Bank Accounts for High-Risk Customers: KYC, AML and Onboarding in Estonia

Bank account applications from high-risk customers are assessed under a provider’s risk-based KYC and AML framework. A higher-risk profile can mean more questions, supporting documents, senior review or ongoing monitoring; it does not automatically mean wrongdoing, and it does not guarantee acceptance or refusal.

Article updated: 11 October 2026. This guide explains what financial institutions may mean by a high-risk customer, how customer due diligence works, what a business can prepare, and where Eesti Consulting may assist with the Estonian company documents and onboarding file.

What does “high-risk customer” mean?

“High risk” is an internal compliance assessment, not a label that proves a customer has committed an offence. A bank or payment provider evaluates the customer, beneficial owners, business model, countries involved, expected transactions and source of funds. The provider decides which controls are proportionate to the risks and to its own risk appetite.

Factors that may lead to additional checks include a complex or opaque ownership chain, an unusual transaction pattern, a business that handles substantial cash, a politically exposed person, links to jurisdictions subject to enhanced scrutiny, activity in a sector with elevated financial-crime exposure, or a mismatch between the company’s stated purpose and the payments it expects to receive. A non-resident founder or an e-Residency card alone does not determine the result. Institutions assess the whole relationship and the evidence available.

Estonian law requires obliged entities to apply customer due diligence and set the scope of checks according to assessed risk. The current Money Laundering and Terrorist Financing Prevention Act describes customer identification, beneficial-owner checks, understanding the purpose of the relationship and enhanced due diligence. The Estonian Financial Supervision Authority’s AML guidance links to national and EBA risk-factor guidance.

How do KYC and AML checks work?

KYC means “Know Your Customer”: the provider verifies who is applying and understands the customer’s activities. AML means anti-money laundering. In practice, onboarding combines identity verification, sanctions and politically exposed person screening, beneficial-owner checks, a review of the business purpose and an assessment of anticipated account use. The exact process varies by provider and product.

1. Identity and authority

Expect to identify each director, account user, representative and beneficial owner. The provider may verify identity against reliable independent sources, check the authority to act for the company and ask for company registry documents. Remote onboarding may require a video call, an approved electronic identity document or additional verification.

2. Ownership and control

Prepare a clear ownership chart showing every person who ultimately owns or controls the company. Explain intermediate entities, trusts, nominee arrangements or unusual voting rights. If ownership is straightforward, say so and provide the supporting register extracts. Keep names and percentages consistent across the application and corporate documents.

3. Business purpose and expected account activity

Describe what the company sells, who its customers and suppliers are, where they are based, how it delivers the service and why it needs the account. Give realistic estimates for monthly turnover, transaction size, payment corridors, currencies and cash use. If funds will come from investors, group companies, asset sales or savings, explain that flow and provide the relevant agreements or records.

4. Source of funds and source of wealth

“Source of funds” explains where money for a particular payment or account balance came from. “Source of wealth” explains how a person accumulated their overall assets. Depending on the risk assessment, an institution may request contracts, invoices, tax returns, audited accounts, sale agreements, payslips, bank statements or evidence of investment proceeds. Provide genuine records and explain any gap or inconsistency rather than trying to shape activity to fit a bank’s checklist.

5. Screening, decision and ongoing review

The provider may compare applicants and transactions with sanctions lists, public sources and internal risk indicators. If it needs more information, reply accurately and within the stated deadline. An account may be subject to transaction limits or periodic reviews. Material changes—new ownership, a new business line, a new country corridor or much higher turnover—should be reported when required by the provider.

The European Banking Authority’s ML/TF risk-factor guidelines describe how institutions consider customer, product, geography and delivery-channel risks. They do not create a universal checklist that guarantees approval.

