Guide

Crypto Gateway Prohibited Businesses 2026: 4 of 12

We read the prohibited-business lists of 12 crypto payment gateways in October 2026. Four name your vertical, eight name none, one keeps its list private.

Brian OrmondUpdated October 26, 202612 min read

Key Takeaways

Four of twelve hosted gateways publish a list that names business categories. BitPay (15 prohibited plus 8 restricted), OpenNode (14 category rows), PassimPay (13) and BlockBee (10). The other eight name nothing you can check before you apply.
Two of those four lists were written for card rails. BitPay says most of its categories are "imposed by the requirements of our banking providers or regulators"; OpenNode files its under "restricted by our financial partners" and bans what "violates card network or bank policies" — on a bitcoin-only processor.
PassimPay's list is BitPay's list. Thirteen bullets, same order, same wording, two dropped. PassimPay then adds the only coin-level ban in the set: 11 named privacy assets, Monero and Zcash among them.
BlockBee's is the only list written for crypto, and it is the broadest. Ten categories banned "regardless of whether they are lawful, licensed, regulated" — including video games, charitable donations and precious metals.
No list is not permission. CoinGate can refuse any activity "deemed unacceptable by the Company", Cryptomus keeps its prohibited categories as internal controls, and we found no terms of service published by Apirone at all.

You sell CBD, or supplements, or slots, or you run a fundraiser. Onboarding went through, the API works, the first week settles clean — and then the account is suspended and the reason is a category you never saw written down. The crypto payment gateway prohibited businesses list is the one document that decides whether your integration survives, and it is the one most merchants never open before they build.

So we read all twelve on 26 October 2026 and counted the categories. Four gateways name business types at all. Eight name none. Across the four lists, 45 distinct categories are called out, one gateway bans eleven cryptocurrencies by ticker, and two of the four lists are copies — one from another crypto gateway, one from a card processor.

Last checked: October 2026. Every clause, category and count below was read from the provider's own published document on 26 October 2026, and each source is linked at the end. Where a provider publishes nothing, we say so and say what we checked. Categories change without notice; re-read the document before you build. This is a reading of published terms, not legal advice.

Lime-on-black illustration: twelve upright document outlines standing in a row. Four of them are drawn in bright lime with a tick and several ruled lines of content inside; the other eight are dim grey and completely blank — Twelve hosted gateways, twelve terms documents, and only four of them name a business category.

The document that decides your integration

A crypto gateway has two ways to say no to a merchant. It can refuse you at onboarding, which costs you an afternoon, or it can suspend you after you have taken money, which costs you the orders in flight and whatever sits in the balance. The prohibited-business list is the only published thing that tells you which of those is coming.

It is a different question from KYC. Whether a gateway asks for your passport is about identity thresholds at signup; whether it bans your sector is about underwriting, and a gateway can be entirely no-KYC and still refuse an entire industry in clause 14. It is also a different question from a compliance hold, which is what happens to the money afterwards. The ban list comes first in time and nobody compares them.

We checked the same twelve hosted gateways the rest of this compliance series uses, plus BTCPay Server as the self-hosted control, and we read the terms of service, acceptable-use clause or AML policy each one actually publishes.

What twelve gateways actually publish

Four shapes turn up. A named category list; a conduct clause with no categories; a reference to a policy you cannot read; and nothing at all.

Gateway	Document read	Dated	Business categories named
BitPay	Terms of Use, 4.4.2 and 4.5	1 Apr 2026	15 prohibited + 8 restricted
OpenNode	Terms and Conditions, 14.3	undated	14 category rows
PassimPay	Terms, section 05	11 May 2026	13 + 11 coins
BlockBee	Terms and Conditions	2 Oct 2026	10
CoinGate	Merchant Terms, 16 and 27.5	undated	None — conduct plus a morality clause
NOWPayments	Terms of Use, 14.1.5	19 Oct 2026	None — unlawful business only
B2BinPay	Terms of Use	26 Jun 2026	None — criminal conduct plus mixers
Confirmo	Terms and Conditions, 2.8	2 Oct 2026	None — one sentence
Plisio	Terms of Use (PDF)	undated	None — no vertical of any kind
Triple-A	General T&Cs, 5.2	undated	3 named, then an unpublished policy
Cryptomus	AML Policy, 4.4	undated	Internal controls, not published
Apirone	none found	—	No terms of service published
BTCPay Server	self-hosted software	—	No operator to refuse you

Apirone is the blunt case. Its footer is server-rendered plain HTML and links a privacy policy, a GDPR page, docs and an FAQ; we tried four terms URLs and all four returned 404, and a web search for its merchant agreement surfaced other companies' contracts. A gateway with no published terms has no published ban list, which is not the same as having no view.

