My bank called about my merchant deposits — what they want and what to say

Your business banking relationship manager calls. Or a letter arrives asking for "additional information about recent deposit activity." Or you log in and see a new "Compliance Review" task in the banking portal. These are BSA/AML compliance inquiries — the bank's legal obligation to understand unusual activity.

How you respond determines whether this is a one-time diligence and move-on or the first step toward an account closure.

1. Why banks ask

Bank Secrecy Act requires monitoring for unusual activity. Triggers: (a) sudden increase in deposit volume, (b) deposits from processors you have not used before, (c) cash deposits (most merchant operators have none; if you do, compliance watches), (d) wire transfers to/from high-risk jurisdictions, (e) pattern that resembles structuring, (f) random sampling as part of ongoing CDD (customer due diligence).

2. What they want to know

(a) What is your business. (b) Where is the money coming from. (c) Where is the money going. (d) Does the activity match your stated business model.

3. The right response posture

Calm, complete, in writing. Bank compliance teams value clean documentation more than fast verbal answers. Request the questions in writing if they call; respond in writing with attachments.

4. Documentation to prepare

• Business description and website.
• Recent processor statements showing the deposits.
• Sample invoices or receipts reflecting the deposited volume.
• Customer base summary (geography, typical order size).
• Shipping records or service delivery documentation.
• Any changes in business model that might explain new activity patterns.

5. What not to do

Do not get defensive. Do not say "my lawyer will call you." Do not refuse to answer. Do not "forget" to mention the new processor or new revenue line. Withholding information accelerates account closure.

6. High-risk vertical conversations

If you are in CBD, nutra, kratom, adult, firearms-adjacent, your banker already knows — it was disclosed in account opening (or should have been). The compliance call is sometimes the bank double-checking that the activity matches the disclosed business. Confirm it does with receipts.

7. De-risking reality

Many US banks have quietly "de-risked" — closed accounts in high-risk categories to reduce their own compliance burden. Call from a bank inquiring about deposits in CBD, kratom, or firearms categories sometimes precedes an account closure notice regardless of your answers. Be prepared.

8. Bank options if you are de-risked

• Community banks with high-risk programs: Cross River, Customers Bank, Axos, Western Alliance selectively.
• Fintech business banking: Relay, Mercury (selective), Bluevine.
• Specialty high-risk banking: North Bay Credit Union (cannabis), specialized state banks.

Opening a new bank account takes 2-4 weeks. Do not wait until closure notice.

9. Banking vs processing separation

Bank closure is different from processor closure. Processor holds money before settlement to your bank; bank holds money after. Losing the bank relationship disrupts cash flow but not processing. Losing the processor disrupts processing but not necessarily the bank.

10. Multi-bank resilience

Serious multi-brand operators run 2-3 business banking relationships with processor-to-bank mappings. Clean separation means one bank losing appetite does not freeze the whole operation.

11. What to say on the call

"Thank you for reaching out. I'd like to respond thoroughly in writing so you have complete documentation. Please email me the specific questions and I'll respond with supporting materials within X business days." This converts a verbal fishing expedition into a documented interaction that protects both parties.

12. After the inquiry

Monitor the account. Repeat inquiries on the same activity = bank is building a case to close. One-and-done inquiry with clean response = usually fine, back to business. In either case, start expanding your banking relationship footprint.

Response template

• Business description (1 paragraph).
• Revenue model summary (customer base, average order size, typical geography).
• Recent change explanation if applicable.
• Attach: processor statement, sample invoices, receipt/shipping samples.
• Available for follow-up via phone or in-person meeting.

The structural fix

Banking concentration risk is the less-talked-about cousin of processor concentration risk. Solve both in parallel. See holding company stacks, multi-brand playbook, pricing, or apply for a banking-resilience fit check alongside payment processor audit.

13. The de-risking macro trend

Since 2021, US banks have systematically reduced high-risk client exposure. Crypto, cannabis-adjacent, adult, gambling, and even some nutra operators have seen banking relationships closed with minimal explanation. Regulatory pressure + Operation Chokepoint remnants + internal compliance cost. De-risking is structural, not temporary.

14. Community bank vs national bank behavior

Community banks often serve high-risk better than national banks. Community bank compliance officer meets with you; national bank compliance officer is three layers removed. For specific verticals (cannabis banking, high-risk nutra), community banks in specific states remain viable. Cross-reference the state DFI lists.

15. Separating operating cash from reserves

Best practice: keep at least two business bank accounts. Operating account (payroll, ops) + reserve account (long-term cash). If one relationship is frozen, the other continues. Also: never concentrate all cash in a Fintech business banking product (Relay, Mercury) — those run through sponsor banks with their own risk appetites.

16. Documentation you should keep warm

Articles of incorporation, EIN letter, beneficial ownership documents (FinCEN BOI filing), last 12 months of processor statements, last 12 months of bank statements, customer list summary, sample invoices. Kept in a single folder, ready to share on 24 hours notice. Diligent operators update quarterly.