Seven reasons BaaS providers reject applicants

Very few companies get through their first banking-as-a-service application untouched. Some are declined outright, many are stalled in compliance review until they give up, and almost none are told exactly why. The vagueness is deliberate: providers are wary of giving guidance that reads as coaching, and wary of explaining a risk decision they may need to make again.

That leaves applicants guessing, and guessing wrong is expensive. Here are the seven reasons this actually happens.

1. Your sector sits outside their risk appetite

This is the most common reason and the least negotiable. Every regulated provider maintains a list of sectors they will not serve, and a second list they serve only with enhanced scrutiny. Gambling, adult content, crypto, high-value goods dealing, money services businesses, offshore corporate services, arms-adjacent trade and parts of the CBD and supplements world appear on most of them.

You may not think of yourself as being in one of those sectors. Your provider classifies you by what flows through the account, not by how you describe yourself. A marketplace whose sellers include any of the above inherits their classification.

What to do: find out early. Ask, in a first call, whether your specific model sits inside their appetite — before you invest weeks in an application. Appetite varies enormously between institutions, and a decline from one says very little about the next.

2. Your ownership structure is not clean

Providers must identify ultimate beneficial owners and satisfy themselves about every one of them. Three things reliably stall this: an ownership chain running through jurisdictions with limited transparency; a shareholder who cannot or will not provide documentation; and a cap table that has moved several times without being properly documented.

Nominee shareholders, bearer arrangements and trust structures are not disqualifying in themselves, but they convert a two-week review into a two-month one, and some providers decline rather than do the work.

What to do: assemble the full chain up to natural persons before you apply, with documentation for each. If something in the structure is genuinely complex, explain it proactively. An unexplained complexity reads as concealment; an explained one reads as a tax or investor arrangement.

3. Your flow of funds does not make obvious sense

Compliance teams build a mental model of your money: who pays in, why, how much, how often, where it goes. If that model has gaps, they fill them with risk.

Applications get declined when projected volumes are wildly out of proportion to the company's size or funding, when the reason a counterparty in one country is paying an entity in another is not explained, when the model involves pooled funds without a clear reconciliation story, or when the applicant cannot say who their customers will actually be.

What to do: write the flow-of-funds narrative yourself, before anyone asks. One page: who the customers are, what they are paying for, the average and maximum transaction, the monthly volume, the countries involved, and why each leg exists. Clarity here does more for an application than any deck.

4. Your compliance function is too thin for your model

A provider is extending their licence over your activity. They need to believe you can operate inside it. For a low-risk model with modest volumes, a founder with an outsourced MLRO may be sufficient. For higher-risk models, it is not.

Warning signs from their side: no named compliance officer, no written AML policy, no transaction monitoring plan, no sanctions screening arrangement, no idea who handles a suspicious activity report, and no answer for how complaints are managed.

What to do: have the artefacts before you apply, and make them real rather than templated. A policy that names your actual thresholds and your actual escalation path is worth more than a thirty-page generic document.

5. Your volumes are too small to be worth onboarding

Not every rejection is about risk. Onboarding a client costs a provider real money in review, integration support and ongoing monitoring. If your projected revenue does not cover that, some providers will pass — and will usually describe it as a compliance outcome, because that is the less awkward conversation.

What to do: ask about minimums explicitly. If you are early, look for providers who position themselves for early-stage clients, and be honest about your trajectory rather than inflating projections — inflated numbers create expectations that become a commercial problem six months later.

6. Your product touches something they cannot support

Sometimes the model is fine and one feature is not: issuing to customers in a market they do not cover, holding balances in a currency they do not support, a payout pattern their scheme access cannot serve, or a card programme structure their processor cannot configure.

Because it arrives as a decline rather than a scoping conversation, applicants often assume they were rejected on risk when they were actually rejected on capability.

What to do: get your non-negotiable requirements in front of them in the first conversation. Markets, currencies, card types, settlement timing, customer types. If one of those is a hard no, you have saved a month.

7. Something in the application did not match

Compliance teams cross-check. Registered address against the website; director names against the register; described activity against the app store listing; claimed volumes against the filed accounts; the pitch deck against the application form. Mismatches — usually innocent, often just stale — are treated as red flags because from the outside they are indistinguishable from misrepresentation.

What to do: before applying, review your public footprint against what you are about to submit. Update the register, fix the website, retire the old landing page, and make sure the entity you are applying with is the entity everything else points at.

What rejection actually tells you

Mostly: that one institution's risk appetite, at one moment, did not include you. Appetite shifts with the provider's own regulatory pressure, portfolio concentration and commercial strategy. Companies routinely get declined by one provider and approved by another within the same quarter, with no change to their business.

The mistake is treating the first decline as a verdict and either giving up or reapplying identically somewhere else. The productive response is to work out which of the seven it was — asking directly is worth a try, and a straightforward "was this appetite, structure, or capability?" sometimes gets an honest answer — then fix that specific thing and target providers whose stated appetite matches your model.

Where Finlane fits

Finding out which providers have appetite for your model is most of the work, and it is work usually done through a sequence of introductory calls. On Finlane you describe your requirements once and vetted providers in the matching category respond to them — so appetite surfaces from the responses rather than from six weeks of scheduling. You stay anonymous until you accept a provider, and it is free for buyers.

If you are earlier than that, the guide on choosing a BaaS provider in Europe covers what to have ready before you approach anyone.