A bank account for a VASP (virtual asset service provider, the FATF term) is opened once the VASP has proved three things: the license or registration its country requires, who owns and runs it, and whose money will move through the account. Most refusals trace back to one of those answers arriving incomplete or in a form the bank's compliance team cannot file.
The question got sharper in 2026. Costa Rica, since September 19, and Brazil, from November 6, forbid banks to serve providers that are not registered or authorized, and the MiCA transition period in the European Union is over. For a VASP, the account question has become a licensing question. The basics of the category are in our VASP explainer.
Why banks and EMIs hesitate to bank a VASP
A bank that turns away a whole sector is de-risking, and both the global standard setter and the EU banking regulator have said that is the wrong answer. The FATF's updated guidance on virtual assets of October 2021 tells financial institutions to apply a risk-based approach to VASP clients and not to resort to "wholesale termination or exclusion" of the sector without a targeted risk assessment (paragraph 23).
The European Banking Authority went further in its Opinion on de-risking, EBA/Op/2022/01 of January 5, 2022: refusing entire categories of customers without looking at individual risk profiles "can be unwarranted and a sign of ineffective ML/TF risk management." The report attached to the opinion names VASPs among the customer groups most affected, and records respondents denied the bank accounts they needed to run fiat gateways to crypto.
None of that obliges a given bank to say yes. It moves the burden: the bank is expected to assess the individual VASP. The VASP that arrives with a complete, legible file gets assessed. The one that arrives with a pitch deck gets declined on the cost of finding out.
The corporate documents a bank or EMI asks a VASP for
There is no regulator-published checklist for a VASP's bank or EMI account. The table below is the common core of three sources we read on October 31, 2026: the VASP onboarding page of Narvi, a Finnish e-money institution (EMI); Clear Junction's guide for money services businesses; and the KYB (know your business, the verification of a company and its owners) requirements in our own documentation.
What a bank or EMI typically asks a VASP for, and the usual failure
Item | What it proves | Common failure |
Articles of incorporation, registry extract | The company exists and who may sign | Foreign-language copies not from an official registry |
Recent proof of address | The company is where it says it is | Older than the bank's window (90 days at Lumx) |
Ownership chart to natural persons | Who controls the money | Stopping at the holding company |
ID for owners and signatories | The people behind the entity | One signatory missing |
License or registration per country | The activity is lawful where it happens | A pending application presented as a license |
AML policy and AML officer | Controls exist and someone owns them | The AML officer is also a director or owner |
Risk assessment | The VASP knows its own exposure | A template not tied to the products offered |
Source of wealth and source of funds | Where the starting capital came from | Crypto gains with no exchange statements |
Fund-flow map with expected volumes | Whose money moves, from where, to where | Treasury and client funds drawn as one arrow |
Two rows do most of the deciding. The license row is now binary in Brazil, Costa Rica and the EU, as the next sections show. The fund-flow map is where the reviewer decides which account you can get. Clear Junction's advice is blunt: "Have a clear fund flow map." Narvi lists as reasons to decline a VASP that "is not properly licensed or still waiting for license approval," and says it can discuss a more limited account, for the company's own expenses, with applicants still awaiting one. The KYB step itself is covered in our guide to KYB.
Your fund-flow map decides the account type
A VASP moves three kinds of money, and a bank treats each differently.
Corporate money is the VASP's own: capital, revenue, payroll, vendors. It needs an ordinary business account with enhanced due diligence on top, the easiest account to get and the one every VASP needs first.
Settlement money is also the VASP's own, used to buy and sell assets with liquidity counterparties. It moves in larger, lumpier amounts, often to exchanges, so the bank asks who the counterparties are and how they were checked.
Client money belongs to the VASP's users. This is the account banks resist most, because the bank carries the risk of every end user it never onboarded. In the EU it is mandatory: Article 70(3) of MiCA (Regulation (EU) 2023/1114) requires a crypto-asset service provider to place client funds other than e-money tokens with a credit institution or a central bank by the end of the next business day.
Drawing the three as separate lines, with volume and counterparties on each, is the change that most improves a VASP's file. It lets the reviewer approve the part they can approve instead of declining the whole. It also shows where a named virtual account fits and where a pooled structure is the honest description, which we set out in named versus pooled accounts.
