Formation & Licensing for High-Risk Businesses

What a High-Risk Business Needs

A high-risk build rests on three things we deliver directly: a regulated operating entity in the right jurisdiction, the activity-specific licence or registration, and an ongoing AML and compliance framework that survives a regulator’s reading. Banking and card processing sit alongside these as supporting workstreams once the licence is in place.

“High-risk” is a banking and card-scheme classification, not a judgement of legitimacy. It captures any business whose transaction profile produces elevated chargeback, fraud or AML risk: gambling and forex operators, OTC desks, adult platforms, CBD and cannabis-adjacent commerce, nutraceuticals, dating and ticketing. The Visa Acquirer Monitoring Programme (VAMP) and Mastercard’s Excessive Chargeback Programme (ECP) capture these categories disproportionately, which is why mainstream providers turn them away and why the structure has to be built correctly from the start.

Sequence determines how fast you launch. We form the company first, run capital and key-person appointments in parallel, and have the application drafted so it lands cleanly, never presenting a regulator with a half-built structure and an open question. The work is ours end to end, and we are accountable for getting it filed and approved.

The build is the same shape every time, and we lead the parts that decide the outcome. Formation and licensing are the work we own; banking and card processing follow once the licence is in hand.

What the build looks like

Choosing the Right Jurisdiction

The decision narrows to two clusters: gambling, running from Anjouan and the reformed Curaçao at the offshore end to Malta and Gibraltar for EU and UK-adjacent credibility; and forex, running from Labuan and the Bahamas at the offshore end to Cyprus, ADGM and DIFC at the regulated end. We have built in all of them and will tell you straight which fits what you are doing.

We weigh the regulator’s posture toward the activity, capital and cost, banking accessibility, EU or UK market access, application speed, and the headcount expected in-country. EU retail gambling needs a Malta MGA licence or another EU-passporting authorisation; a non-EU web-only operator can run from Anjouan or Curaçao at far lower cost. EU retail forex caps leverage at 30:1 on majors under the European Securities and Markets Authority (ESMA) rules in CySEC Directive DI-87-09, whereas professional or non-EU retail clients can be served from ADGM, the Dubai Financial Services Authority (DFSA), Bahamas or Labuan with higher leverage and lighter conduct overlays.

Jurisdiction Comparison

Curaçao under the new LOK suits operators wanting offshore tax efficiency under a regulator still bedding in. The Landsverordening op de Kansspelen replaced the legacy master-and-sublicence model, and substance is meaningful but achievable: a resident managing director, a statutory seat on the island, Tier-IV-certified hosting, building to three resident key persons by year five. We form the company, build the substance and file directly with the Curaçao Gaming Authority.

Anjouan is the fastest, cheapest credible offshore route, with several large markets geo-blocked. Major B2B suppliers now whitelist Anjouan licences, closing the credibility gap the jurisdiction had a couple of years ago. We deliver the incorporation and licence as one engagement.

Malta (MGA) is the choice when you need EU passport access and full reputational credibility. The trade-off is the highest cost in the gambling cluster and a tighter advertising and player-protection overlay. We build the file the MGA expects, including the fit-and-proper case.

Gibraltar fits a primarily UK and EU customer base where institutional credibility matters. The planning constraint is the dual UK tax burden: Remote Gaming Duty at 40% applies on UK customer turnover regardless of operator location, which is why several UK-facing brands have moved to Malta. See the Gibraltar formation guide; we deliver the formation layer through a Gibraltar-resident specialist we work with directly.

Cyprus (NBA Class B) works only for pure sports-event betting; online casino, slots, poker, exchange betting and lotteries remain prohibited, with serious operator penalties. The capital and bank-guarantee requirement pushes the practical floor above many alternatives. We will tell you plainly whether your model fits before you commit capital.

Kahnawake gives a Mohawk Territory corporate seat with North-American-adjacent recognition. Servers must be hosted inside the territory, and the licence does not permit US-facing operations. We handle the Client Provider Authorisation (CPA) and the corporate seat together.

Cyprus (CIF) is the dominant EU-passporting route when your primary market is EU retail forex, transposing MiFID II under Law 87(I)/2017 with DORA and the ESMA leverage caps applying. MiCA Article 60 lets a CIF add equivalent crypto-asset services by notification, without a separate Crypto-Asset Service Provider (CASP) authorisation, which is a useful overlay for operators combining FX and crypto. See the Cyprus crypto licensing guide. We deliver the CIF formation and authorisation directly.

ADGM or DFSA (Category 3A) gives regulated-jurisdiction credibility with materially better banking accessibility than EU peers, paired with the UAE’s 9% federal corporate tax and the Qualifying Free Zone Person regime for 0% on qualifying income. We build the Approved Person regime and file the authorisation.

