volume. ISOs do not take on credit risk themselves — the acquirer retains ultimate liability.
BINBank Identification Number: The BIN (or IIN — Issuer Identification Number) is the first 6–8 digits of a payment card number, identifying the issuing bank, card network, card type (credit/debit/prepaid), and country of issue. BIN data is used by merchants and acquirers to identify prepaid cards (often excluded from high-risk categories), geographic restrictions, and card type to determine correct interchange rates.
Authorisation rate: The authorisation rate is the percentage of card payment attempts that result in a successful authorisation from the issuing bank. High-risk merchants typically see lower authorisation rates (60–80%) than standard merchants (90–95%), because many issuing banks block MCC 7995, 5967, and similar codes by default. Improving authorisation rates — through acquiring bank relationships, retry logic, and local acquiring — is one of the most commercially significant optimisations for high-risk operators.
Decline rate: The decline rate is the complement of the authorisation rate — the percentage of card transactions rejected, either by the issuer (hard decline: insufficient funds, blocked MCC, fraud flag) or by the acquirer's fraud tools (soft decline). High decline rates increase customer friction, inflate chargeback risk from repeat-attempt customers, and signal to acquirers that the merchant's traffic profile is poor-quality.
Statement descriptor: The statement descriptor is the text that appears on a cardholder's bank statement to identify a charge. A clear, recognisable descriptor (matching the brand the cardholder transacted with) directly reduces friendly fraud chargebacks, because cardholders are less likely to dispute a charge they recognise. High-risk merchants should always request a descriptor that matches their brand name, not the name of their PSP or holding company.

§05 · Crypto-specific

Crypto-specific.

The licences, regulations, and operational concepts unique to crypto businesses seeking banking.

13 terms

VASPVirtual Asset Service Provider: VASP is the FATF-defined category covering exchanges, custodians, and other businesses providing virtual-asset services. VASP registration or licensing is now required in most major jurisdictions, and most banks will only engage with crypto businesses that hold a recognised VASP authorisation.
CASPCrypto-Asset Service Provider: CASP is the EU-specific term used in MiCA for a regulated crypto-asset service provider, broadly equivalent to VASP but with EU-harmonised authorisation. From late 2024, CASPs need a single MiCA authorisation that passports across all 27 EU member states.
MiCAMarkets in Crypto-Assets regulation: MiCA is the EU regulation that creates a unified regime for crypto-asset issuers and CASPs, fully applicable from 30 December 2024. MiCA brings legal clarity, stablecoin reserve rules, and EU-wide passporting, and is expected to make EU-licensed crypto firms substantially more bankable than before.
FIUFinancial Intelligence Unit: An FIU is the national agency that receives, analyses, and disseminates SARs and STRs from regulated entities, examples including FinCEN (US), the NCA (UK), TRACFIN (France), and Rosfinmonitoring (Russia). FIUs are members of the Egmont Group, which facilitates cross-border information sharing on financial crime.
On-ramp / Off-ramp: An on-ramp converts fiat to crypto (typically via card or bank transfer); an off-ramp converts crypto back to fiat. Reliable fiat ramps are the single biggest banking pain point for crypto businesses, and most exchanges contract with multiple providers to maintain redundancy.
Custodial vs non-custodial: A custodial service holds users' private keys and crypto on their behalf (Coinbase, Binance), while a non-custodial service lets users retain their own keys (MetaMask, Ledger). Custodial services face the heaviest regulatory burden including capital, audit, and segregated-account requirements, while non-custodial services typically fall outside VASP scope.
Chain analytics: Chain analytics tools (Chainalysis, Elliptic, TRM Labs) trace blockchain addresses to known entities and risk-score transactions for AML compliance. Banks and licensed VASPs use chain analytics to screen incoming and outgoing crypto, blocking flows associated with sanctions, mixers, darknet markets, or stolen funds.
CEX / DEXCentralised Exchange / Decentralised Exchange: A CEX (centralised exchange) is a custodial crypto trading platform operated by a company that holds customer funds and must comply with AML/KYC obligations as a VASP (e.g. Coinbase, Kraken, Binance). A DEX (decentralised exchange) runs via smart contracts with no intermediary and no custody, creating significant regulatory grey areas that FATF and national regulators are progressively addressing.
Stablecoin: A stablecoin is a crypto-asset designed to maintain a stable value relative to a reference asset, most commonly the US dollar (USDT, USDC) or euro (EURE). Under MiCA, fiat-referenced stablecoins are classified as e-money tokens (EMTs) and require EMI-equivalent authorisation. Stablecoins are widely used in iGaming and payments due to their price stability and cross-border speed, but onboarding stablecoin-heavy merchants raises AML questions for banks.
CBDCCentral Bank Digital Currency: A CBDC is a digital form of a country's sovereign currency issued directly by the central bank, distinct from bank deposits or stablecoins. The digital euro (in development by the ECB), digital yuan (e-CNY, live in China), and others represent central banks' response to crypto and stablecoin adoption. CBDCs may eventually create a new payment rail relevant to high-risk merchants, depending on AML rules embedded at the protocol level.
Hot wallet / Cold wallet: A hot wallet is a crypto wallet connected to the internet, enabling fast transaction signing but exposing private keys to online attack. A cold wallet stores private keys offline (hardware device, air-gapped computer, paper), maximising security at the cost of transaction speed. Regulated custodians and exchanges are required to hold the majority of customer funds in cold storage, typically 90–95%, retaining only a small float in hot wallets for operational liquidity.
DeFiDecentralised Finance: DeFi refers to financial services — lending, borrowing, trading, yield — delivered via smart contracts on blockchains (primarily Ethereum) without centralised intermediaries. DeFi protocols generally do not collect KYC information or hold customer funds, creating significant AML and consumer protection challenges that regulators are beginning to address. Banks universally refuse to process DeFi-native revenue streams directly.
Proof of Reserves: Proof of Reserves (PoR) is a cryptographic audit mechanism that allows a crypto exchange or custodian to publicly verify that customer balances are fully backed by on-chain assets without revealing individual account details. Following the FTX collapse in 2022, PoR became a de facto expectation for regulated exchanges and a factor in banking due diligence for crypto business accounts.

