Words you can't just use: bank, insurance, and verified TLDs

Some words and some extensions are closed to you no matter what an availability checker says. You can’t register a .bank domain unless you’re a verified member of the banking community — which excludes fintechs, electronic money institutions and crypto exchanges outright, however bank-like the product. Several European countries bar the word “bank” from company names — or from business use entirely — without a licence or a regulator’s consent. Extensions like .gov, .pharmacy and .law turn you away at the registry door even with the name unregistered. None of this is trademark. It’s a separate layer of constraint — eligibility — that naming advice rarely mentions.

This article is general information, not legal advice; policies and statutes change, and details turn on your specific situation.

Why isn’t this just trademark law?

Because several separate mechanisms put names off limits, and three of them are routinely mistaken for each other:

1. Registry eligibility. A private contract term set by whoever runs the registry and enforced by it — backstopped, for community gTLDs from ICANN’s application rounds, by the Specification 12 community registration policies in the registry’s contract and the Registration Restrictions Dispute Resolution Procedure. (Specification 11 Public Interest Commitments and the PICDRP are a related but different mechanism covering a different set of promises.) fTLD’s ineligibility list for .bank is the sharpest illustration of what this means in practice: offshore banks, development banks, cryptocurrency companies and exchanges, peer-to-peer payment providers, electronic money institutions, and non-bank financial companies including fintechs, micro-lenders and currency exchanges are all excluded. A neobank running on a partner’s licence cannot have one.
2. Statutory restriction. Actual law governing use of a word in trade or in a company name, independent of any domain — you could own the domain outright and still be barred from trading under the word.
3. Trademark. A specific party’s prior right in a specific mark, adjudicated case by case. The first-ever UDRP decision — World Wrestling Federation Entertainment, Inc. v. Michael Bosman (WIPO Case No. D99-0001, decided 14 January 2000) — transferred worldwrestlingfederation.com on trademark grounds alone. .com has no eligibility rule; no statute was involved.

The three stack independently; passing one says nothing about the others. A clean trademark search (trademark basics before you register, do you need to register a trademark?) gets you nowhere with fTLD, and a granted .bank domain doesn’t immunise you against a prior mark.

There’s a fourth reason a name can be unavailable that has nothing to do with any of them: it may simply be reserved. Every new extension holds back a required list — two-character labels, country and territory names, intergovernmental identifiers — and registries reserve their own premium inventory on top. A .brand extension goes furthest, since the registry is often the only party permitted to register anything in it at all. Reserved is reserved; there’s no eligibility to satisfy or right to assert.

The rest of this article covers the first two — the ones nobody warns you about.

How hard is it really to get a .bank or .insurance domain?

Both are run by fTLD Registry Services, formed in 2011 by a coalition of banks, insurance companies and financial-services trade associations. ICANN granted it .bank on 25 September 2014 and .insurance on 19 February 2015.

Who qualifies for .bank: verified members of the global banking community — retail banks and savings associations; their holding and parent companies, where those are themselves supervised by the relevant government regulator; associations made up primarily of such entities; and fTLD-Board-approved government banking regulators. Note the condition on holding companies, because older write-ups get it wrong: fTLD’s original position excluded them, and a 2019 policy revision made supervised holding and parent companies eligible in their own right. US credit unions are not eligible — .creditunion exists for them — and neither are fintechs, electronic money institutions, or crypto businesses.

Verification is not a checkbox: security and watch-list screening; organization, jurisdiction and banking-credential checks, including charter and regulator confirmation; name-selection compliance; physical-address and phone verification; a call to the registrant’s HR confirming full-time employment; and another confirming the contact’s authority to request domains. fTLD says initial approval generally takes five days or less, though live telephone contact can stretch it. And it never ends: full re-verification — employment and authority re-confirmed — happens at every renewal, or at least every two years, whichever comes first.

