Reading the risk in a compliance review before contracting with a Mainland China entity

A contract signed in good faith can become a compliance liability the moment the payment channel is tested. For international groups entering commercial relationships with Mainland China counterparties, the real exposure rarely sits in the written terms. It sits in the gap between what the counterparty declares and what a structured compliance review reveals – a gap that can close a bank account, freeze a correspondent-bank relationship, or trigger a regulator's inquiry before the first invoice is settled.

A compliance review before contracting with a Mainland China entity is the structured process of assessing counterparty risk, sanctions exposure, and source-of-funds position under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the United Nations Sanctions Ordinance, conducted before a commercial relationship is formalised. The review maps the Hong Kong–Mainland interface, identifies the points at which the payment channel is tested, and produces a documented file that can be presented to a correspondent bank or regulator. Properly sequenced, it is the instrument that separates a defensible contracting decision from an undocumented one.

This analysis works through the commercial stakes, the governing instruments across both systems, the comparative read of the two regimes, and our view on where the risk sits now for groups operating through Hong Kong.

What is actually at stake commercially?

The commercial question is straightforward: can you get paid, and can you pay? That is the centre of gravity for most cross-border contracts with Mainland counterparties. The legal answer depends on the payment channel remaining open – and the payment channel is a compliance question, not a contractual one.

Correspondent banks and international clearing institutions apply their own risk filters to cross-border renminbi and US dollar flows. A transaction that is legally valid under both Hong Kong and Mainland law can still be blocked, returned, or flagged if the compliance file does not support the relationship. We regularly see situations where a contract has been executed, performance has begun, and the first payment is held because the international bank's compliance desk cannot clear the counterparty.

The stakes for an international group are layered. At the first level, there is the transaction itself: delayed or blocked payments disrupt commercial performance and expose the group to breach claims from its own downstream counterparties. At the second level, a compliance failure on a Mainland contract can affect the group's broader banking relationships – a correspondent bank that flags one transaction may review the entire account. At the third level, a documented failure to conduct adequate counterparty due diligence before contracting can expose the group to regulatory inquiry in Hong Kong, in the Mainland, or in the jurisdictions where its treasury and treasury accounts are held.

The asymmetry matters. A well-constructed compliance review is a one-time investment. The cost of a blocked payment channel, a frozen account, or a regulator's inquiry is several orders of magnitude larger. This is not a theoretical risk. Our desk sees enforcement and account-closure situations arising from precisely this gap.

What is the governing framework, and where does the cross-border interface bite?

Two distinct regimes govern the compliance position for a Hong Kong-based group contracting with a Mainland entity: the Hong Kong regime, anchored in the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the United Nations Sanctions Ordinance, and the Mainland regime, which operates through its own fangjian fagui (regulatory instruments covering anti-money-laundering, foreign exchange control, and sanctions-related measures) enforced principally by the People's Bank of China and the relevant foreign-exchange administration.

Hong Kong's position is defined by statute. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance imposes customer due diligence and ongoing monitoring obligations on financial institutions and designated non-financial businesses and professions. The United Nations Sanctions Ordinance gives domestic effect to United Nations Security Council sanctions; Hong Kong does not give domestic legal effect to unilateral sanctions measures imposed by other states. That distinction is operationally significant: a transaction that is prohibited under a unilateral regime of another state may be legally permissible in Hong Kong, but may still be declined by a correspondent bank applying its own risk appetite or home-country rules.

This is the point at which the cross-border interface bites most sharply. The legal position and the banking reality are not the same thing. A group that has satisfied Hong Kong's statutory obligations may still find a payment blocked by a correspondent institution applying US, EU, or UK unilateral measures. The compliance review must address both the legal standard and the banking-channel standard simultaneously.

On the Mainland side, the relevant instruments include the Anti-Money Laundering Law, the rules on foreign-exchange management administered by the Guojia Waihui Guanliju (State Administration of Foreign Exchange, SAFE), and the measures on financial sanctions administered through the People's Bank of China. Cross-border payments from the Mainland are also subject to the Mainland's capital-account controls, which can affect the counterparty's ability to remit funds offshore regardless of the contractual position. A compliance review that does not engage with the counterparty's own regulatory environment is incomplete.

The interface bites at the payment step. A Mainland entity contracting with a Hong Kong group will typically make or receive payment through either the onshore renminbi system, the cross-border renminbi clearing arrangement, or a foreign-currency account subject to SAFE approval. Each channel has its own compliance filter. A disclosure that satisfies one filter may not satisfy another. The compliance file must be constructed with the actual payment channel in mind.

For a structured assessment of the compliance position across Hong Kong and the relevant Mainland mechanisms, write to us at info@lockhartyip.com.