§06 · Account structures

Account structures.

Different ways of structuring corporate, client, and beneficiary money inside the banking system.

5 terms

Segregated client account: A segregated client account holds each customer's funds separately in a dedicated bank account or sub-account, ring-fenced from the operator's own money. Required for licensed iGaming operators (e.g., MGA, UKGC) and many investment firms to protect player or client funds in case of operator insolvency.
Omnibus account: An omnibus account pools client funds from many customers in a single bank account, with the operator maintaining internal ledgers tracking each customer's balance. Cheaper and operationally simpler than segregated accounts, omnibus structures rely heavily on the operator's reconciliation discipline and are accepted in fewer regulated contexts.
Escrow account: An escrow account holds funds on behalf of two parties pending fulfilment of conditions in an underlying contract, controlled by a neutral third-party escrow agent. Common in M&A, real estate, and high-value B2B transactions, escrow accounts reduce counterparty risk by giving each side certainty over fund release.
Trust account: A trust account is held by a trustee on behalf of one or more beneficiaries under the terms of a trust deed, with legal title separated from beneficial interest. Used in private wealth, estate planning, and fund administration, trust accounts offer asset protection but require careful structuring to satisfy bank KYC on the trustee, settlor, and beneficiaries.
Sub-IBAN / virtual IBAN: A sub-IBAN (or virtual IBAN, vIBAN) is an addressable IBAN that routes inbound payments into a designated sub-ledger of a master account, without requiring a separate bank account. Widely used by EMIs and fintechs to give each end-customer a unique IBAN at minimal cost, sub-IBANs are technically operator-owned, which can create AML attribution issues with some banks.

§07 · Corporate structuring & registry

Corporate structuring & registry.

The legal documents and registry concepts banks ask for during KYB onboarding.