Then come the operating requirements: mandatory DNSSEC and email authentication; multi-factor authentication for any change to registration data; mandatory strong TLS — .bank is an HTTPS-only community, unencrypted pages permitted only to redirect to HTTPS; no proxy or privacy registration, so registrant identity can’t be hidden; and compliant nameservers. fTLD states these are not currently mandated by operators of other commercially available gTLDs. They’re policed, too: fail to respond with a remediation plan and the domain can be removed from the .bank zone — or worse; repeatedly ignore verification requests and verification simply fails.

fTLD doesn’t publish a wholesale fee. As of July 2026, third-party registrar listings put .bank at roughly $800–$2,260 per year and .insurance at roughly $725–$2,150 — against roughly $10–15 for a typical .com. The price is part of the gate.

Which other extensions are gated, and by whom?

The new gTLD rounds created a great many open extensions — which TLD should you use? covers choosing among those — but some carry genuine gates. And this list isn’t closed: ICANN’s next application round is open as this publishes, so the roster of gated extensions will grow again. (Registry versus registrar fuzzy? The domain glossary untangles it.)

Extension	Who qualifies	Gatekeeper and notes
.pharmacy	Health-care and health-care-adjacent merchants accredited under NABP’s Healthcare Merchant Accreditation Program — broader than pharmacies alone	National Association of Boards of Pharmacy; a paid annual accreditation, and renewal requires it in good standing
.creditunion	Credit unions and credit-union organisations	DotCooperation; the home for the institutions .bank turns away
.law	Licensed/qualified lawyers, law firms formed by qualified lawyers, accredited law schools, legal regulators — inactive or non-practising lawyers are not eligible	GoDaddy Registry, via an independent verification agency; must notify the registrar within 14 days of becoming ineligible
.cpa	Individually licensed CPAs or CPA-firm-licensed firms only; unlicensed firms excluded because of state “holding out” laws	AICPA with CPA.com
.aero	Entities or individuals exclusively or substantially in civil aviation	SITA issues an aviation community membership ID before registration
.coop	Cooperatives, NCBA or ICA members, associations of cooperatives, organizations majority-controlled by or principally serving cooperatives; individuals not eligible	Verification ~5 business days; 2–3 weeks with extra documents
.museum	Anyone, anywhere, who can substantiate a link to museum activity — the gate has loosened (below)	MuseDoma; no proof required up front, spot checks only
.gov	US federal, state, tribal and local government entities and special districts	CISA; a digital request naming a senior official with executive responsibility — the physical-signature requirement was dropped in January 2024; free
.edu	US-based, degree-granting, institutionally accredited postsecondary institutions	Educause
.mil	US Department of Defense components only	Not available through commercial registrars
.int	Intergovernmental organizations established by international treaty between national governments, with independent international legal personality	IANA/ICANN; one registration per organization; free
.jobs	Must correspond to a bona fide employer’s own legal company name	Story below
.travel	Travel industry — the gate has eroded (below)	Pre-registration proof no longer required

Three rows deserve footnotes, and together they make the real point: restrictions are policy, not physics.

.travel originally required a unique identifier proving travel-industry status before registration. That was dropped; verification now happens via a travel-industry acknowledgment afterwards. .museum has eroded further still — the registry now describes itself as open to anyone, anywhere, who can substantiate a link to museum activity, with no proof required up front and only spot checks against misuse. Two gates, both quietly loosened.

.jobs is the instructive counter-case, and it’s usually told backwards. Its registry petitioned in 2010 to open the extension to city and keyword names; ICANN approved that request in August, then in December rejected a reconsideration request from HR and recruiting bodies trying to overturn it. The registry won at the policy level. What eventually constrained the extension was contractual enforcement — a compliance notice in 2011 and years of arbitration — not the objection. If you want to know whether a gate will hold, look at the registry’s contract, not at who is complaining.

At the other extreme, .int — requiring an actual treaty between national governments — has the narrowest eligible population here.