When a VASP asks us for an account, I ask for the fund-flow map before the license. The license tells me the company may operate; the map tells me whether the account it is asking for is the account it needs. More than once the honest answer was that the company needed two things: a corporate account in its own name, which we could provide, and a client-money structure, which had to sit with a bank under its own license.
Brazil after November 6, 2026
From November 6, 2026, Brazilian banks, payment institutions and other institutions authorized by the Central Bank of Brazil (BCB) may not carry out or enable virtual asset operations with counterparties that provide virtual asset services and are not authorized by the BCB to operate in the country. That is Article 91 of BCB Resolution 520/2025 of November 10, 2025, as amended by BCB Resolution 589/2026 of September 23, 2026. Its sole paragraph extends the ban to foreign exchange and to opening and maintaining payment accounts when they serve those operations.
Resolution 589/2026 changed two things. It moved the start date from October 30 to November 6, 2026. And it removed "or in the process of authorization" from the description of the providers the ban spares. In the original text, a provider that had filed was outside the ban; the current text names only authorized providers. How the BCB and the banks will treat pending applicants is a question for counsel, and we would not plan a Brazilian banking relationship around a reading of it. A VASP with a pending application should ask its bank, in writing and before November 6, how the bank reads Article 91.
The ban sits on top of the transition rule in Article 88. Companies already providing virtual asset services when Resolution 520/2025 took effect, on February 2, 2026, had 270 days to file for authorization, a period that ended on October 30, 2026. Those that filed in time may keep operating until the BCB decides. Those that did not must stop within 30 days, which by our count is November 29, 2026. What a PSAV (Prestadora de Serviços de Ativos Virtuais, Brazil's virtual asset service provider authorization) is, and how it is obtained, is in our PSAV explainer; the wider set of rules is in stablecoin regulation in Brazil.
For a VASP looking for a Brazilian account, the authorization status is now the first document the bank reads. Article 91 does not distinguish by country of incorporation: a foreign VASP serving Brazilian clients faces the same question.
The EU and Costa Rica also gate on registration
In the European Union, Article 59 of MiCA allows crypto-asset services only from an authorized crypto-asset service provider (CASP) or from a credit institution, e-money institution or other entity allowed to provide them. The transition period of Article 143(3) ended on July 1, 2026 at the latest. An EU bank reviewing a VASP today expects a CASP authorization or a clear reason why one is not needed. What MiCA changes for payment companies is in MiCA stablecoin rules.
Costa Rica follows the Brazilian mechanism. A reform of Law 7786 approved in May 2026 requires virtual asset providers to register with SUGEF, the financial supervisor, for anti-money-laundering purposes. KPMG Costa Rica notes that registration does not authorize the provider's operations. LexLatin reports that the reform took effect on September 19, 2026, bars financial institutions from dealing with unregistered providers, and gives a registered provider no right to a bank account. Those are summaries, not the official gazette, and sources differ on the enactment date, so confirm it with SUGEF.
All three work the same way. Authorization or registration is the precondition for a bank to talk to you, and no regime turns it into a right to an account. The next question banks will ask is the Travel Rule, which Brazil makes mandatory from February 2, 2028 under Article 89 of Resolution 520/2025; our Travel Rule guide has the international picture.
When a payments-provider account is the wrong tool for a VASP
An account through a payments infrastructure provider, ours included, is the wrong tool when the VASP wants to run its clients' money through it as if it were its own.
A VASP that collects deposits from thousands of users into one account in its own name is running an omnibus structure, and every one of those users is a party the provider and its banking partner never onboarded. Our nested payments policy requires every transaction to belong to an onboarded customer's own funds and does not allow a virtual account to pool or commingle the funds of multiple third parties. Anything outside that needs our compliance team's written approval in advance.
It is the wrong tool for a VASP without the license its jurisdiction requires. Our prohibited activities list treats exchanges, OTC desks, custody providers and stablecoin issuers as high risk, allowed with disclosure and enhanced due diligence, and prohibits virtual asset providers operating without required licenses.
Nor can it hold MiCA client money. Article 70(3) wants those funds at a credit institution, and a payments provider is not one.