16 terms

Articles of Association: The Articles of Association set out the internal rules of a company, including share rights, director powers, voting procedures, and meeting requirements. Banks request the Articles during KYB to verify ownership structure, signatory authority, and any provisions affecting control or transferability of shares.
Memorandum of Association: The Memorandum of Association is the founding document declaring a company's formation, name, registered office, and (in older common-law forms) its objects. In many modern jurisdictions the Memorandum has been merged into or simplified within the Articles, but offshore registries still issue both.
Certificate of Incorporation: The Certificate of Incorporation is the official document issued by a company registry confirming a company has been legally formed, with its registration number and date. It is the most basic KYB document a bank will request and is often the first item on any onboarding checklist.
Certificate of Good Standing: A Certificate of Good Standing is issued by a company registry confirming that an entity is currently registered, has filed all required returns, and is not in liquidation or strike-off proceedings. Banks typically require a recent (under 3 months old) Good Standing certificate at onboarding and at periodic refresh.
Certificate of Incumbency: A Certificate of Incumbency lists current directors, officers, and shareholders of a company, typically issued by the registered agent in offshore jurisdictions where this information is not publicly registered. Required by most banks for offshore entities to verify signatories and beneficial ownership chains.
Registered agent: A registered agent is a licensed person or firm appointed to receive official correspondence and legal service on behalf of a company in its jurisdiction of incorporation. Mandatory in most offshore jurisdictions (BVI, Cayman, Seychelles, Belize), registered agents also typically maintain the company's share register and issue incumbency certificates.
Registered office: The registered office is the official legal address of a company, where statutory correspondence is delivered and legal records are held. Banks check the registered office for substance and may reject applicants whose registered office is a known mass-incorporation address with no operational presence.
Apostille: An apostille is a standardised certificate authenticating the origin of a public document for use in another country, issued under the 1961 Hague Convention. Banks routinely require apostilled corporate documents (Certificate of Incorporation, Good Standing, board resolutions) for cross-border KYB.
Notarisation: Notarisation is the formal verification of a signature, copy, or document by a licensed notary public, attesting to its authenticity. Often a precursor to apostille, notarised copies of passports, utility bills, and corporate documents are standard requirements for high-risk KYB and PoA execution.
Annual return / annual filing: The annual return is the periodic filing a company must submit to its registry confirming directors, shareholders, and registered office, plus paying the annual fee. Failure to file leads to strike-off and loss of Good Standing, which in turn invalidates banking relationships.
Strike-off: Strike-off is the registry's removal of a company from the register, usually for non-payment of fees or non-filing, after which the company ceases to legally exist and its assets may vest in the state. Banks freeze accounts of struck-off companies, and recovering them requires formal restoration.
Restoration: Restoration is the legal process of reinstating a struck-off company onto the register, typically requiring payment of arrears, penalties, and a court or administrative application. Once restored, the company is treated as if never struck off, but the process can take weeks to months and disrupts banking and contracts.
Bearer shares: Bearer shares are share certificates whose ownership is determined by physical possession of the certificate, with no name registered. Effectively prohibited in most jurisdictions since the 2010s due to AML concerns, any company with historical bearer shares in its chain of ownership faces extreme banking difficulty.
Nominee director / nominee shareholder: A nominee director or shareholder holds the position formally on behalf of the actual beneficial owner, typically under a declaration of trust or nominee agreement. Legitimate in many jurisdictions, but banks always require disclosure of the underlying UBO and may decline structures where the nominee arrangement appears designed to obscure ownership.
Power of AttorneyPoA: A Power of Attorney is a legal instrument authorising one person to act on behalf of another, with scope ranging from general to single-purpose. Banks typically require PoAs to be notarised and apostilled, and may impose additional verification on the attorney before acting on PoA-based instructions.
Trust deed: A trust deed is the legal document creating a trust, identifying the settlor, trustee, beneficiaries, and the property held in trust along with the powers and obligations of the trustee. Banks reviewing trust accounts require sight of the full trust deed to identify the UBO chain and any provisions affecting how funds may be used.

§08 · Trade finance

Trade finance.

Bank instruments and documents that bridge trust between buyers and sellers in international trade.

7 terms

LCLetter of Credit: A bank instrument guaranteeing payment to a seller upon presentation of stipulated documents. LCs are widely used in international trade to bridge trust gaps between buyer and seller and are issued by banks against the buyer's creditworthiness or collateral.
SBLCStandby Letter of Credit: An SBLC is a payment guarantee issued by a bank that pays out only if the underlying obligation is not met by the principal. Functionally similar to a bank guarantee, SBLCs are widely accepted internationally and governed by ICC rules (UCP 600 or ISP98).
Escrow agent: An escrow agent is the neutral third party (often a bank, law firm, or specialist escrow company) that holds funds or documents in escrow and releases them upon fulfilment of contract conditions. Escrow agents are subject to KYC on both parties and must verify the satisfaction of release conditions before disbursing.
Documentary collection: Documentary collection is a trade-finance method where the seller's bank forwards shipping documents to the buyer's bank, releasing them only against payment (D/P) or acceptance of a draft (D/A). Cheaper than an LC but offers less protection, as the seller relies on the buyer's willingness to pay rather than a bank guarantee.
Bank guarantee: A bank guarantee is a written undertaking by a bank to pay a beneficiary if the bank's customer fails to fulfil a contractual obligation. Common in construction, government tendering, and international trade, bank guarantees are issued against collateral or credit lines and are typically governed by ICC URDG 758.
Performance bond: A performance bond is a specific type of bank or surety guarantee, ensuring that a contractor performs an underlying contract (typically construction or supply) to specification, with payout to the beneficiary if performance fails. Performance bond percentages typically range from 5–20% of contract value, depending on industry norms.
Bill of Lading: A Bill of Lading is the shipping document issued by a carrier acknowledging receipt of cargo and serving as a receipt, contract of carriage, and document of title. Negotiable bills of lading transfer title to the goods and are central to LC and documentary collection workflows.