Can the law stop you using a word even on an open extension?

These are jurisdiction-specific statutes summarised briefly — not legal advice. If one could touch your business, confirm with a local lawyer or the regulator.

Yes — this is the mechanism most often mistaken for trademark. Several countries restrict words like “bank” by statute, regardless of whether anyone else has claimed them. They look similar and differ in kind:

United Kingdom. Companies House treats a defined list of “sensitive words and expressions” — Bank, Banking, Banc, Assurance, Insurance, Insurer, Reinsurance, Trust, Royal, Charter, Chartered, University, Institute, Federation among them — as requiring a regulator’s non-objection or the Secretary of State’s consent, under section 55 of the Companies Act 2006 and the 2014 Sensitive Words and Expressions Regulations. For banking and insurance words that means the FCA’s written non-objection, typically around ten business days. “Royal” and “Chartered” are refused where they falsely imply a royal connection or a Royal Charter.

But this is not only an incorporation gate, and that’s the part most summaries miss. The same schedule is specified for section 1194, which makes it an offence to carry on business in the UK under a name containing a listed word without approval — reaching sole traders, partnerships and trading names, not just registered companies. Separately, section 24 of the Financial Services and Markets Act 2000 makes it an offence to hold yourself out in a manner reasonably likely to indicate you are an authorised person. Trading under a bank-flavoured name while unauthorised engages both.

And “bank” is only the headline. The UK separately protects a long list of words under other legislation entirely — architect, pharmacy and chemist, dentist, veterinary surgeon and vet, optician, solicitor, building society, credit union, Olympic, Red Cross, and the medical titles. If your name gestures at a regulated profession, check that list before the domain, not after.

Ireland. The Companies Registration Office restricts “bank”, “banker”, “banking”, “banc” and compounds of them unless the Central Bank of Ireland consents — regardless of whether the company intends to do any banking business. “Insurance” and “group” separately require permission.

Netherlands. Article 3:7 of the Wet op het financieel toezicht prohibits anyone who is not a licensed bank from using the word “bank”, or translations and forms of it, in their name or in the conduct of their business. It carries its own escape hatch: the prohibition doesn’t bite where the context makes clear you are not active on the financial markets — a bloedbank, a blood bank, is the standard example — and DNB can grant a formal exemption on application, with exempted firms listed in the public register. Supervision of compliance and the power to exempt sit with different authorities, so ask the regulator rather than assuming.

Germany. Sections 39 and 40 of the Kreditwesengesetz reserve “Bank”, “Bankier” and “Sparkasse” for licensed credit institutions — and note the scope, because it’s wider than a company name: the reservation covers use in the firm name, as an addition to it, to describe the business purpose, or for advertising. Section 41 then supplies the exception, in almost the same terms as the Dutch one: the reservation doesn’t apply where the word is used in a context that excludes any appearance of banking business. The textbook example is a Samenbank — a seed bank.

So the honest summary is not that these regimes differ in kind. They converge on a single principle — a non-bank may use the word only where context defeats the implication — and differ in machinery: consent plus criminal offences in the UK, regulator consent at registration in Ireland, supervision plus a formal exemption register in the Netherlands, and in Germany a reservation whose real teeth are elsewhere. That last point matters more than it sounds.

Because in Germany, the regulator is not who comes after you. BaFin’s view under these sections is essentially declaratory, and only the register court can force deletion — of a company name on the register, which a domain isn’t. The live risk is a competition claim: the sections are treated as market-conduct rules, so a competitor or Germany’s competition-enforcement association can sue directly. They have. In one case a financial intermediary used “Ersatzbank” in the domain of its web presence; the action ended in a conceded judgment at the Landgericht Karlsruhe in April 2023 prohibiting it from advertising services under that designation. A parallel case shut down “Banka”.