Table of what each of twelve gateways publishes, read 26 October 2026. BitPay names 15 prohibited plus 8 restricted categories, OpenNode 14 category rows, PassimPay 13 plus 11 coins and BlockBee 10. CoinGate, NOWPayments, B2BinPay, Confirmo and Plisio name none, Triple-A names 3 then refers to an unpublished policy, Cryptomus keeps internal controls unpublished, and Apirone publishes no terms of service at all — Four shapes turn up: a named category list, a conduct clause with no categories, a reference to a policy you cannot read, and nothing at all.

Which list names your vertical

Here is the part no comparison site publishes: the four real lists against the sectors merchants actually ask about. Read down your own row.

Your business	BitPay	OpenNode	PassimPay	BlockBee
Adult content or services	Banned	Not named	Banned	Banned
Licensed gambling or betting	Restricted, written consent	Only illegal gambling banned	Not named	Banned
Cannabis, CBD, dispensaries	Banned	Paraphernalia only	Banned	Banned
Weapons, ammunition, fireworks	Banned	Not named	Banned	Banned
Supplements, nutraceuticals	Banned	Banned	Banned	Banned
Charity, donations, crowdfunding	Restricted, written consent	Banned	Not named	Banned
Video games, in-game items	Not named	Not named	Not named	Banned
Alcohol, tobacco, vapes	Not named	Not named	Not named	Banned
Gold, silver, gemstones	Not named	Not named	Not named	Banned
Buying or selling crypto	Restricted, written consent	Not named	Not named	Not named
Telehealth, airlines, timeshares	Not named	Banned	Not named	Not named
MLM and pyramid schemes	Banned	Banned	Banned	Banned

Read from each provider's own published terms, 26 October 2026. "Not named" means the category appears nowhere in that document — not that the gateway will accept you.

Two things fall out of that grid. Only one row is unanimous — pyramid and multi-level marketing, which all four ban. And the gateway with the broadest ban list is not the regulated American one; it is BlockBee, a Panama-registered, non-custodial, no-KYC processor, which is the opposite of what the market assumes.

Matrix of eight merchant verticals against the four gateways that publish a list. Adult content is banned by BitPay, PassimPay and BlockBee and not named by OpenNode. Licensed gambling is restricted by BitPay, only illegal gambling is banned by OpenNode, it is not named by PassimPay and banned by BlockBee. Cannabis and CBD is banned by three with OpenNode naming paraphernalia only. Weapons are banned by three and not named by OpenNode. Supplements and MLM schemes are banned by all four. Charity and crowdfunding is restricted by BitPay, banned by OpenNode and BlockBee, and not named by PassimPay. Video games are named only by BlockBee — Read down your own row. Only one line is unanimous, and the broadest list belongs to the no-KYC processor.

These lists were written for card rails

The strangest thing about the four lists is that two of them describe a payment system none of these companies run. BitPay says it outright in the paragraph above its own categories: "Most Prohibited Business categories are imposed by the requirements of our banking providers or regulators." The ban is not BitPay's risk view. It is a bank's, passed down.

OpenNode goes further. Its categories sit under the heading "Products or services that are otherwise restricted by our financial partners", and its catch-all bans "any businesses that we believe poses elevated financial risk, legal liability, or violates card network or bank policies". OpenNode is a bitcoin and Lightning processor. There is no card network in the path of a Lightning invoice.

You can see where the text came from. Three sentences in OpenNode's list appear word for word in Stripe's current restricted-businesses page — "bidding fee auctions", "investment opportunities or other services that promise high rewards", and "sale or resale of a service without added benefit to the buyer" — along with Stripe's distinctive high-risk examples: psychic services, timeshares, door-to-door sales, telemedicine. Other OpenNode entries, including essay mills, mug-shot removal sites and the sale of Twitter followers, are not on Stripe's page today, which puts OpenNode's text at an older revision of the same document.