§09 · Gaming revenue metrics

Gaming revenue metrics.

The headline numbers banks use to assess iGaming and betting operators.

5 terms

RTPReturn to Player: RTP is the percentage of total wagered money a casino game pays back to players over the long run, typically 92–98% for slots and over 99% for some table games. Regulators require RTP disclosure, and unusually low RTPs may trigger regulatory scrutiny and player complaints visible in chargeback patterns.
GGRGross Gaming Revenue: GGR is total amount wagered minus total winnings paid out to players, the operator's gross win before bonuses, taxes, and operating costs. GGR is the standard headline metric for the gambling industry and the base on which most gambling taxes (e.g., UK Remote Gaming Duty at 21%) are levied.
NGRNet Gaming Revenue: NGR is GGR minus bonuses, free bets, jackpot contributions, and gaming taxes, representing the operator's revenue actually retained. Banks evaluating iGaming clients usually focus on NGR rather than GGR, since NGR is closer to economic reality and predicts the real cash flow available to service obligations.
House edge: The house edge is the operator's long-run mathematical advantage on a game, expressed as a percentage of each wager and equal to 100% minus RTP. House edges range from under 1% on blackjack played optimally to 5–15% on most slots, and the figure determines theoretical operator profit.
Hold percentage: Hold percentage is the actual realised win as a percentage of money handled or wagered over a given period, distinct from theoretical house edge due to player behaviour and variance. In sports betting, "hold" typically means the bookmaker's margin built into the odds, usually 4–10% depending on market.

§10 · Risk metrics

Risk metrics.

How banks classify a prospective client and decide whether and how to onboard them.

6 terms

Risk appetite: Risk appetite is the level and type of risk a bank or PSP is willing to accept, formalised in internal policy and translated into onboarding criteria. A bank's risk appetite for high-risk verticals can shift quickly under pressure from correspondents or regulators, leading to sudden offboarding even of compliant clients.
High-risk merchant: A high-risk merchant operates in a vertical with elevated chargeback, fraud, regulatory, or reputational risk, including iGaming, adult, forex/CFD, crypto, nutraceuticals, and travel. High-risk classification leads to higher MDR (typically 3.5–6%), mandatory reserves, restrictive contract terms, and limited acquirer choice.
Pre-approval: Pre-approval is an informal indication from a bank or PSP, given before formal application, that they would likely onboard a particular client based on a high-level review of structure, licences, and projected volumes. In high-risk banking, pre-approval saves weeks of work but is non-binding and can be withdrawn during full underwriting.
OnboardingKYB onboarding: Onboarding is the full process of setting up a new banking or PSP relationship, from application through KYB, EDD, and final account activation. High-risk onboarding routinely takes 4–12 weeks and can require multiple rounds of documentation, calls with underwriters, and conditional approvals subject to volume caps.
Excessive chargeback programme: Visa and Mastercard both operate excessive chargeback programmes that monitor acquiring banks' merchants and impose fines and remediation obligations when a merchant's monthly chargeback ratio exceeds defined thresholds (Mastercard: 1.5%; Visa: 0.9%). A merchant that remains in the programme for multiple months faces acquirer termination and potential MATCH listing. Chargeback ratios above 2% typically trigger immediate account review.
Offboarding: Offboarding is the process by which a bank or PSP terminates its relationship with an existing client. In high-risk banking, offboarding can happen with little notice (often 30–60 days) and without explanation, due to changes in the bank's risk appetite, correspondent banking pressure, or regulatory review. The risk of sudden offboarding is why high-risk businesses should always maintain at least two active banking relationships — never single-bank.

§11 · Jurisdictional / offshore

Jurisdictional / offshore.

