Reading the risk in an AML and source-of-funds file for the BVI counterparty

A deal that looks clean on the term sheet can carry significant AML risk inside the holding structure. When the counterparty sits in the British Virgin Islands, the file you build – or fail to build – determines whether the transaction proceeds, whether your bank remains comfortable, and whether your compliance record holds under regulatory scrutiny. For principals and in-house teams managing cross-border positions through Hong Kong, the BVI counterparty is a recurring feature. Getting the source-of-funds analysis right is not a back-office exercise. It is the deal.

An AML and source-of-funds file for a BVI counterparty requires a two-system analysis: the Anti-Money Laundering and Counter-Terrorist Financing Ordinance governs the obligations of Hong Kong-regulated persons and intermediaries, while BVI law – principally the Proceeds of Criminal Conduct Act and the Financial Services Commission's AML/CFT Code of Practice – governs the counterparty's own obligations in its home jurisdiction. The file that satisfies one system does not automatically satisfy the other, and the gap between the two is where enforcement exposure concentrates.

This analysis works through the four questions that practitioners in our desk see drive the most consequential decisions: what is commercially at stake; how the cross-border interface between Hong Kong and the BVI actually bites; where the comparative analysis sits between the two systems; and where the risk is concentrated right now.

What is actually at stake – and why the BVI holding layer raises the stakes

The BVI is not a problem jurisdiction. It is the world's most widely used holding-company domicile for cross-border corporate structures, and the regularity of its appearance in Greater China deal flow is entirely unremarkable. A BVI intermediate holdco above a Hong Kong operating company, or below a Cayman fund, is standard architecture. The commercial stakes arise not from the fact of BVI incorporation but from the opacity that a BVI structure can introduce into a source-of-funds file – and from the regulatory and banking consequences when that opacity is not managed correctly.

Three commercial pressure points appear consistently in the files our desk reviews. First, correspondent banking: a Hong Kong bank processing payments to or from a BVI entity is required under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance to apply customer due diligence and enhanced due diligence where the risk profile warrants it. A file that cannot trace the ultimate beneficial owner of the BVI counterparty, or cannot demonstrate the origin of the funds, is a file that a compliance officer at a Hong Kong bank will pause – and sometimes terminate. The cost of a payment channel closing mid-transaction is often larger than the cost of the underlying dispute it triggers.

Second, deal documentation and representations: acquisition agreements, loan facilities, and joint venture arrangements in the Hong Kong market routinely carry AML representations and warranties from both sides. A counterparty that cannot support those representations with a credible source-of-funds file creates a condition that can be waived only at the accepting party's own compliance risk. We have seen deals where the buyer's internal compliance function blocked closing not because of a regulatory order, but because the AML file on the seller's BVI holdco was insufficient to sustain the warranty.

Third, regulatory follow-through: the Securities and Futures Commission, the Hong Kong Monetary Authority, and the relevant licensed entity's own AML auditors all operate against the same standard. A transaction that passed the commercial teams but left a thin AML file behind it is a liability in the next regulatory review cycle. The file you build today is the file that will be examined two years from now.

The governing instruments and how they map onto the cross-border position

Two legal systems govern simultaneously, and neither defers to the other. Understanding the exact scope of each is the starting point for building a file that holds.

On the Hong Kong side, the primary instrument is the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. It applies to financial institutions and designated non-financial businesses and professions operating in or through Hong Kong. The Ordinance requires customer due diligence – including identification and verification of the beneficial owner – before establishing a business relationship or executing a transaction above the relevant threshold. Where the counterparty is a legal person incorporated in a foreign jurisdiction, the due diligence obligation extends to understanding the ownership and control structure and, where the risk profile is elevated, the source of funds and source of wealth. The Ordinance does not prescribe a single documentary standard; it requires that the institution apply a risk-based approach and document its reasoning.

The Hong Kong Monetary Authority and the Securities and Futures Commission have each issued AML guidelines that sit alongside the Ordinance. Those guidelines provide sector-specific elaboration on what a reasonable risk-based approach looks like for different counterparty types, including offshore holding entities. They are not legally binding in the same sense as the Ordinance, but in an enforcement or supervisory review they define the standard against which actual practice is measured.

On the BVI side, the counterparty itself operates under its own AML and beneficial-ownership disclosure regime. The BVI's Financial Services Commission (the territory's financial services regulator) maintains an AML/CFT Code of Practice that applies to BVI-regulated entities. Separately, the BVI's beneficial-ownership register – accessible to competent authorities under the international exchange framework but not publicly searchable in the way some registers are – records the ultimate beneficial owners of BVI companies. A file built on Hong Kong obligations alone will not reflect what the BVI counterparty is itself required to maintain, and a counterparty that is compliant in the BVI may still present a documentation gap from a Hong Kong regulated institution's perspective.