Bahamas or Labuan suit non-EU client bases where the priority is cost-efficient regulated offshore, under the Bahamas Securities Industry Act 2024 and Labuan’s Money Broking Licence respectively. We deliver formation and licensing in both directly through specialists we work with in-country.

Avoid SVG for new forex entrants. The FSA does not issue an FX-specific licence, and its notice of 6 January 2023 required a licence from wherever the activity is conducted. Operators that previously used SVG vehicles have moved to Mauritius, Comoros, Belize, Labuan and the UAE; we will not set you up somewhere we know cannot deliver.

We Form the Company

The operating entity has to be incorporated in the licensing jurisdiction, with the substance the regulator expects, before the licence application moves. We incorporate it, structure the share capital, directors and shareholders around the regime, and build the substance that holds up. This is our work, not a referral.

The right vehicle varies: a Curaçao limited company with a statutory seat on the island, an Anjouan International Business Company, limited companies in Malta, Gibraltar and Cyprus, a Bahamas company limited by shares, a Labuan company, or a private company under the ADGM and DIFC companies laws. Share-capital practice differs too: Anjouan, Kahnawake and the Bahamas accept nominal capital at formation with licensing capital paid up before authorisation, while Curaçao, Malta, Gibraltar and Cyprus need it paid up alongside the application. We sequence the capital so it lands when the regulator needs to see it.

Director and key-person substance is the recurring trap, and where we earn our place. Curaçao requires a resident managing director building to three resident key persons; Malta’s MGA applies fit-and-proper assessment to all qualifying shareholders, directors and key persons; a Cyprus CIF needs two executive plus two independent non-executive directors, a local office, certified personnel and an external auditor; ADGM and DFSA each run an Approved Person regime tied to free-zone presence. We build each to the regulator’s expectation.

For multi-vertical operators (gambling plus payments, forex plus crypto), the most common mistake is layering the holding entity into a jurisdiction the home regulator later treats as an indirect parent for substance purposes, triggering a regulator-led redesign mid-application. We keep the structure clean and pre-clear the parent with the regulator before formation, which routinely takes months off the cycle.

Where in-country capacity is needed, we deliver through a controlled network of vetted lawyers, accountants and licensed specialists we work with directly, never offloaded to an unverified third party. See the company formation hub and the European and offshore formation pages for entity-level detail.

We File the Licence

A high-risk business needs a licence matched to the activity, not a generic “high-risk authorisation”. Gambling operators need a gambling licence from a recognised gaming regulator; forex operators need an investment-firm or securities-broker licence; adult, CBD and OTC verticals are licensed under general commercial frameworks plus activity-specific overlays (the UK Online Safety Act for adult platforms, MiCA for crypto-OTC desks). We draft, file and shepherd the application, and we deal with the regulator directly.

The gambling cluster. Curaçao’s reformed LOK regime is the structural change of the cycle, with the Curaçao Gaming Authority replacing the legacy master-and-sublicence model entirely; eligible applicants are island companies with a statutory seat, a resident managing director and Tier-IV-certified hosting in Curaçao. Anjouan’s Offshore Finance Authority licence permits casino, sports betting, lottery and crypto-gaming, with geo-blocking required for major markets and Financial Action Task Force (FATF) blacklisted jurisdictions. Malta’s MGA splits activity into Type 1 to Type 4 with a compliance contribution scaling by gross gaming revenue; Gibraltar’s Gambling Act 2025 runs six licence categories. Cyprus NBA Class B authorises online sports-event betting only, and Kahnawake’s Client Provider Authorisation grants after a six-month provisional period. We build the fit-and-proper file each regulator expects and tell you up front whether your model fits.

The forex cluster. Cyprus’s CIF licence under Law 87(I)/2017 is the dominant EU-passporting route for retail FX and CFD operators; the ESMA product-intervention regime in CySEC Directive DI-87-09 caps retail leverage, mandates negative-balance protection and the 50% margin close-out rule, and bans monetary inducements, while MiCA Article 60 lets the CIF add crypto-asset services by notification. ADGM’s FSRA licenses dealing as Category 3A and arranging or advising as Category 4; the DFSA mirrors this under its CP161 reforms, both paired with the UAE’s 9% corporate tax and the Qualifying Free Zone Person regime. The Bahamas Securities Industry Act 2024 reorganises registration around functional categories with a CFD overlay, and Labuan offers a Money Broking Licence. We build the Approved Person appointments and deliver formation and authorisation as one engagement, directly or through in-country specialists we work with.

We bring first-hand experience of delivering difficult, multi-jurisdiction licensing in the hardest verticals. In our experience, applications fail most often on the governance file, not the technology file. A money-laundering reporting officer who cannot articulate the operator’s risk appetite in the regulator’s vocabulary, or a board that does not survive fit-and-proper scrutiny, costs more time than any technical gap. We build the governance case before we file. See the crypto licensing hub for the crypto-asset framework that overlays many high-risk operations.