Documents to prepare before applying

• Company registry extract, articles of association and details of directors and authorised account users.
• Ownership chart and identification documents for beneficial owners.
• A concise business plan, website or product description, and explanation of the company’s commercial connection to Estonia where relevant.
• Customer and supplier examples, signed contracts, purchase orders, invoices or letters of intent, where available.
• A 12-month transaction forecast: expected turnover, typical amounts, countries, currencies and payment purposes.
• Evidence for initial capital and the source of funds expected to enter the account.
• Licences, professional registrations or compliance policies relevant to the company’s actual activity.
• Recent financial statements and tax documents for an established business, if requested.

Do not manufacture invoices, customers, contracts, local presence or transaction history. A coherent explanation supported by genuine evidence is safer than material that contradicts the company’s actual operations.

Can an Estonian company opened by an e-resident get a bank account?

It can apply, but company registration and e-Residency do not guarantee a bank account. An institution may ask how the company is managed, where its customers and suppliers are, what economic activity connects it to Estonia, and whether it serves the provider’s permitted customer profile. A provider may also decide it cannot support a particular sector or country corridor.

Compare the requirements of banks and regulated payment institutions, but verify each provider’s current terms directly. A payment account or e-money service may not be the same as a bank deposit account, and products differ in safeguarding, deposit-guarantee coverage, available services and geographic availability. See our guides to Revolut Business for an Estonian company and Estonian e-Residency for related setup questions.

Our ready-made company Estonia page explains a separate company-acquisition route. Buying an existing company does not remove the new owner’s due-diligence obligations; the provider will still assess the actual ownership, business purpose and transaction profile.

What to do if an application is delayed or declined

Ask the provider whether it can identify a missing document or an unanswered question. A decline may reflect a provider’s product scope or risk appetite; it does not necessarily mean the company breached a rule. Do not submit repeated applications with inconsistent facts, and do not conceal a prior refusal if asked. Correct errors, obtain the relevant corporate or financial evidence, and approach another provider only after checking that its services and eligibility fit the business.

If an account is restricted, follow the provider’s formal review or complaint process and respond to requests using its secure channel. Institutions may be legally limited in what they can disclose about suspicious-activity reviews. Do not attempt to route around a restriction through another person’s account.

How Eesti Consulting may help

Eesti Consulting can help with the Estonian company-side preparation: obtaining or organising registry documents, clarifying director and ownership details, reviewing whether the registered address and contact-person arrangements are in place, and helping the client describe the real business activity and expected transactions. We can also explain questions that commonly arise when preparing an onboarding file.

Our assistance is administrative and preparatory. We are not the bank, cannot influence its risk appetite, cannot promise an account, and cannot replace a regulated provider’s KYC checks or legal advice. We do not create artificial business links or documents. You can learn more about our Estonian legal address, contact person service, accounting services and Power of Attorney guidance.

Frequently asked questions

Does high risk mean a bank will reject my application?

No. It can lead to enhanced checks, but each institution decides under its own policies and applicable law. No consultant can guarantee the result.

Is being a non-resident automatically high risk?

No. Residency is one possible factor among many. The institution assesses the entire customer and business relationship, including ownership, activity, geography and anticipated transactions.

Will an e-Residency card open a bank account?

No. E-Residency is a digital identity for Estonian e-services; it does not guarantee access to banking. The provider performs separate onboarding checks.

Can a payment institution replace a bank?

It may provide payment services useful to a business, but it is not necessarily a bank and its legal protections and product scope can differ. Review the provider’s licence, safeguarding arrangements, terms and availability for your country.

What is the most useful evidence for a new company?

Provide a truthful business description, transparent ownership details, realistic transaction forecasts, evidence of the source of initial funds and genuine customer or supplier documentation available at that stage.

Can Eesti Consulting apply to the bank for me?

We can help organise company information and explain the administrative process where appropriate. The applicant must provide accurate information, and the financial institution alone makes the account decision.

This article is general information, not legal, tax or financial advice. Provider requirements and legislation may change; confirm current criteria directly with the relevant institution and competent authorities.