Why it matters commercially. An inherited list refuses you for a reason that does not apply. A bitcoin invoice cannot be charged back, so the chargeback-driven categories on a card-network list — airlines, timeshares, subscriptions over one year — are priced for a risk the rail removed. Triple-A does the same by reference, binding merchants to "the rules of a Payment Network or Virtual Asset Service Provider".

PassimPay's list is BitPay's, plus 11 coins

Put PassimPay's thirteen bullets beside BitPay's fifteen and they are the same document. Same order, same parentheticals, down to "Drugs and drug paraphernalia (e.g., narcotics, controlled substances, and any equipment designed for making or using drugs)" and "Products and services with varying legal status from state to state" — a clause about American states, in the terms of a processor that is not American.

PassimPay dropped exactly two of BitPay's bullets: items used for speculation or hedging, and cloud mining. Everything else survives verbatim. Two gateways, one underwriting policy, and a merchant comparing them is comparing the same answer twice.

What PassimPay adds is unique in the set. It bans eleven cryptocurrencies by name — Monero, Verge, MobileCoin, Firo, BEAM, Zcash, Horizon, Navcoin, Secret, Decred and Dash — as "privacy-focused (anonymous) digital assets", and reserves the right to "block, reject, or reverse any related activity". No other gateway in the set bans an asset at the protocol level in its terms. If privacy coins are part of your checkout, that is the single most consequential sentence in these twelve documents.

A single stacked bar labelled BitPay, 15 prohibited bullets. The lime segment covering most of it reads 13 bullets verbatim and carries a bracket labelled PassimPay, 13 bullets; the small grey segment at the end is labelled the 2 BitPay dropped, items used for speculation or hedging, and cloud mining. A panel beneath lists the eleven privacy assets PassimPay bans by name: Monero, Verge, MobileCoin, Firo, BEAM, Zcash, Horizon, Navcoin, Secret, Decred and Dash — Two gateways, one underwriting policy — and the one coin-level ban in the whole set.

BlockBee bans what no card processor bans

BlockBee's terms, effective 2 October 2026, carry the only list in the set that reads as though crypto wrote it. Ten categories, and the framing is the point: they apply "regardless of whether they are lawful, licensed, regulated, or otherwise authorized in the jurisdiction in which they operate". A licence does not help you.

The categories are adult content, gambling and betting, gaming, drugs, alcohol and tobacco, pharmaceutical and medicinal products, precious metals and stones, donations and fundraising, weapons and dangerous materials, and fraudulent schemes. Three of those are not on any card-network list we have read. Gaming covers "video games, online games, gaming platforms, in-game purchases, virtual items" — a mainstay of crypto checkout. Donations and fundraising covers crowdfunding and any collection of funds "without the direct provision of goods or services in return". Precious metals covers bullion bought as a store of value.

That is a coherent position: BlockBee is non-custodial and takes no KYC, and it manages the risk by refusing whole sectors instead of screening individuals. It is also the opposite of the trade-off merchants expect, and worth knowing before you pick a gateway because it asks you for nothing.

BlockBee's ten banned categories under its terms effective 2 October 2026: adult content, gambling and betting, gaming, drugs, alcohol and tobacco, pharmaceutical products, precious metals and stones, donations and fundraising, weapons and dangerous materials, and fraudulent schemes. Gaming, precious metals and stones, and donations and fundraising are marked as not on any card-network list. A banner above reads that they are banned regardless of whether they are lawful, licensed, regulated or otherwise authorized in the jurisdiction in which they operate — A licence does not help you here. Three of the ten appear on no card-network list we have read.

The silent eight, and why silence is not a yes

Eight gateways name no sector. They are not equally permissive, because the power to refuse you lives somewhere else in each document.