Concepts that determine how a structure is treated for tax, reporting, and bankability across borders.

5 terms

Offshore: Offshore refers to jurisdictions offering low or zero tax on foreign-source income and lighter regulatory disclosure, including the BVI, Cayman, Seychelles, Belize, and Nevis. Once the default for high-risk businesses, offshore structures are now significantly harder to bank due to FATCA, CRS, substance requirements, and bank derisking.
CRSCommon Reporting Standard: CRS is the OECD-developed standard for automatic exchange of financial account information between tax authorities, with over 110 participating jurisdictions. Banks in CRS-participating jurisdictions report customers' tax residency, account balances, and income annually, and CRS is now the global default for offshore tax transparency.
FATCA: FATCA (Foreign Account Tax Compliance Act) is US legislation requiring foreign financial institutions to report on US-person accounts to the IRS, enforced via 30% withholding on non-compliant institutions. FATCA preceded CRS and remains in force in parallel, making any US-touching account structure subject to ongoing reporting.
Substance requirements: Substance (or economic substance) requirements oblige offshore companies to demonstrate genuine local activity, including local directors, employees, premises, and decision-making, to qualify for tax residency or licence retention. Introduced under EU and OECD pressure from 2018 onwards, substance rules have made pure shell-company structures unworkable for most regulated activities.
Beneficial owner registry: A beneficial owner registry is a government-maintained database of UBOs of legal entities, with varying degrees of public access depending on jurisdiction. EU Member States maintain UBO registries under AMLD5, the UK has the Persons of Significant Control register, and most major offshore jurisdictions now maintain non-public UBO databases.

§12 · Technical / integration

Technical / integration.

The standards and APIs that define how modern banking systems talk to each other and to merchant tech stacks.

5 terms

PSD2Payment Services Directive 2: PSD2 is the EU directive (in force since 2018) regulating payment services, mandating SCA for online card payments and creating the legal basis for open banking via mandatory bank API access. PSD2 is the foundational rulebook for EU EMIs and PIs and underpins the entire European fintech ecosystem.
SCAStrong Customer Authentication: SCA is the PSD2 requirement for two-factor authentication on most electronic payments in the EU, combining two of: knowledge (password), possession (phone), and inherence (biometric). Implemented for cards via 3DS2 and for account access via dedicated authentication flows, SCA dramatically reduced card-not-present fraud after full enforcement in 2021.
Open Banking: Open Banking is the framework, mandated by PSD2 in the EU/UK and adopted voluntarily elsewhere, requiring banks to expose account data and payment initiation via standardised APIs to licensed third parties. Open Banking pay-by-bank is now a serious alternative to card payments, with no chargebacks and lower fees, particularly attractive for high-risk verticals.
ISO 20022: ISO 20022 is the international standard for financial messaging, replacing legacy SWIFT MT messages with rich, structured XML/JSON formats carrying significantly more data. SWIFT migration to ISO 20022 is in progress through 2025, and the richer payload directly improves AML screening, reconciliation, and compliance automation.
API banking: API banking is the provision of programmatic access to banking services (account opening, payments, balances, FX) via REST or similar APIs, allowing fintechs and merchants to embed banking into their own products. EMIs and challenger banks compete heavily on API quality, and rich API banking is a major reason high-risk businesses prefer EMIs over traditional banks.

§13 · iGaming operations

iGaming operations.

The operational, regulatory, and product concepts specific to running a licensed online gambling or sports betting business.