The interface point is the gap between what the Hong Kong institution must verify and what the BVI counterparty must disclose. Bridging that gap requires a file architecture that speaks to both sets of obligations simultaneously – not a BVI compliance pack handed over as-is, and not a Hong Kong KYC form that ignores the BVI source material.

How does the cross-border interface actually bite?

The practical mechanism through which the two systems create friction is worth tracing in detail, because the pressure point is rarely where clients expect it to be.

A BVI company has no physical presence, no employees, and often no accounts in the BVI itself. Its operational footprint runs through Hong Kong, Singapore, or another hub. Its banking relationships are typically maintained at a correspondent bank account held in the name of the BVI entity but operated from the hub jurisdiction. When a Hong Kong bank is asked to process a payment on behalf of a BVI counterparty – or to a BVI payee – it applies its own AML screening and CDD obligations under the Ordinance. If the bank cannot identify the ultimate beneficial owner of the BVI entity to the required standard, it will not process the payment. That is not a technicality. It is a transaction block.

Consider a practical cross-border scenario. A Hong Kong-based joint venture partner receives a capital contribution from its BVI co-venturer. The JV agreement is signed; the commercial terms are clear; the BVI entity is properly incorporated and in good standing with the BVI Registry of Corporate Affairs. But the Hong Kong bank receiving the funds requests a source-of-funds certificate, ultimate beneficial owner declaration, and supporting documentation before it releases the credited amount from its internal hold. The BVI entity's registered agent provides the standard registered-office documents. The bank's compliance team finds these insufficient; it needs documentation tracing the specific funds – not just the entity's general structure – to a legitimate economic source. The hold persists. The JV timetable slips. The commercial relationship begins to strain.

This scenario is not exceptional. It is the ordinary position in any Hong Kong transaction where the counterparty is an active BVI entity receiving or transmitting funds of material size. The correct intervention is not to argue with the bank. It is to anticipate the request and build the source-of-funds file before the bank asks.

The second friction point is the travel rule for virtual-asset transfers. Where a BVI entity is involved in virtual-asset transactions processed through a licensed platform in Hong Kong, the Anti-Money Laundering and Counter-Terrorist Financing Ordinance's travel rule requirements apply: the originating platform must transmit beneficiary and originator information alongside the transfer. A BVI counterparty that cannot provide that information in the format the Hong Kong platform requires is a counterparty whose transaction the platform cannot process. This is a specific and increasingly active area of enforcement focus at the Securities and Futures Commission.

The sequence above describes the standard position across these two systems. Your matter will turn on the documents, the jurisdictions actually engaged, and the order in which the file is built – which is where the risk is either managed or left open.

For a structured assessment of how the Hong Kong-BVI interface applies to your transaction or counterparty position, write to us at info@lockhartyip.com.

The comparative read: Hong Kong obligations versus BVI requirements

Running the two systems side by side reveals not a uniform standard but a series of deliberate misalignments that the practitioner – and the client building the file – must navigate consciously.

The Hong Kong risk-based approach under the Ordinance is prescriptive in outcome but flexible in method. The institution must identify and verify the beneficial owner; it must understand the source of funds where the risk profile warrants it; it must document its reasoning. What counts as satisfactory documentation is a judgment call against a risk-based standard, which means that the same BVI entity may be adequate for one Hong Kong institution and inadequate for another, depending on the risk appetite and compliance culture of each.

The BVI regime, by contrast, is more prescriptive about what must be held – and by whom. A BVI company is required, under BVI law, to maintain a register of directors and a record of its beneficial owners, and to file certain information with the BVI Registry of Corporate Affairs. The BVI's financial intelligence unit holds a parallel register accessible to competent authorities under the automatic exchange of information framework. For the cross-border practitioner, the key point is that the BVI's records are created and held by the BVI entity and its service providers – not made available automatically to a Hong Kong institution conducting CDD. Accessing those records for the purposes of a Hong Kong AML file requires a deliberate step: a request, a consent mechanism, and a document-production process. That step is often skipped, and the gap it leaves is exactly what a regulatory examination will find.

What does a well-constructed file actually contain, from the perspective of a Hong Kong-regulated person dealing with a BVI counterparty? At minimum: certified constitutional documents of the BVI entity; a UBO declaration signed by the registered agent or a director with personal liability; supporting identity documents for each beneficial owner above the relevant threshold; a source-of-funds narrative traceable to a specific economic event (sale of assets, dividend from an operating company, drawdown from a documented facility); and bank statements or equivalent financial records substantiating that narrative. Where the risk profile is elevated – for instance, where the ultimate beneficial owner is a politically exposed person (a term defined in the Ordinance to mean an individual who holds or has held a prominent public function) – enhanced due diligence is required, and the file must be correspondingly deeper.