Banking and Payments

Banking and card processing are one of our core services. A licensed operator with no operational account is dark from day one, so we open the accounts as the licence lands. Mainstream banks decline high-risk operators structurally, not personally: whole categories are de-risked without regard to individual profile. The practical effect is that a licensed EU electronic money institution (EMI), not a traditional credit institution, is usually the realistic primary route, with a credit institution reserved for the treasury layer.

The EMI route suits high-risk deposit-and-payout volume: it can issue dedicated IBANs, run SEPA and SEPA Instant flows, safeguard client funds, and operate KYC and AML tooling that scales with transaction count. The answer to provider exits is redundancy: more than one EMI relationship, a card acquirer, and an alternative-rails channel such as Open Banking or a stablecoin off-ramp. Operators with a substantive German or Dutch customer base should also plan for at least one local-country IBAN inside the stack. We do not name providers here by commercial choice; we discuss the realistic options with you directly.

Card acquiring is a parallel workstream tied to the Visa VAMP and Mastercard ECP thresholds, which tightened across the EU, US, Canada and Asia-Pacific from 1 April 2026. Chargeback-management tooling has to be in place before card processing goes live, not after, and we make sure your launch sequence reflects this rather than treating banking as a downstream afterthought.

Ongoing Compliance

Compliance is a permanent operating commitment, not a one-time licensing event, and we build it into the application rather than leave it for you to retrofit. The perimeter runs across AML and counter-terrorist-financing obligations under the new EU Anti-Money Laundering Package, activity-specific overlays (Online Safety for adult, the MiCA Travel Rule for crypto, ESMA conduct for forex, responsible gambling for gaming), card-scheme programme management, and ongoing supervisory reporting.

The EU AML package is the cross-cutting event of 2026. The Anti-Money Laundering Authority (AMLA) is operational in Frankfurt, the AMLR Single Rulebook applies from 10 July 2027 and drops the beneficial-ownership threshold to 25%, and the measures due through 2026 make this the year to complete gap-assessment work. We frame your AML programme to that timeline so you are ready before the regime bites. The EU Travel Rule, in force since 30 December 2024, captures any crypto-OTC desk or stablecoin off-ramp inside the stack, and we account for it in the licence design.

For UK-facing adult platforms, OFCOM’s highly-effective-age-assurance regime under the Online Safety Act 2023 makes self-declaration explicitly insufficient, with penalties up to £18 million or 10% of qualifying worldwide revenue. We build age-assurance and content moderation into the launch plan from the start.

Gambling operators carry AML and CFT programmes calibrated to the regulator (Malta MGA, Curaçao CGA, Gibraltar, Cyprus NBA), responsible-gambling tooling, source-of-funds checks and ongoing audits. Forex operators carry MiFID II conduct overlays, CySEC returns and audited financials, ESMA reporting, and DORA ICT risk management. We size and stand up the compliance function so it survives the regulator’s first review, and we are straight with you about the recurring cost rather than under-pitching it to win the work.

Realistic Timeline

End to end, expect 4 to 12 months for an offshore gambling build (Anjouan or Curaçao), 6 to 14 months for an EU gambling build (Malta or Gibraltar), and 6 to 15 months for a regulated forex build (Cyprus CIF, ADGM or DFSA). The variance is driven by jurisdiction mix, business-model complexity and parent-company structure far more than by the regulator’s own pace. Costs depend on the same factors, so we quote them once we understand what you are building. Book a free consultation and we will scope it.

End-to-End Timeline

What compresses the timeline: a clean fit-and-proper file, pre-drafted compliance documentation, and a parent structure pre-cleared with the regulator. What expands it: regulator backlog, a holding structure assessed for indirect substance, and an MLRO appointed late. We manage every one of these for you, which is the difference between a file that sails through and one that stalls.

Frequently Asked Questions

Banking & Payments

A company and a licence still need a bank account

Banking is one of our three core services. We help high-risk and regulated businesses open the bank and payment accounts that others refuse: we work directly with EU EMIs, payment institutions and crypto-aware banks, confirm appetite before you apply, and make the introduction. Take it with your company and licence, or on its own.

Explore banking & payments →

Related Services

• Gambling & iGaming Licensing: Curaçao, Anjouan, Malta, Gibraltar, Cyprus, Kahnawake
• Forex Broker Licensing: Cyprus CIF, ADGM, DFSA, Bahamas, Labuan
• Company Formation: operating entities in the licensing jurisdiction, formed by us
• High-Risk Banking: the supporting banking and payments layer for operators others decline
• Crypto-Fiat Settlement: SEPA, SWIFT, Open Banking and stablecoin settlement rails