High-risk business categories

High-risk business categories are the types of business that a bank, payment provider or card network treats as carrying elevated financial crime, fraud, dispute or reputational risk, and therefore subjects to extra onboarding checks, approvals or monitoring. There is no single universal list: each institution sets its own in its risk assessment, and card networks publish their own for card acceptance.

Why it matters in KYB review

The category decides how deep the review goes. Under the FFIEC BSA/AML Examination Manual, information from customers with a higher risk profile "should be reviewed more closely at account opening and more frequently throughout the term of their relationship with the bank." The manual also notes that even within higher-risk categories "there can be a spectrum of risks," so the label starts the analysis rather than ending it.

Card networks add their own layer. Visa's 2021 Payment Facilitator and Marketplace Risk Guide defined "high-brand risk" merchants as card-absent merchants that must be classified under specific MCCs, including:

The same guide says acquirers must register with Visa before contracting with such merchants, and a payment facilitator must be registered as a High Risk Internet Payment Facilitator before signing them. Visa's current Merchant Data Standards Manual uses the term "high-integrity risk." Check the network's current rules rather than relying on an old list.

What an analyst checks

• What the business really does, from the website, documents and payment flows, before accepting the category on the application.
• Licences the activity needs, such as gambling, pharmacy, money transmission (see money services business) or state lending licences, verified against the issuing authority.
• Jurisdiction. Legal in one state or country does not mean legal where the customers are.
• Controls the customer runs, such as age verification or geo-blocking, where the activity requires them.
• Whether the case needs enhanced due diligence under your policy.

Common pitfalls

• Declining whole categories without a documented risk rationale, then approving the same activity under a vaguer description.
• Letting a merchant choose a lower-risk code (see MCC misclassification).
• Treating a licence screenshot as verification. Check the regulator's register directly.
• Never revisiting the category after onboarding, when business models drift.

Related terms

Enhanced due diligence, MCC misclassification, transaction laundering, customer due diligence.

Sweat AI is an AI-native BPO for banks and fintechs, working onboarding and fraud queues. For high-risk categories our analysts check licences at the source and document what the business actually does, then hand your team a recommendation to decide on. See KYB review.