CoinGate publishes a conduct clause and a morality clause. Section 16.1.4 bans activity "not in conformity with sustainable activities of the Company, ensuring of human rights, transparency, gender equality, moral and ethics, or other activity deemed unacceptable by the Company", and 16.2 lets it refuse anyone "without any prior notice or explanation". Section 27.5.5 then names the sectors as grounds for termination — prostitution, brothels, arms, narcotics, and gambling conducted without a licence.
Cryptomus states that it "maintains internal controls defining prohibited activities and business models" embedded in onboarding. The list exists; you cannot read it before you apply.
Triple-A names weapons, gambling and adult content, then widens it to anything prohibited "by Triple-A's compliance policies", which are not published.
NOWPayments (FD Transfers LLC) bans unlawful businesses, naming prostitution, escorts, counterfeits and narcotics, then adds "any business that we believe poses elevated financial risk". Its clause 14.2 is explicit that it may block or terminate without notice and "shall not give reasons for its actions".
B2BinPay bans criminal conduct and one technology: operating "as a mixer, tumbler, or using similar privacy-enhancing tools". No sector.
Confirmo, a MiCA-authorised CASP in Ireland, gives the whole subject one sentence in clause 2.8: do not apply if you intend unlawful purposes or sanctions evasion. The most regulated entity in the set has the shortest list.
Plisio names no vertical anywhere. Its suspension grounds are inactivity, failure to identify yourself, and breach of the agreement — that is the complete list.
Apirone publishes no terms of service we could find.

Read those together and the practical rule is uncomfortable: an unwritten policy is harder to plan against than a published ban. A named category tells you to go elsewhere this afternoon. "Deemed unacceptable by the Company" tells you after you have integrated, and with your balance already inside.

Screenshot of the BitPay Merchant and Donee Terms of Use page, headed Terms of Use with the legal entity BitPay Inc. selected and the line TERMS EFFECTIVE ON 1 APRIL 2026 above the opening paragraph — The BitPay document every count in this article was read from, dated on its own page. Captured 27 October 2026.

What the industry pages sell

The useful cross-check is to put each gateway's own marketing beside its own terms. We read the homepage and industry navigation of the same companies on 26 October 2026.

Gateway	Verticals it advertises to	Sectors its terms ban	Consistent?
Plisio	High Risk, Adult Creators, Games, Crowdfunding, Non-Profit	None	Yes
NOWPayments	Casinos, Adult Platforms, iGaming, Charity, Trading	None by sector	Yes
B2BinPay	Gambling, Adult, Online Games, Donation Tools	None by sector	Yes
BlockBee	No vertical named on its homepage	10 categories	Yes
BitPay	Donation acceptance, defined in its own terms	Charities restricted, consent required	Read 4.5 first

That is a cleaner result than the cynical read predicts. The gateways selling to high-risk sectors are the ones with no sector bans, and the gateway with the long list sells to nobody in particular. The marketing and the terms line up; the only place to read carefully is BitPay, which markets donation acceptance and defines a "Donee" throughout its terms while listing charitable and religious organisations as restricted businesses needing written authorisation.

If your sector is the problem rather than your paperwork, the honest shortlist is the permissive four — compare them on fees and custody rather than on policy, because on policy they say nothing. And if your category appears on every list you read, self-hosting removes the underwriter from the question entirely: there is no operator to refuse you, and every duty is yours.

Five questions before you integrate

Ten minutes, before any code. Four of twelve gateways let you answer question one from a public page. For the other eight, the answer only exists in an email you have not sent yet.

Find the list, and date it. Search the terms for your sector word — adult, gambling, cannabis, donation, gaming. If the word is absent, record that the document is silent rather than that you are allowed.
Ask for the unwritten policy in writing. Cryptomus and Triple-A both point at internal policies. A one-line email asking whether your category is prohibited, answered by email, is worth more than any clause you can read.
Check the coins, not just the sector. PassimPay bans eleven assets by name. If you quote in Monero or Zcash, read that paragraph before the fee table.
Check who the list belongs to. If it names airlines, timeshares or card-network policy, it was written for a card rail and the gateway is applying someone else's underwriting to a bitcoin invoice. Ask which categories it actually enforces.
Plan for refusal without notice. CoinGate can refuse "without any prior notice or explanation"; NOWPayments "shall not give reasons". A second gateway configured and tested is the only real mitigation, and merchants in named sectors should run two from day one.

The twelve documents agree on almost nothing except their own discretion. Read the one that covers your sector before you write the integration, not after the suspension email.

Related Articles

A gateway that never names your sector cannot tell you no in advance. It can still tell you no in month three.

