This is why everyone is always asking everyone to demonstrate the sources of funds in finance.
Obviously it is not 100% effective, but it is somewhat effective. You cannot just jog in from Iran and enroll as a JP Morgan client
A whitelist/allowlist is a system that defaults to rejecting everything, but allow someone to override that rejection.
A blacklist/denylist is a system that defaults to allowing everything, but can on-demand block/deny something.
Banking system for individuals today mostly have a blacklist/denylist for the common use case. Walk into a bank and ask to open an account, and they'll most likely allow you.
If you manage to trip up any alerts (big deposits for example), they'll ask you for more info, citing KYC/AML for the reason why.
> This is why everyone is always asking everyone to demonstrate the sources of funds in finance.
This usually happen after the funds have touched some account you own, hence it's a blacklist system. A whitelist system wouldn't allow you to deposit those funds until after you got verified somehow.