How does the counterparty risk assessment actually work in practice?

Counterparty risk assessment in a cross-border Mainland engagement is not a single check against a sanctions list. It is a layered process that builds a documented picture of the entity, its beneficial owners, its source of funds, and its operational history – sufficient to withstand scrutiny from a correspondent bank, an auditor, or a regulator.

The first layer is entity identification. A Mainland registered entity will have a yingyezhizhao (business licence), a tongyi shehui xinyong daima (unified social credit code), and registration records with the relevant Shichang Jiandu Guanli Ju (market supervision administration). These records are the starting point. They confirm legal existence, registered scope of business, and registered capital. They do not, on their own, identify the ultimate beneficial owner.

The second layer is beneficial-ownership mapping. Mainland corporate structures frequently involve layered shareholding, with natural persons at the apex holding interests through a chain of legal entities. The compliance file must trace that chain to the level of natural persons exercising ultimate control. Where the structure includes a state-owned or state-linked entity, the analysis takes a different form: state ownership is not itself a disqualifying factor under Hong Kong law, but it affects the risk rating and the information required for a correspondent bank's due diligence.

The third layer is sanctions and adverse-media screening. The United Nations consolidated sanctions list is the baseline. Counsel on our desk routinely screen against the UN list and then assess the position under the unilateral regimes that the relevant correspondent bank is likely to apply. The screening result must be documented contemporaneously: a screen conducted but not recorded is of limited use when a bank's compliance desk asks for the file six months later.

The fourth layer is source-of-funds analysis. This is the layer most often omitted. The question is not merely whether the counterparty is sanctioned. It is whether the funds flowing under the contract originate from a source that a correspondent bank and Hong Kong's Anti-Money Laundering and Counter-Terrorist Financing Ordinance regime would accept as compliant. For a Mainland entity, this requires an understanding of the entity's business model, its principal revenue streams, and – where the contract involves a significant payment – some evidence of the origin of those funds.

Consider a European industrial group contracting with a Mainland procurement entity in late 2026. The Mainland entity was clean against all United Nations sanctions lists. The beneficial-ownership chain was traceable. The contract was commercially standard. The first payment was nevertheless held by the European group's clearing bank for three weeks while the bank's own compliance desk requested additional documentation on the origin of the counterparty's funds. The group had no file. The delay cost more in commercial disruption than the review would have cost to commission. We have seen this pattern repeat across sectors.

What are the main risk points that a compliance review must address?

The risks in a Mainland counterparty engagement cluster around four areas. Each requires specific documentary attention.

First, the beneficial-ownership gap. Mainland corporate structures are not always transparent to the level of natural-person control. Where ownership is held through a web of domestic entities, nominee arrangements, or contractual rights rather than equity, the beneficial-ownership picture requires active investigation. The compliance file must record the analysis and its limits. A documented gap – with a reasoned assessment of the residual risk – is defensible. An undocumented engagement is not.

Second, the state-ownership and designation risk. Entities with state ownership above a threshold recognised by the relevant correspondent-bank regime attract additional scrutiny under a number of unilateral sanctions frameworks. The analysis here is about the banking channel: Hong Kong law does not prohibit engagement with state-owned entities, but a correspondent bank applying another state's rules may treat the relationship differently. The compliance review must map the actual banking path and assess it against the rules the relevant institutions will apply.

Third, the capital-account and payment-channel risk. A Mainland entity's ability to make or receive cross-border payments is a regulatory question, not merely a contractual one. SAFE approval requirements, capital-account categories, and the renminbi clearing arrangements each impose conditions on cross-border flows. A contract that assumes a payment channel without verifying that the channel is available is a contract with a latent performance risk. The compliance review should include a payment-channel assessment: which mechanism will be used, what approval or registration is required on the Mainland side, and what documentation will the Hong Kong-side bank require.

Fourth, the AML file and the ongoing-monitoring obligation. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance imposes ongoing monitoring obligations, not merely a pre-contract check. A compliance review conducted before contracting should also establish the framework for ongoing monitoring: what events will trigger a re-screening, what changes in the counterparty's structure will require re-documentation, and who within the group holds the file. An initial review that produces no ongoing protocol is only half a review.

If an earlier compliance attempt produced a stalled or adverse result – a held payment, a bank's request for additional documentation, or a regulator's query – a second-read analysis can identify the gap and the routes still available. Write to us at info@lockhartyip.com.

How do the Hong Kong and Mainland regimes compare, and where do they diverge?

The two regimes share a structural commitment to international AML standards: both Hong Kong and the Mainland are members of the Financial Action Task Force framework, and both have implemented the principal FATF recommendations. The overlap is real. The divergences are equally real, and they are the source of most cross-border compliance friction.

