If your business sits in crypto, iGaming, forex or adult entertainment, choosing an IBAN provider is not a one-size question. Named accounts give you a direct, unambiguous legal claim on the funds and the cleanest compliance profile; pooled accounts are often faster and cheaper to set up but can leave your claim on the money legally murkier if the provider fails or a dispute arises.
Direct Answer
The single most important choice is structural: whether the IBAN is issued in your business's own name (a named account) or allocated as a sub-ledger inside a provider's shared pool (a pooled or omnibus account).
Beyond that structural question, a genuinely useful high-risk IBAN provider needs to be evaluated on its own licensing status, its safeguarding arrangements, its actual currency and payment-rail coverage, and whether its stated risk appetite for your specific vertical is real or just marketing copy. Too many high-risk businesses pick a provider off a "high-risk friendly" listicle and only discover the gaps once money is moving.
This guide sets out what a virtual IBAN actually is, why named and pooled structures behave so differently in practice, the criteria worth checking before you sign anything, and why "IBAN discrimination" against compliant high-risk businesses remains a real, documented problem rather than a myth.
What Is a Virtual IBAN, and How Is It Different from a Bank IBAN?
A traditional bank-issued IBAN is tied directly to an account held at a licensed bank, sitting on that bank's own balance sheet and typically falling under a national deposit-guarantee scheme up to a set threshold.
A virtual IBAN (vIBAN) is different. It is an International Bank Account Number issued by an electronic money institution (EMI) or a payments infrastructure provider, routing payments through one or more underlying bank accounts that the provider itself holds. The virtual IBAN gives your business a stable-looking account number for receiving and sending payments, but the actual money typically sits in an account (or accounts) the provider controls, not one opened directly in your name at a bank.
This is not automatically a problem. Many well-run EMIs use virtual IBANs precisely to give high-risk businesses fast SEPA and SWIFT access that a traditional bank would decline outright. But the structure behind the vIBAN determines how safe your funds are, how quickly you can be onboarded, and what happens if things go wrong. That structure comes down to a named-account model or a pooled-account model.
Named Account vs Pooled Account: The Distinction That Matters Most
A named-account structure means the IBAN is issued and held directly in your business's own legal name at the underlying bank or via a segregated sub-account clearly earmarked as yours. Your business has a direct, traceable, contractual relationship to those specific funds. If the provider runs into difficulty, your claim to the money is comparatively clean: it is identifiably yours, not commingled with anyone else's.
A pooled or omnibus-account structure works differently. The provider holds one large account (often at a partner bank) in its own name, and allocates internal sub-IBANs to individual clients purely as an internal bookkeeping and routing mechanism. From the outside, payments still appear to move in and out of "your" IBAN. Internally, your funds sit inside a single shared pool alongside every other client's funds, distinguished only by the provider's own ledger.
Pooled structures are often faster to set up (no need to open a bespoke account with an underlying bank for each client) and can be cheaper to run at scale, which is part of why so many EMIs default to this model for high-risk onboarding. The trade-off is real. If the provider becomes insolvent, is subject to regulatory action, or has a dispute with its own banking partner, a client's claim on funds inside a pooled account is generally harder to establish and can take considerably longer to resolve than a claim on a named account, because a liquidator or administrator first has to reconstruct whose money is whose from internal records rather than from the bank's own account title.
This is not a hypothetical concern. In its 2026 review of payment institutions, the European Banking Authority (EBA) flagged money-laundering monitoring gaps and weaknesses in consumer and business protection specifically in pooled-account and safeguarding models, noting that internal record-keeping quality varies significantly between providers and that this variance directly affects how quickly and how completely clients can be made whole if something goes wrong. That review does not mean every pooled-account provider is poorly run; several maintain rigorous, auditable internal ledgers. It does mean the burden is on the business to verify the quality of that record-keeping before relying on it, rather than assuming it is equivalent to a named account by default.
What Should a High-Risk Business Actually Check Before Choosing a Provider?
Marketing pages describing a provider as "high-risk friendly" tell you almost nothing about whether the underlying structure is sound. The criteria that actually matter sit underneath that headline claim.
Licensing status of the provider itself. Is the provider a licensed EMI, a licensed payment institution, or an unregulated intermediary reselling access to someone else's licence? A provider operating under its own direct authorisation from a recognised regulator (rather than as an unlicensed agent of one) is accountable in a way an unlicensed reseller is not.
Safeguarding and segregation arrangements. Ask specifically how client funds are safeguarded: held in a segregated account at a separate bank, covered by an insurance or guarantee arrangement, or simply commingled with the provider's own operating funds. Under frameworks derived from PSD2, EMIs are typically required to safeguard client funds, but the quality and transparency of that safeguarding varies enormously between providers.
Named vs pooled structure, as set out above, ideally confirmed in the account agreement itself rather than taken on trust from a sales conversation.
Currency coverage and payment-rail access. Confirm which currencies the provider can genuinely settle in, whether it offers direct SEPA access, SWIFT access, or both, and whether cross-currency payments route through additional intermediary banks that add cost and delay.