10 terms

GAMSTOP: GAMSTOP is the UK's national online self-exclusion scheme, mandatory for all UKGC-licensed operators. A player registered with GAMSTOP is blocked from accessing any UKGC-licensed site for the duration of their self-exclusion (6 months, 1 year, or 5 years). Operators that fail to enforce GAMSTOP exclusions face significant UKGC fines and licence risk.
Self-exclusion: Self-exclusion allows a player to voluntarily block themselves from a gambling site or a network of sites for a defined period. Virtually all licensed jurisdictions require operators to provide self-exclusion tools and to honour exclusion requests from other schemes (e.g. MGA requires MGA operators to accept GAMSTOP exclusions for UK-resident players). Failure to implement self-exclusion robustly is a common trigger for regulatory action.
Responsible gamblingRG: Responsible gambling (RG) is the framework of tools, policies, and interventions designed to prevent gambling harm and protect vulnerable players. Required elements vary by jurisdiction but typically include deposit limits, loss limits, session time limits, reality checks, cooling-off periods, and self-exclusion. UKGC, MGA, and AGCO all require documented RG frameworks as a condition of licensing; inadequate RG is the most common cause of major regulatory fines.
Affordability checks: Affordability checks are assessments of whether a player's gambling expenditure is within their financial means, required by the UKGC under its enhanced player protection framework. At lower thresholds (net losses of £500 in 30 days), operators must use open-source data to assess risk. At higher thresholds (£1,000 net loss in 24 hours or £2,000 in 90 days), operators must request financial documentation. Affordability is one of the most commercially contentious aspects of UKGC compliance for high-volume operators.
White-label gaming: White-label gaming refers to a model where an operator launches a branded gambling site built on a third-party platform provider's technology, using the platform provider's licence (or their own) and typically the provider's payment processing and game content agreements. White-label operators avoid the need to build tech infrastructure but share revenue with the platform provider and often have less control over payment options and compliance tools.
B2B vs B2C gaming licence: In iGaming licensing, a B2C (Business-to-Consumer) licence authorises operators to offer gambling services directly to end players. A B2B (Business-to-Business) licence authorises suppliers of software, platforms, payment tools, or RNGs to gaming operators without directly serving players. The MGA, for example, issues B2C Gaming Service Licences and B2B Critical Gaming Supply Licences; UKGC issues Operating Licences (B2C) and remote gambling software licences (B2B). The distinction matters for banking, as B2B gaming businesses often face lower risk categorisation.
Bonus abuse: Bonus abuse occurs when players exploit a casino's promotional offers — welcome bonuses, reload bonuses, free spins — in ways the operator did not intend, such as meeting wagering requirements on low-risk bets, using multiple accounts, or coordinating with others to extract consistent expected value. Bonus abuse erodes GGR and, if combined with chargebacks, can result in both financial loss and elevated chargeback ratios.
Wagering requirementPlaythrough requirement: A wagering requirement (or playthrough) is the number of times a bonus amount must be wagered before the resulting winnings can be withdrawn. A 30x wagering requirement on a £100 bonus means the player must wager £3,000 before withdrawal. Regulators including the UKGC have tightened restrictions on wagering requirements under responsible gambling rules, limiting the types of games that count and the maximum time to complete them.
RNGRandom Number Generator: An RNG is the algorithm (hardware or software) that generates unpredictable outcomes in casino games — card draws, reel spins, dice rolls. Licensed jurisdictions require RNG certification from approved testing laboratories (eCOGRA, BMM Testlabs, GLI, SIQ) to demonstrate that game outcomes are genuinely random and unbiased. RNG certification is a prerequisite for any B2C gaming licence application.
Player lifetime valueLTV / PLTV: Player lifetime value (PLTV or LTV) is the total net revenue an operator expects to generate from a single player over the entire duration of their relationship, calculated from deposit history, game mix, bonus uptake, and churn probability. PLTV directly informs CPA (cost per acquisition) and marketing spend decisions. Regulators increasingly scrutinise high PLTV calculations because they may correlate with exploitation of at-risk players.

§14 · Fraud & chargeback management

Fraud & chargeback management.

The tools and metrics that determine whether a high-risk merchant keeps its card processing — and how to manage disputes when they arise.