The comparative gap becomes most acute in three situations. First, where the BVI entity is a multi-layer structure – a BVI company owned by another BVI company owned by a trust settled by a discretionary settlor – the source-of-funds chain becomes complex very quickly, and each layer must be penetrated for the Hong Kong file to hold. Second, where the funds originate from a jurisdiction with its own AML profile – Mainland China, Central Asia, the Middle East, the CIS region – the Hong Kong institution will apply its own country-risk assessment alongside the BVI counterparty assessment. A BVI entity with a Mainland Chinese UBO and funds originating from a mainland transaction is not a simple file; it is a layered one. Third, where the transaction involves multiple currencies or cross-currency conversions, the source-of-funds narrative must trace each conversion leg as well as the underlying economic event.

For a comparative treatment of a parallel situation – a Cayman Islands counterparty – see our guide on the AML and source-of-funds file for a Cayman counterparty, which addresses the Cayman-specific overlay and the points of divergence from the BVI position.

What foreign counsel typically misread about the BVI-Hong Kong interface

In our cross-border practice, the most consistent error made by counsel and compliance teams based outside Hong Kong is treating the BVI counterparty's home-jurisdiction compliance pack as a substitute for a Hong Kong AML file. It is not.

A BVI entity in good standing with its registered agent, with a clean certificate of good standing and a director's declaration of beneficial ownership, meets its BVI law obligations. It does not meet the Hong Kong Ordinance standard that the Hong Kong-regulated person must apply. The Hong Kong institution is not assessing BVI law compliance; it is assessing whether it has sufficient evidence, under its own risk-based framework, to identify, verify, and understand the counterparty to the standard the Ordinance requires. Those are different questions, and they require different answers.

The second common error is conflating the sanctions check with the AML and source-of-funds check. Hong Kong implements United Nations sanctions. It does not give domestic effect to unilateral measures of other states. Screening a BVI counterparty against the UN consolidated list is a necessary step, but it is not a sufficient AML file. Sanctions clearance does not substitute for a source-of-funds analysis, and a counterparty that is not on a sanctions list may still present AML risk if the source of its funds cannot be traced to a legitimate economic origin.

The third error is timing. Counsel and compliance teams frequently begin the source-of-funds file only after the bank requests it. At that point, the transaction is already delayed. In our experience, the correct sequencing is to build the file in parallel with the commercial due diligence, so that by the time the bank or the closing process requires it, the file is ready for delivery. An additional read on how sanctions due diligence integrates with AML analysis in CIS-connected transactions is available in our analysis on sanctions due diligence for deals touching the CIS.

Where the risk sits now: our read on the current enforcement environment

The regulatory environment for AML and source-of-funds analysis in the Hong Kong-BVI corridor has tightened materially over the past several years, and the direction of travel is clear. Several developments concentrate the risk at specific points in the file and the transaction cycle.

The Hong Kong Monetary Authority and the Securities and Futures Commission have both signalled, through supervisory circulars and enforcement actions, that they view inadequate beneficial-owner identification and thin source-of-funds documentation as primary areas of concern. The pattern is not only enforcement against institutions for technical breaches of the Ordinance; it is supervisory action against institutions whose risk-based approach is found to be inconsistent or insufficiently documented. A file that cannot show its reasoning – not just its conclusions – is a file that does not hold.

The BVI has moved in the same direction. The territory's beneficial-ownership regime has been subject to ongoing international pressure from the FATF (Financial Action Task Force, the inter-governmental body that sets global AML standards) and from its major trading partners. The BVI has committed to enhanced access to beneficial-ownership information for competent authorities, and the practical effect is that a BVI entity whose UBO records are incomplete or inconsistent with the filings held by its registered agent is now more likely to surface as an anomaly in a regulatory exchange than it was five years ago. The file that was adequate in practice three years ago may not be adequate against the current standard.

The virtual-asset sector introduces a further layer. Where a BVI entity is the counterparty to a transaction involving a Hong Kong-licensed Virtual Asset Trading Platform, the platform's AML obligations under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance apply in full, including the travel rule. The mandatory licensing regime for centralised virtual-asset trading platforms commenced 1 June 2023 under the Ordinance, and the Securities and Futures Commission is the licensing authority. Compliance teams managing BVI entities involved in virtual-asset transactions that touch Hong Kong need to build the travel-rule obligations into their file architecture from the outset.