Actual risk appetite for your specific vertical, not a generic "high-risk friendly" claim. A provider that happily banks forex brokers may still decline iGaming outright, and a provider comfortable with adult entertainment may treat crypto exchanges as entirely out of appetite. Ask for vertical-specific onboarding experience and expected documentation requirements before applying, rather than discovering the mismatch mid-application.
- Regulatory status: is the provider directly licensed, or an agent/reseller of someone else's licence, and in which jurisdiction?
- Safeguarding transparency: will the provider confirm, in writing, exactly how and where client funds are held?
- Account structure: is the IBAN named in your business's own legal name, or a sub-IBAN inside a pooled account?
- Currency and rail coverage: does the provider genuinely support the currencies and payment rails your business transacts in, without routing through costly intermediaries?
- Vertical-specific appetite: has the provider actually onboarded businesses in your specific sector recently, or only adjacent ones?
- Exit and portability: how easily can you move funds and close the relationship if the provider's risk appetite changes later?
Why Does "IBAN Discrimination" Still Happen to Compliant Businesses?
IBAN discrimination refers to a payment being refused, delayed, or an account application declined purely because of the country of the IBAN or the perceived business category, rather than any specific compliance failing in the applicant. The EU's PSD2 framework and related guidance were intended to prohibit exactly this kind of discrimination for cross-border SEPA payments within the euro area, requiring that a business IBAN issued in one member state be treated the same as a domestic account for payment purposes.
In practice, high-risk businesses report a related but distinct pattern: refusal not on the country of the IBAN but on the business category itself, applied as a blanket policy regardless of how compliant the individual applicant is. Regulatory guidance and enforcement in this area continues to develop, and documented patterns suggest that some institutions still apply category-level blocking as a risk-management shortcut rather than assessing individual applications on their actual merits. This is typically not framed as unlawful discrimination in the strict PSD2 country-based sense, but the practical effect for a well-documented, fully compliant high-risk business is often indistinguishable: a refusal that has little to do with the specific application in front of the underwriter.
This is precisely why matching a business to the right provider, rather than the first one willing to open an account quickly, tends to matter more for high-risk applicants than for low-risk ones. A named-account, properly licensed provider with genuine appetite for your vertical will typically assess the application on its merits; a provider applying blanket category exclusions will decline regardless of how strong your documentation is.
Named vs Pooled: A Structural Comparison
| Factor | Named account | Pooled / omnibus account |
|---|---|---|
| Legal claim to funds | Direct and clearly identifiable as the business's own | Indirect; depends on the quality of the provider's internal ledger |
| Typical onboarding speed | Often slower, in the region of a few weeks | Often faster, sometimes days, since no bespoke account is opened per client |
| Safeguarding transparency | Generally higher; funds are traceable to a specific account title | Varies significantly by provider; requires direct verification |
| Insolvency/dispute exposure | Lower; funds are segregated and identifiable | Higher; reconstruction of client claims can be slow and contested |
| Best suited to | Established businesses moving meaningful transaction volumes, or those prioritising legal clarity | Early-stage or smaller businesses prioritising speed of setup, provided safeguarding is independently verified |
Figures and timelines above are indicative and will vary by provider, jurisdiction, and the specific business's transaction profile.
Example
A composite mid-sized forex brokerage, already turning over a meaningful volume of client funds, was initially onboarded onto a pooled-account IBAN structure by an EMI chosen mainly for its two-day setup time. Roughly a year later, that EMI came under regulatory scrutiny over its safeguarding practices, and the brokerage's access to its own operating funds was frozen for several weeks while administrators reconstructed which pooled funds belonged to which client. Following that experience, the business restructured onto a named-account IBAN with a differently licensed provider, accepting a longer onboarding period in exchange for a direct, clearly documented legal claim on its funds. No client-facing service was disrupted by the switch, but the operating disruption during the freeze illustrated exactly the exposure a pooled structure can carry.
Final Takeaway: Choose the account structure before you choose the provider. A named IBAN with a slower onboarding is usually the safer trade for a high-risk business than a fast pooled IBAN with an unverified safeguarding story.
Conclusion
Choosing a high-risk IBAN provider is rarely just a question of who says yes fastest. The structural choice between a named account and a pooled account shapes how safe your funds are and how quickly you could recover them if a provider runs into difficulty, and the EBA's own 2026 review makes clear that safeguarding quality in pooled models is genuinely uneven across the market. Layering the right licensing checks, safeguarding verification, and vertical-specific risk-appetite questions on top of that structural choice is what separates a durable banking relationship from one that quietly becomes a liability months later.
How BankMyCapital Helps
BankMyCapital is not a bank, EMI, or payment service provider, and does not hold or safeguard client funds directly. We work as a compliance-first intermediary, assessing which IBAN structures and providers genuinely suit your business's vertical, transaction profile, and risk tolerance, then mapping that against the actual (not marketed) risk appetite of relevant banking and EMI partners before making structured introductions. That includes checking licensing status, safeguarding arrangements, and named-versus-pooled structure on your behalf before you commit to an application. Our own fee starts from 1,500 EUR, with any EMI onboarding fee charged separately by the institution itself. Our /services/banking hub covers the full range of high-risk account-opening support this guide sits alongside.