6 terms

Velocity checks: Velocity checks are fraud detection rules that flag or block transactions based on unusual frequency — multiple purchases from the same card, IP, device, or email address within a short window. Velocity rules are a front-line fraud defence but must be calibrated carefully: over-aggressive velocity limits increase false declines and damage authorisation rates, while lax ones allow card testing and account takeover.
Device fingerprinting: Device fingerprinting is the collection and hashing of browser/device attributes (screen resolution, fonts, plugins, time zone, language settings) to create a pseudonymous identifier for a device across sessions, even when cookies are cleared. Used in fraud detection and bonus abuse prevention, device fingerprinting helps operators link multiple accounts on the same device — critical for preventing multi-accounting and promotion abuse.
Fraud rate: Fraud rate is the percentage of transaction volume flagged as fraudulent, typically measured as fraud chargebacks divided by total transaction volume in the same period. Visa's Fraud Monitoring Programme (VFMP) triggers when a merchant's fraud rate exceeds 0.9% and volume exceeds $75,000/month. Maintaining fraud rate below 0.65% and chargeback ratio below 1% is the practical target for any merchant that wants to stay off Visa's monitoring programmes.
False decline / False positive: A false decline (or false positive) occurs when a legitimate transaction is rejected by the merchant's fraud filter or the acquirer's risk system, even though the cardholder is genuine. False declines are costly: they damage customer experience, increase customer support load, and reduce authorisation rates. For high-risk merchants, false decline rates of 5–15% on legitimate transactions are not uncommon with poorly tuned fraud tools.
Ethoca / Verifi: Ethoca (owned by Mastercard) and Verifi (owned by Visa) are chargeback prevention services that allow merchants to resolve disputes before they become chargebacks. When a cardholder initiates a dispute, the service notifies the merchant in real time; the merchant can then issue a refund to stop the chargeback, preserving the customer relationship and avoiding the chargeback fee and ratio impact. Essential tools for high-volume iGaming and subscription merchants.
Card testing: Card testing (or carding) is a fraud technique where criminals use stolen card numbers to make small test transactions on a merchant's checkout to verify the card is active before using it for larger fraudulent purchases elsewhere. Merchants with weak velocity controls and easy checkout flows are particularly targeted. Card testing generates chargebacks, triggers acquirer alerts, and can result in MCC reassignment or account termination if not detected quickly.

§15 · Foreign exchange & treasury

Foreign exchange & treasury.

How high-risk businesses manage multi-currency revenues, hedge FX exposure, and structure treasury to optimise yield and reduce conversion costs.

6 terms

FX spread: The FX spread is the difference between the mid-market exchange rate and the rate actually applied by a bank or EMI to a currency conversion, representing their margin on the transaction. EMIs and challenger banks typically charge 0.5–2% spread on FX conversions; traditional banks may charge 2–5%. For high-risk businesses with significant multi-currency flows, reducing FX spread is a material cost optimisation — often justifying the use of multi-currency accounts to hold balances in native currency rather than converting.
Spot FX: Spot FX is a currency exchange transaction settled at the current market rate within two business days (T+2). It is the simplest FX transaction type and the default for most business account currency conversions. Spot FX carries full rate risk — the exact rate received depends on market conditions at the moment of execution, making it unsuitable for large or time-sensitive conversions where rate certainty matters.
FX forward: An FX forward is a contract to exchange currencies at a fixed rate on a specified future date, locking in today's rate to eliminate exchange rate uncertainty on a future cash flow. iGaming and forex operators with predictable multi-currency revenue streams use FX forwards to hedge currency risk between when revenue is earned and when it is repatriated. Not all EMIs offer forward contracts — specialist FX brokers (e.g. Ebury, Currencies Direct) typically provide better rates and flexibility than banks.
Currency hedging: Currency hedging is the practice of taking a financial position that offsets the risk of adverse FX movements on business cash flows. Simple hedges use FX forwards to lock in rates on known future receipts or payments. More complex strategies use options (right but not obligation to convert at a fixed rate). Hedging is relevant to any high-risk business receiving revenue in multiple currencies that needs to report in a single base currency.
Account sweeping: Account sweeping is the automated transfer of funds above a defined threshold from one account to another — typically from an operational account to a treasury or reserve account. Used by iGaming operators to maintain minimum operational balances while parking excess cash in higher-yield treasury accounts. EMIs and high-risk banking providers increasingly offer automated sweep infrastructure as part of their business banking packages.
Treasury account: A treasury account is a dedicated account used to hold operating reserves, capital buffers, and longer-term cash holdings, separate from the operational account used for day-to-day payments. For high-risk businesses, the treasury account is typically held at an offshore bank (TBC Georgia, Bank of Georgia, Swiss bank) while the operational account is held at an EMI. Segregating treasury from operations protects reserves against EMI account suspensions and creates a more robust multi-bank structure.

Ready to get banked?

You know the terms.
Now what?

Free pre-approval. Honest answer within 24 hours on which banking partner fits your business.

Get Free Pre-Approval Contact us

The language ofhigh-risk banking.

Licences & regulators.

AML / KYC / Compliance.

Banking infrastructure & rails.

Payment processing & merchant services.

Crypto-specific.

Account structures.

Corporate structuring & registry.

Trade finance.

Gaming revenue metrics.

Risk metrics.

Jurisdictional / offshore.

Technical / integration.

iGaming operations.

Fraud & chargeback management.

Foreign exchange & treasury.

You know the terms.Now what?

The language of
high-risk banking.

You know the terms.
Now what?