Banking for Exchanges, Desks and Funds. What a risk committee tests.

A software company applying for banking is assessed on its own activity. An exchange, OTC desk, broker or fund is assessed on its activity and on the activity of everyone whose money passes through it. That distinction changes the entire underwriting exercise.

The institution is effectively accepting indirect exposure to your customer base. If your onboarding is weak, their exposure is weak. If your monitoring misses something, their monitoring missed it too. This is why applications from trading businesses spend most of their time not on the business model but on the client-onboarding and transaction-monitoring architecture behind it.

It also explains why volume, which founders assume is persuasive, is not the deciding factor. A large flow from an unverified retail base is a harder file than a modest flow between identified institutional counterparties. Composition beats size in almost every committee.

The businesses that get banked are the ones that can show, with documents, that they operate to something close to the standard the institution applies itself.

Any business holding customer balances must be able to describe exactly where those balances sit, how they are segregated from corporate funds, and how they are reconciled.

Segregation is the baseline. Client fiat should sit in designated client accounts, legally and operationally distinct from the operating account used for payroll, suppliers and corporate expenses. Commingling is a finding that ends applications and, in most regimes, a regulatory breach.

Reconciliation must be documented and frequent. Institutions ask how often client balances are reconciled against the ledger, who performs it, who reviews it, and what happens when a break is identified. A daily documented reconciliation is the expected answer.

Settlement design should be explicit. How fiat enters, how it is attributed to a customer, how it is converted, how it is withdrawn, and to whose account. Third-party payments — money arriving from or leaving to someone other than the account holder — are among the highest-risk patterns in the sector and must either be prohibited by policy or tightly controlled and explained.

Custody of digital assets is assessed alongside the fiat design: whether custody is self-managed or with a qualified custodian, key-management controls, multi-signature or MPC arrangements, cold and hot wallet policy, and insurance where held. An institution's comfort with your fiat rail depends in part on its comfort that your asset side is not about to produce a solvency event.

Institutions will map your counterparties. Expect to provide a list of your largest by volume, with jurisdictions and, for institutional counterparties, their own regulatory status.

Institutional and verified corporate flow is the strongest profile. The counterparties are identifiable, regulated in many cases, and the relationships are documented. Desks trading with licensed venues and known liquidity providers occupy the most favourable position in the sector.

Retail flow is harder in proportion to how it is verified. A retail exchange with full KYC, sanctions screening, source-of-funds thresholds and documented enhanced due diligence for larger customers is bankable. One relying on light verification is not, at any credible institution.

Geographic exposure is tested directly. Where your customers are, what proportion sit in higher-risk jurisdictions, and how sanctioned jurisdictions are blocked at the technical level rather than only in the terms of service. IP-level and KYC-level controls are both expected, and institutions ask which you actually operate.

Peer-to-peer models and anonymity-preserving flows are the hardest profiles in the market. They are not unbankable in every case, but they require a materially stronger compliance argument and a narrower set of institutions.

For trading businesses, the compliance stack is the product being underwritten. It should be documented as such.

Governance: a named compliance officer with relevant experience and genuine authority, a reporting line to the board, an MLRO where the regime requires one, and evidence that compliance can block onboarding and freeze activity.

Customer onboarding: written KYC and KYB procedures, identity verification tooling, sanctions and PEP screening at onboarding and on an ongoing basis, source-of-funds thresholds, and defined enhanced due diligence triggers.

Transaction monitoring: rule sets with stated thresholds, alert handling procedures, case management, and suspicious activity reporting workflow with evidence that reports have been filed where appropriate. A monitoring system that has never generated a report on meaningful volume invites scepticism rather than confidence.

On-chain analytics: blockchain screening of deposits and withdrawals, wallet risk scoring, exposure thresholds for mixers, sanctioned addresses and darknet-linked funds, and a documented procedure for handling tainted deposits.

Assurance: internal testing, independent compliance review or audit, and a record of remediation where deficiencies were identified. A file that includes a review with findings and completed remediation is stronger than one that claims no findings at all.

Training and record-keeping: staff training records, policy version control, and retention procedures.

Trading businesses generally need more than one type of relationship, and matching the need to the institution type prevents wasted quarters.