That case also retires a hedge we would otherwise have offered here: the German rule is not untested against a domain name. For the Netherlands it still is — we found no published Article 3:7 case at all — but treat “nobody has enforced this against a domain” as a statement about the Netherlands, not about Europe. If your worry is a specific company’s rights rather than a statute, that’s mechanism three — start with how to check an EU trademark.

Which country-code domains check who you are?

Country-code extensions gate on a different axis — not what you do, but where or what you are. A sampler:

ccTLD	Who qualifies	Notes
.eu	Citizens of the EU, Iceland, Liechtenstein or Norway anywhere in the world; non-citizen residents of the EU/EEA; undertakings established in the EU/EEA	Citizenship-regardless-of-residence applied to Union citizens from 19 October 2019 under Regulation (EU) 2019/517, and was extended to Icelandic, Liechtenstein and Norwegian citizens on 2 August 2021
.fr	Residence or establishment in the EU/EEA plus Switzerland	UK residents lost eligibility for new registrations from 1 January 2021; pre-2021 UK registrations preserved
.it	EU/EEA plus Vatican, San Marino, Switzerland and the UK	Requires a tax or VAT ID
.no	Organizations: a Norwegian organization number. Individuals: Norwegian national ID, a Norwegian postal address, age 18+	Caps: 100 domains per organization, 5 per individual
.au	Australian presence	Tightened 12 April 2021: foreign entities can no longer rely solely on an Australian trademark application or registration unless the domain exactly matches the mark’s words
.ca	Canadian Presence Requirements — 18 defined categories	CIRA runs Registrant Information Validation audits; failure costs the domain (below)

Two separate .eu events get merged constantly. Eligibility widened first: from 19 October 2019 a Union citizen qualified wherever they lived, and from 2 August 2021 the same applied to Icelandic, Liechtenstein and Norwegian citizens. Then Brexit narrowed it in practice — UK-held domains without a qualifying connection were suspended, then withdrawn, and finally revoked and released on 3 January 2022, a couple of days after the announced date. Whether .eu deserves a place in your plans is a different question: is a .eu domain worth it?, European country-code domains for founders, and the fine print behind country-code domain hacks.

What actually happens if you register anyway?

An fTLD registration isn’t complete until verification clears, and later non-compliance can remove the domain from the zone. .coop puts unverified registrations on Hold with 30 days to finish — fees typically non-refundable. .ca deletes the domain roughly two months after a failed CIRA audit begins. .eu moved non-compliant post-Brexit domains through withdrawal to revocation. .law expects you to report your own ineligibility within 14 days; the registry can cancel, lock, hold, transfer or delete. The pattern: you don’t get sued, you get unwound — money kept, brand equity stranded.

Why would anyone want a gated extension?

Because the gate is the feature. Every hurdle in the .bank list is also a published requirement working in your customers’ favour: mandatory DNSSEC, mandatory encryption, multi-factor authentication on registration changes, no privacy proxies, re-verification at least every two years. And the eligibility rule does real work — an attacker can’t stand up a convincing lookalike inside .bank, because they would have to clear the same verification you did.

Be precise about what that buys, though, because it’s narrower than the marketing suggests. It’s a constraint on who can hold a .bank name — not protection from everything else. Nothing stops someone registering a lookalike in an open extension and phishing your customers from there. What you get is an extension that stays clean, and a signal that rests on something: an extension anyone can have certifies nothing; an extension almost nobody can have certifies something.

The takeaway is sequencing: eligibility is a constraint to discover before you fall in love with a name.

Which is worth saying plainly about our own tool, given everything above. Domain Yoga covers the exploration half — a search returns around 250 availability-checked name ideas, ranked for brandability (see our methodology), for $2–$5 per search. Availability is the cheap check, and this article has been fifteen hundred words on why it’s also the least informative one. Nothing in a generator tells you whether you’d clear fTLD’s verification, whether a regulator would object to your company name, or whether someone holds a prior mark. Take the shortlist, then run the survivors through the eligibility questions above and the pre-registration checklist before money changes hands.