Prohibited and Restricted Business Activity Guidance | Neves PSP License

Prohibited and restricted business activity guidance.

Not every client should be onboarded. Not every merchant category should be accepted. And not every transaction profile belongs inside a payment ecosystem.

One of the clearest indicators of institutional maturity is the ability to define what the business will not support.

Reality Risk appetite is defined by exclusion as much as acceptance.
Core issue Uncontrolled onboarding creates hidden institutional exposure.
Expectation Restricted and prohibited activity should be operationally defined.

Not all business activity carries the same operational risk.

Payment institutions are expected to understand which activities:

  • can be supported normally,
  • require enhanced controls,
  • require additional review,
  • should not be supported at all.

Without these boundaries, onboarding becomes inconsistent and risk exposure becomes unpredictable.

Key principle
A payment institution should define prohibited and restricted activity before onboarding pressure forces reactive decisions.

The three-category activity framework

1. Standard activity

Businesses and transaction profiles considered acceptable under normal onboarding and monitoring conditions.

2. Restricted activity

Businesses requiring enhanced due diligence, tighter monitoring, additional approvals, or operational limitations.

3. Prohibited activity

Businesses, transaction types, or client profiles the institution chooses not to support due to operational, legal, reputational, or banking concerns.

4. Escalated review activity

Businesses not automatically rejected but requiring structured internal review before approval decisions are made.

Examples of activity that often requires enhanced review

  • Cross-border high-volume remittance
  • High chargeback digital businesses
  • Complex marketplace structures
  • Aggregator and sub-merchant models
  • Rapid-growth merchant profiles
  • High-risk geographic exposure
  • Cash-intensive transaction environments

Enhanced review does not automatically mean prohibited activity. It means the institution should understand the exposure before onboarding.

Why banks focus heavily on prohibited sectors

Because merchant exposure becomes bank exposure very quickly.

If a payment institution cannot explain:

  • what sectors it accepts,
  • what sectors it restricts,
  • what sectors it prohibits,
  • how exceptions are reviewed,

then the institution appears operationally uncontrolled.

Where institutions usually fail

  • No documented prohibited activities list
  • Risk decisions made emotionally or commercially
  • Different onboarding standards applied inconsistently
  • No enhanced review process
  • High-risk sectors accepted without control upgrades
  • No escalation pathway for edge-case merchants
  • Public claims broader than actual risk appetite

This creates unpredictable onboarding behavior — which banks dislike immediately.

Restricted does not mean impossible

Some businesses may still be supportable where:

  • transaction visibility is strong,
  • monitoring controls are enhanced,
  • ownership is transparent,
  • banking alignment exists,
  • risk appetite permits controlled exposure.

The important part is that the decision is intentional.

Operational consistency matters

Institutions should avoid situations where:

  • sales teams approve risky merchants casually,
  • compliance teams are bypassed,
  • risk appetite changes weekly,
  • commercial pressure overrides controls.

Once onboarding discipline weakens, the entire institution begins looking unstable.

Strong activity governance signals

  • Defined prohibited sectors list
  • Restricted business category framework
  • Enhanced due diligence triggers
  • Documented onboarding escalation pathways
  • Alignment between banking appetite and merchant exposure
  • Operational consistency across onboarding decisions

Bottom line

A mature payment institution is not defined by how many merchants it can onboard.

It is defined by how intelligently it controls who enters the ecosystem.

The ability to reject risk is one of the clearest indicators of institutional maturity.

Quick takeaway

Institutions should clearly define which activities are acceptable, restricted, escalated, or prohibited before onboarding begins.

Risk appetite rule
If everything is acceptable, the institution has no real risk framework.

Next: onboarding and due diligence expectations

Understand how serious payment institutions structure onboarding review, verification, and approval controls.