Corporate operating account. Payroll, suppliers, tax and general expenses. This is the easiest relationship to place and should be separated from client flow entirely. A bank in the jurisdiction of incorporation is the natural home.

Client money and settlement rails. Named multi-currency accounts, SEPA and SWIFT access, and the capacity to handle high transaction counts. Specialist electronic money institutions in the EU and licensed institutions in the UAE, Hong Kong and Singapore are the principal categories here, alongside international banks in established financial centres for larger balances.

Treasury and custody-adjacent banking. Where meaningful balances are held, a bank relationship offering treasury products and, in some cases, credit becomes valuable. These relationships require the strongest files and the largest balances.

Card acquiring and consumer payment-in. A separate discipline from banking, handled by acquirers and payment service providers with their own underwriting, chargeback reserves and rolling settlement terms. Businesses frequently assume banking approval implies acquiring approval; it does not.

Fiat on and off ramps. Crypto-native payment institutions providing conversion and settlement, useful as an operational layer alongside, not instead of, a bank relationship.

Redundancy is not optional at this scale. An exchange that loses its settlement rail without a live alternative stops operating within days, and that operational risk is itself something counterparties and institutions assess.

For trading businesses the licensing question is not whether, but where and how many. Activity that touches customers in multiple markets frequently requires authorisation in more than one.

The main frameworks institutions underwrite against are the EU regime for crypto-asset service providers, the UAE regimes operated by the federal and free-zone authorities, Hong Kong's virtual-asset trading platform licensing, and Singapore's payment-services regime. Each has published expectations that compliance teams test directly.

Substance requirements follow the licence and are enforced. Resident directors, local compliance staff, a genuine office, local governance, and decision-making in the jurisdiction. Institutions verify these independently, and a mismatch between claimed and actual substance is a serious adverse finding.

Group structures need to be coherent. A licensed operating entity, a holding company, an intellectual property entity and a treasury entity is a normal and explicable structure. The same entities spread across unconnected jurisdictions with no operational logic is not, and intercompany flows within such a structure attract disproportionate scrutiny.

Where an entity is deliberately unlicensed because it serves only institutional counterparties or operates outside a regulated perimeter, document that position with legal support. It is a defensible position when evidenced and a fatal one when merely asserted.

Assessment. A full review of the entity, group structure, licensing, client-money design, counterparty composition and compliance stack, producing an honest read on whether the profile is currently placeable and, if not, precisely what would need to change.

Remediation. In most trading-business mandates something needs fixing first: a documented reconciliation procedure, an updated monitoring rule set, a client-money policy, a legal opinion, or a governance change. Doing this before an institution sees the file is materially cheaper than doing it after a decline.

File construction. The corporate pack, the compliance pack, the business narrative, the flow-of-funds documentation and the counterparty analysis, assembled so that a committee can reach a decision without a chain of follow-up questions.

Matching and introduction. Approach the specific institutions whose current appetite fits the profile, one or two at a time, with the file presented in the terms their risk function uses. Institutional appetite in this sector changes quarterly, so currency of information matters more than breadth of contacts.

Due diligence support. Answering enhanced due diligence questions promptly and completely. Most files that fail at this stage fail on responsiveness rather than on findings.

Onboarding and rail testing. Account activation, test transactions, threshold agreement, and documenting the operating parameters so that normal activity does not trigger review in month one.

Expect three to six months for a bank relationship and less for a specialist payment institution. Expect to be asked for things twice. Expect at least one institution to decline for reasons it will not fully disclose; this is normal and is why matching, not volume, is the discipline that matters.

We advise digital-asset trading businesses on banking, payment rails and the structuring work that precedes them. We do not hold client funds, operate accounts, or promise outcomes, and no institution can be committed ahead of its own due diligence.

Our network spans more than a hundred banking and payment institutions across Europe, the Middle East, Asia and international financial centres, and we maintain a current view of which are open to exchanges, desks, market makers and funds, and on what terms.

We work only with lawfully structured and appropriately authorised businesses, and the first output of any engagement is an honest assessment. Where a profile is not placeable we say so and set out what would change that, which is frequently a licensing, governance or client-money question rather than a banking one.

Where a case exists we prepare the file, run the introductions, and support the due diligence process through to activation, building redundancy deliberately so that a single closure notice is not an existential event.