What Banks Look for in Crypto-Related Companies in the UAE

Why banks apply enhanced scrutiny to crypto companies

Digital asset businesses can combine rapid settlement, cross-border customers, complex ownership arrangements and transactions involving self-hosted wallets or overseas platforms. These characteristics do not make a company unacceptable, but they require the bank to conduct a more detailed assessment.

Banks may need to establish whether the applicant is correctly licensed, whether its activities match its regulatory permissions, how it identifies customers, how it detects suspicious transactions and whether it can explain the source and destination of funds.

The Financial Action Task Force continues to highlight licensing, registration, offshore VASP exposure and Travel Rule implementation as important areas in the global management of virtual asset financial-crime risks.

A well-prepared company therefore gives the bank evidence, not broad assurances.

1. The company’s regulatory status

The first question is usually whether the business is permitted to conduct the activities described in its application.

In Dubai, excluding the Dubai International Financial Centre, a firm seeking to conduct virtual asset activities must obtain the relevant VARA authorisation before commencing regulated operations. VARA’s process distinguishes between preliminary approval stages and a full VASP licence. An approval that permits incorporation or operational preparation should not be presented as permission to serve customers.

In Abu Dhabi Global Market, financial services entities conducting regulated digital asset activities must secure the applicable Financial Services Permission from the Financial Services Regulatory Authority. The FSRA assesses matters including the applicant’s track record, management, resources, governance and systems.

A bank will normally compare the licence, commercial registration, website, pitch deck and projected account activity. Inconsistencies can create immediate concerns.

2. A business model the bank can understand

Crypto founders often explain their business through technical architecture. A relationship manager, compliance analyst or risk committee usually needs a simpler commercial explanation.

The bank should be able to understand:

• What service the company provides
• Which customers it serves
• Where those customers are located
• How the company earns revenue
• Whether it holds or controls client assets
• Which parties send money into the bank account
• Which parties receive payments
• How fiat and virtual asset transactions interact

A company describing itself as a “blockchain ecosystem” may create more questions than confidence. A precise explanation such as “a regulated broker earning disclosed transaction fees from verified professional clients” is easier to assess.

3. Transparent ownership and governance

Banks need to identify the ultimate beneficial owners, controllers, directors and senior decision-makers behind the company.

Complex holding structures are not automatically unacceptable. The difficulty arises when the commercial reason for the structure is unclear, shareholder information is incomplete or control appears to sit with people who are not disclosed in the application.

VARA’s published application documentation includes beneficial-owner information, organisational structures, governance frameworks, key-person details, source-of-funds evidence and information about associated entities.

In practice, founders should prepare a clear group chart showing ownership percentages, jurisdictions, regulated entities and operational responsibilities.

4. AML and customer onboarding controls

A polished AML policy is useful, but banks will also ask whether it reflects the way the company actually operates.

The review may cover:

• Customer identification and verification
• Beneficial-owner checks
• Customer risk scoring
• Enhanced due diligence
• Politically exposed person screening
• Sanctions screening
• Adverse-media checks
• Ongoing customer reviews
• Suspicious-activity escalation
• Record retention

The bank may test whether the company applies different controls to retail customers, institutions, high-risk jurisdictions, self-hosted wallets and corporate clients.

Generic policies copied from another market often fail because they do not match the applicant’s licence, systems or customer base.

5. Transaction monitoring and blockchain analytics

Banks need confidence that the company can identify unusual behaviour across both fiat and virtual asset activity.

Depending on the business model, the company may need to demonstrate how it monitors wallet exposure, transaction velocity, unusual value movements, high-risk counterparties, sanctioned addresses and rapid movement between fiat and virtual assets.

The monitoring framework should also explain:

• Which alerts are generated
• Who investigates them
• How quickly investigations are completed
• When accounts are restricted
• How decisions are documented
• When matters are escalated or reported
• How audit trails are retained

The objective is not to claim that every suspicious transaction can be prevented. The objective is to show that the company has a proportionate, documented and functioning control environment.

6. Source of funds and flow-of-funds clarity

A bank may ask where the company’s initial capital came from, how operating revenue is generated and why expected transactions will enter or leave the account.

Founders should be ready to reconcile investor contributions, shareholder loans, token-related proceeds, customer fees and transfers involving group companies.

A useful flow-of-funds document shows each stage of a typical transaction. It should identify the customer, payment provider, company account, exchange or custodian, settlement route and final beneficiary.

Unexplained transfers involving founders’ personal accounts, unrelated third parties or multiple overseas entities can delay the review.

7. Customer and geographic exposure

A UAE licence does not remove the need to assess overseas exposure.

Banks typically consider where customers live, where counterparties are established, where technology and operational teams are based, and whether the company services jurisdictions subject to sanctions or elevated financial-crime risk.

The company should be able to explain its restricted-country policy, geolocation controls, customer acceptance rules and approach to cross-border servicing.

A business claiming to serve the “global market” without a defined jurisdictional strategy may appear difficult to supervise.

8. Financial strength and capital planning

Banks look at whether the company appears capable of operating through market volatility, delayed fundraising, technology incidents or lower-than-expected revenue.