What a VASP's own BRL account looks like with Lumx
Lumx is stablecoin payments infrastructure for businesses that move money between Latin America and the rest of the world: one API to collect, hold, convert, and pay out in BRL, MXN, COP, USD, EUR, and GBP or in USDC and USDT, over local rails such as PIX, SPEI, PSE, Bre-B, ACH, FEDWIRE, SEPA, and Faster Payments, with SWIFT and on-behalf-of payments and collections (POBO and COBO) in USD, EUR, and GBP, plus named virtual accounts, custodial wallets, and KYB/KYC built in.
For a VASP the relevant piece is the named virtual account, a fiat account issued by a Lumx banking partner in the customer's own name. A Brazilian VASP gets a BRL account in its own corporate name that receives Pix (Brazil's instant payment system, run by the Central Bank) transfers. Deposits can be converted to USDC or USDT automatically by a conversion rule. It is the corporate and settlement account from the fund-flow map, for the VASP's own money.
Onboarding is the KYB file from the table, sent through the API. The VASP declares a regulated activity, which makes the license or proof of regulated activity a required document, alongside articles of incorporation, a proof of address from the last 90 days, and ID and address for each owner of 25% or more and each legal representative. A VASP is a high-risk business type under our policy, so the review includes enhanced due diligence, and open questions come back as an RFI (request for information, a compliance hold that asks for a document before a transaction clears) naming the missing document. Once the customer is approved, a BRL account is active immediately.
Which regulated entity sits behind each rail is on our supported countries page. A VASP's compliance lead should read it next to the VASP's own authorization status before the first transfer.
Methodology and sources
BCB Resolutions 520/2025 and 589/2026 were read on October 31, 2026 from the text served by the BCB's normative search endpoint, because the bcb.gov.br pages return only a JavaScript shell; the October 30 end of the Article 88 window is our calculation from the 270-day period. The FATF guidance and the EBA opinion were read from copies hosted by Romania's financial intelligence unit and the Bank of Russia, because fatf-gafi.org returned 403 and the EBA link we tried returned 404. MiCA was read on EUR-Lex. Costa Rica rests on KPMG Costa Rica and LexLatin. Lumx's requirements come from docs.lumx.io pages on business verification, document types, accounts, nested payments and prohibited activities, all read on October 31, 2026.
Verified on October 31, 2026. Operational context, not legal, tax, or investment advice. BCB Resolutions 520/2025 and 589/2026 checked against bcb.gov.br on October 31, 2026. MiCA (Regulation (EU) 2023/1114) checked against eur-lex.europa.eu on October 31, 2026.
Cover photo: Etienne Martin on Unsplash.
Can a VASP open a bank account in Brazil after November 6, 2026?
A VASP authorized by the Central Bank of Brazil can, subject to the bank's due diligence. From November 6, 2026, Article 91 of BCB Resolution 520/2025, as amended by Resolution 589/2026, bars banks and payment institutions from enabling virtual asset operations, including through payment accounts, with providers the BCB has not authorized. How that applies to a pending application is a question for counsel.
What corporate documents does a bank or EMI ask a VASP for?
Articles of incorporation, a recent proof of address, an ownership chart down to natural persons, ID for owners and signatories, the license or registration in each country, the AML policy, a risk assessment, source of wealth and funds, and a fund-flow map with expected volumes. Documents in another language often need a certified translation or a copy from an official registry. At Lumx, a VASP that declares a regulated activity must also send its license or proof of regulated activity, and the proof of address must be from the last 90 days.
Is a registered VASP entitled to a bank account?
No. Brazil, Costa Rica and the EU make authorization or registration a precondition for a bank to deal with a provider, and none turns it into a right to an account. The FATF and the EBA say refusing a whole sector is poor risk management, but neither obliges a bank to serve a given VASP.
Can a VASP use a virtual account for its clients' deposits?
Not at Lumx without prior written approval. Our nested payments policy requires every transaction to belong to an onboarded customer's own funds and does not allow a virtual account to pool multiple third parties' funds. A VASP's account with us is for its own corporate and settlement money.
Does Lumx serve VASPs?
Yes, as a high-risk category with enhanced due diligence. A VASP holding the license or registration its jurisdiction requires can be onboarded through our KYB flow and receive a named virtual account in its own name. VASPs operating without a required license are on our prohibited list.