We track fees, custody, KYC and settlement for every processor in the directory. Plisio names no prohibited vertical and sells to high-risk sectors directly; B2BinPay bans only criminal conduct and mixers; BTCPay Server has no operator to refuse you at all.

Compare Crypto Payment Gateways →

Affiliate disclosure: Payyd earns a commission if you sign up to some providers linked on this page. It changes none of the clauses, categories or counts reported here, all of which come from the providers' own published documents and are linked below.

FAQ

Which crypto payment gateways have no prohibited-business list?

Eight of the twelve we read name no business sector at all: CoinGate, NOWPayments, B2BinPay, Confirmo, Plisio, Triple-A, Cryptomus and Apirone. Plisio is the most complete silence, with no vertical named anywhere in its terms. That is not consent, though: each of those documents keeps a general power to refuse or suspend a merchant at its own discretion.

Can a crypto payment gateway process adult content?

It depends which one. BitPay, PassimPay and BlockBee all ban sexually explicit content and adult services outright, and Triple-A names adult content in its prohibited activities. OpenNode does not mention it. NOWPayments, B2BinPay and Plisio advertise to adult platforms on their own sites and ban no sector in their terms, which makes them the readable options for that vertical.

Why do crypto gateways ban businesses that card processors ban?

Because several copied the list. BitPay says most of its prohibited categories are imposed by the requirements of its banking providers or regulators, and OpenNode files its categories under products restricted by its financial partners, banning anything that violates card network or bank policies. Three sentences in OpenNode's terms appear word for word in Stripe's published restricted-businesses page.

Which gateway has the strictest prohibited-business list?

BlockBee, on sectors. Its ten categories apply regardless of whether the business is lawful or licensed, and they include three that card processors generally allow: video games and in-game purchases, charitable donations and crowdfunding, and precious metals bought as a store of value. BitPay names more individual categories, fifteen prohibited plus eight restricted, but its restricted tier can be unlocked with written authorisation.

Does any crypto gateway ban specific cryptocurrencies?

One. PassimPay names eleven privacy assets in its terms, including Monero, Zcash, Dash, Firo, Decred and Secret, and reserves the right to block, reject or reverse related activity. B2BinPay bans the use of mixers and tumblers but no coin. The rest restrict sectors or conduct rather than assets.

What happens if my business is on the list and I sign up anyway?

Expect suspension rather than a refund. BitPay may close an account without notice at its sole discretion for a prohibited or restricted business, CoinGate may refuse or terminate without any prior notice or explanation, and NOWPayments states that it will not give reasons for its actions. The money in the balance at that moment becomes a support ticket, which is why a second configured gateway matters more than a slightly lower fee.

Does a no-KYC gateway mean no business restrictions?

No, and the set shows the opposite. BlockBee takes no KYC and publishes the broadest sector ban in the twelve, while BitPay runs full verification and will onboard a licensed gambling operator with written consent. Identity checks and underwriting are separate decisions, so read the prohibited-business clause even when nobody asks for your passport.

Sources

Read and counted 26 October 2026:

BitPay Terms of Use — effective 1 April 2026; 4.4.2 Prohibited Business, 4.5 Restricted Business, 4.8.2
OpenNode Terms and Conditions — 14.3 Prohibited businesses
PassimPay Terms — last updated 11.05.2026; section 05 Prohibited Activities
BlockBee Terms and Conditions — effective 2 October 2026; Prohibited Business Activities
CoinGate Merchant Terms of Service — 16 Prohibited Use; 27.5.5
NOWPayments Terms of Use (PDF) — last updated 19 October 2026; 14.1.5, 14.2; FD Transfers LLC
B2BinPay Terms of Use — last updated 26 June 2026
Confirmo Limited Terms and Conditions (PDF) — last updated 2 October 2026; 2.8 Prohibited use
Plisio Terms of Use (PDF) — Suspension and Account Closure
Triple-A General Terms and Conditions — 5.2 Prohibited Activities
Cryptomus AML Policy — 4.4, internal prohibited activities and business models
Apirone Privacy Policy — the only legal document linked from its footer; four terms URLs returned 404
Stripe Restricted Businesses — compared for shared wording
BTCPay Server — "a self-hosted, open-source cryptocurrency payment processor", "censorship-resistant"; no operator in the payment path