The cross-border enforcement risk is also bidirectional. A BVI entity that cannot support its Hong Kong-side file faces payment blocks and possible transaction termination. A Hong Kong-regulated person that cannot demonstrate adequate CDD on a BVI counterparty faces supervisory action from the relevant regulator. Both outcomes are commercial events of the first order. The analysis of where the risk sits now is therefore not a theoretical exercise. It is a direct input into deal structuring and transaction execution.

A decision analysis: matching the file to the risk profile

The practical question for a principal or in-house team building an AML file for a BVI counterparty is how deep the file needs to go. The answer depends on the risk profile, not on a uniform documentary checklist. The risk-based approach that the Ordinance requires means that a simple, low-value, single-currency transaction between two well-known principals with fully documented beneficial ownership requires a lighter file than a multi-layer, multi-currency, multi-UBO transaction with politically exposed persons in the ownership chain.

Situation A: a BVI holding company with a single UBO who is a Hong Kong-resident individual with fully documented identity and a source-of-funds narrative tracing to a documented sale of a Hong Kong property. The risk profile is straightforward; the file requires identity documents, constitutional documents of the BVI entity, a source-of-funds letter, and the supporting transaction record. This is a file that a well-organised compliance team can build in a matter of days.

Situation B: a BVI holding company with a multi-layer structure – BVI HoldCo owned by a second BVI entity, which is owned by a trust settled by a settlor who is a national of a Central Asian jurisdiction and who holds or recently held a public function. The risk profile is elevated on multiple grounds: complex structure, politically exposed person, jurisdiction of origin with an AML country-risk profile. The file requires penetration of each layer, enhanced due diligence on the PEP, a source-of-wealth analysis (not just source of funds), and documentation of the trust structure including trustee identity and discretionary beneficiary scope. This is a file that takes weeks, not days, and that requires cooperation from the BVI entity and its professional advisers.

Situation C: a BVI entity that is itself a licensed fund, regulated by the BVI Financial Services Commission, with a documented AML programme and regular audited accounts. The regulated-entity status is a material risk mitigant, but it does not eliminate the Hong Kong institution's own obligation to conduct CDD. It allows the institution to apply a proportionate standard that relies on the BVI entity's own regulatory standing as part of the evidence base. The file in this situation is still required; it is structured differently.

The decision matrix is therefore: identify the UBO structure and its complexity; assess the politically exposed person risk; assess the jurisdictional risk of the origin of funds; identify whether the BVI entity is itself regulated; calibrate the file depth accordingly; and document the risk-based reasoning that drives each calibration decision. That reasoning is the file. The documents are evidence for the reasoning.

If an earlier AML assessment produced a stalled or challenged file, or if the file built at the time of the transaction is now being re-examined in a supervisory context, a second read by cross-border counsel can identify the gap and the options still open for remediation.

To discuss how these considerations apply to your BVI counterparty position, contact info@lockhartyip.com.

The objection handled: "our BVI agent already handles compliance"

A common position among principals managing BVI holding structures is that the registered agent handles compliance, and that the compliance pack the agent provides is sufficient for all purposes. This position is understandable, and in a narrow sense it is correct: the registered agent is responsible for the BVI entity's compliance with BVI law, including the maintenance of its beneficial-ownership records and its filing obligations with the BVI Registry of Corporate Affairs.

But the registered agent's compliance pack is not designed to satisfy the AML obligations of a Hong Kong-regulated institution. It is designed to satisfy BVI regulatory obligations. The two are different in scope, different in documentary form, and addressed to different regulatory audiences. The registered agent cannot know – and in most cases is not asked – what a specific Hong Kong bank or licensed intermediary needs in order to clear its own internal AML process. The result is a pack that is compliant in the BVI and insufficient in Hong Kong.

This is not a criticism of registered agents or of BVI compliance practice. It is an observation about the architecture of the cross-border interface. The solution is not to replace the registered agent's pack but to supplement it: to take the BVI-compliant documentation and build it into a Hong Kong-facing file that speaks to the Ordinance standard, includes the source-of-funds narrative in the form the Hong Kong institution requires, and documents the risk-based reasoning that justifies the level of CDD applied. That is a cross-border advisory function, not an administrative one.

Related practices

• Sanctions & AML – counterparty screening, source-of-funds files, and AML compliance architecture for cross-border positions
• Holding Structures – BVI and offshore holding design, beneficial-ownership analysis, and substance requirements

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Sanctions Aml
• Aml Source Funds File Cayman Islands Counterparty Cayman 6
• Sanctions Due Diligence Deal Touching Cis Cis Analysis

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.