Relevant information may include:

• Paid-up capital
• Cash reserves
• Monthly operating costs
• Financial projections
• Funding commitments
• Client-money arrangements
• Insurance
• Treasury policies
• Wind-down planning

VARA’s licensing-document list includes financial projections, entity and group financial statements, paid-up capital evidence, reserve information, insurance and wind-down planning.

A heavily funded company can still raise concerns when its forecasts are unsupported or when operating expenses depend on continuous investor injections.

9. Accounting records and financial reporting

The bank may request management accounts, audited financial statements, bank statements from related entities, shareholder funding evidence and forecasts.

The numbers should align with the business plan. For example, projected transaction volumes should be consistent with expected fee income, staffing levels, technology costs and regulatory capital.

Crypto companies should also maintain clear records for digital asset balances, custody arrangements, treasury holdings and transactions between connected parties.

Weak bookkeeping creates more than an accounting issue. It can prevent the bank from confirming where money came from and whether stated activity matches actual activity.

10. Cybersecurity, custody and incident response

Technology risk is central to the assessment because a cyber incident can quickly become a financial, operational and reputational problem.

Banks may examine access controls, multi-factor authentication, key management, wallet governance, segregation of client and corporate assets, penetration testing, vendor oversight, data protection and business continuity.

ADGM’s digital asset framework expressly addresses technology governance, custody, exchange operations, transaction monitoring and associated systems and controls.

The company should also maintain an incident-response plan that identifies decision-makers, communication procedures, containment measures and regulatory notification responsibilities.

11. Reputation and application quality

Banks commonly review the founders, directors, shareholders, group companies and public history of the business.

Previous regulatory disputes, misleading marketing, customer complaints or inconsistent public statements may affect the assessment. A bank may also question a company whose website promotes services beyond its permitted activities.

The application itself is part of the reputation review. Late responses, contradictory documents and exaggerated claims can suggest that the company’s internal controls are immature.

Example 1:

A Dubai startup applies for a bank account while progressing through the virtual asset licensing process. Its presentation says it is “VARA approved,” but its current status only permits incorporation and operational preparation.

The bank requests clarification because the company’s website already appears to invite customers to trade. The founders postpone launch, correct the website, provide the precise regulatory status and submit a staged operating plan. The revised application does not guarantee acceptance, but it gives the bank a more accurate basis for review.

Example 2:

An ADGM-based digital asset business has a clear regulatory route and experienced management, but its banking application includes only a licence document and investor deck.

The bank later requests ownership charts, projected account activity, source-of-funds evidence, AML procedures and transaction-flow diagrams. The company spends several weeks assembling documents that could have been prepared before submission. A banking-readiness review would have identified those gaps earlier.

Common mistakes business owners make

One recurring mistake is applying to several banks with different descriptions of the same business. Inconsistency between applications can create unnecessary credibility concerns.

Other common problems include:

• Treating a commercial licence as permission to conduct regulated virtual asset activity
• Describing projected volumes without supporting assumptions
• Submitting generic AML and sanctions policies
• Failing to explain self-hosted wallet exposure
• Using complicated group structures without a commercial rationale
• Mixing shareholder, customer and operating funds
• Providing outdated ownership records
• Launching marketing before permissions allow customer activity
• Giving the bank technical explanations without a clear flow-of-funds summary
• Assuming that regulatory approval guarantees banking approval

Bank onboarding and regulatory licensing are connected, but they are separate decisions made under different risk frameworks.

Documents and preparation checklist

Before approaching a bank, the company should typically prepare:

• Certificate of incorporation and commercial licence
• Current regulatory licence, approval or application-status evidence
• Memorandum and articles of association
• Ultimate beneficial-owner declaration
• Shareholder and group-structure chart
• Passports and profiles of directors, owners and key managers
• Source-of-wealth and source-of-funds evidence
• Detailed business plan
• Product and customer descriptions
• List of target and restricted jurisdictions
• AML, KYC, sanctions and transaction-monitoring policies
• Sample customer-risk assessment
• Transaction and flow-of-funds diagrams
• Management accounts and available audited statements
• Financial projections and capital plan
• Expected monthly account activity
• Major customer, supplier and technology-provider details
• Cybersecurity and incident-response policies
• Client-asset and custody arrangements
• Tax registrations and relevant accounting records
• Explanation of adverse media, disputes or previous account closures

The documents should tell one consistent story. The licence, policies, financial forecasts, website and account-activity estimates should not contradict each other.

Banking readiness does not end after account opening

A crypto company may continue to receive questions after onboarding, particularly when transaction patterns change.

Material changes in ownership, products, customer geography, transaction volumes, counterparties or regulatory permissions should be assessed internally and communicated where required.

The company should also monitor whether actual account activity remains consistent with the profile originally provided to the bank. Unexpected spikes, new payment corridors or transfers involving previously undisclosed counterparties may lead to further review.

Final advisory view

Banks do not assess crypto companies on branding or innovation alone. They assess whether the business is understandable, lawfully structured, financially credible and capable of managing the risks created by its activities.

The strongest applications usually combine regulatory clarity with transparent ownership, working AML controls, reliable financial records and a realistic description of account activity. A complete submission cannot guarantee approval because every bank applies its own risk appetite. It can, however, reduce avoidable questions and demonstrate that management understands the responsibilities attached to operating a digital asset business.

This article is for informational purposes and does not constitute legal, tax, accounting, or financial advice.