The first divergence is on sanctions posture. Hong Kong implements United Nations sanctions and does not give domestic effect to unilateral measures. The Mainland's sanctions position reflects its own international commitments; it has also enacted domestic counter-measures provisions that can affect the legal position of entities or individuals subject to certain unilateral foreign measures. For a group contracting across the Hong Kong–Mainland interface, both postures are relevant. The Hong Kong compliance file addresses the UN and Hong Kong statutory position. The Mainland counterparty's compliance with its own regime – including any applicable counter-measures – is a separate matter that requires Mainland-side legal input.

The second divergence is on information access. Hong Kong's corporate registry provides a level of beneficial-ownership information that, while not fully transparent at the level of ultimate natural persons, is accessible and auditable. Mainland corporate records provide registered information, but the path to natural-person beneficial ownership can be opaque, particularly where the ownership chain runs through multiple provincial or municipal entities, or through arrangements involving contractual control structures common in certain sectors.

The third divergence is on currency and payment infrastructure. Hong Kong operates a freely convertible currency regime with deep correspondent-banking relationships. Cross-border payments from the Mainland are subject to capital-account management and SAFE rules. These are not compliance issues in the sanctions sense, but they interact with the compliance file: a payment channel that requires SAFE approval but has not obtained it will fail at the point of remittance, regardless of the contractual position and regardless of the cleanliness of the compliance screen.

The practical consequence is that a compliance review for a Mainland engagement cannot be a Hong Kong-only exercise. The file must address the Hong Kong statutory position, the payment-channel mechanics on both sides, and the counterparty's own regulatory standing in the Mainland. Where the transaction has US dollar or Euro clearing exposure, the review must also address the position under the unilateral regimes that the relevant clearing institutions will apply.

This is where specialist cross-border counsel adds the most value: not in running a list screen, which any compliance software can do, but in interpreting the results across two systems and building a file that withstands scrutiny in both directions.

Where does the risk sit now? Our read on the current position

The risk environment for cross-border contracting with Mainland entities has tightened. It has not made such contracting impermissible or impractical. The point is the quality of the documentation, and the sequencing of the review.

Three developments shape the current position. First, correspondent-bank due diligence standards for Mainland-linked flows have increased materially over the past several years. Banks that previously accepted a standard KYC file now regularly request enhanced due diligence documentation, beneficial-ownership analysis to the level of natural persons, and evidence of source of funds. A compliance file that was adequate two years ago may not be adequate today.

Second, the interaction between the Mainland's domestic measures and the unilateral regimes of other states has become more complex. There is a small but growing category of transactions where the legal analysis under Hong Kong and Mainland law is straightforwardly clean, but where the banking analysis under a third jurisdiction's rules requires careful positioning. This is not a reason to avoid the transaction; it is a reason to build the file with the banking channel explicitly in view.

Third, the Foreign States Immunity Law applicable within the PRC, which came into force on 1 January 2024, has introduced a new consideration for groups with assets or judgments in the Mainland context. The restrictive immunity doctrine it adopts has implications for enforcement steps that may sit alongside a compliance-reviewed commercial contract. Where the contracting relationship is with a state-linked entity, the enforcement angle should be considered at the compliance-review stage, not after a dispute arises.

Our desk's assessment is that the risk is manageable for groups that treat the compliance review as a structured pre-contract exercise rather than a checkbox. The compliance review is the instrument that documents the decision. A documented decision is a defensible one. An undocumented decision, in the current environment, is a liability.

The objection we hear most often is that counterparty due diligence is the bank's job, not the contracting party's. That is a misreading of the position. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance places obligations on designated non-financial businesses and professions, not only on financial institutions. Beyond the statutory position, the commercial reality is that a group that cannot produce a compliance file when a correspondent bank requests one has effectively delegated its banking relationship to chance. The bank's file and the group's file are separate documents serving separate purposes.

What does a well-constructed compliance file contain?

A compliance file for a Mainland counterparty engagement is a living document. It begins before contract execution and is updated throughout the relationship. Its core components are defined by the Anti-Money Laundering and Counter-Terrorist Financing Ordinance regime and the standards that correspondent banks apply in practice.

The foundational documents are: the counterparty's constitutional documents and registration materials; a beneficial-ownership analysis traced to the level of natural persons, with supporting evidence; the results of sanctions and adverse-media screening against the United Nations consolidated list, with contemporaneous records of the screening date and methodology; and a source-of-funds analysis with supporting documentation proportionate to the transaction value and risk profile.

Beyond the foundational documents, a well-constructed file should contain: a payment-channel assessment identifying the mechanism for cross-border flows and any Mainland-side regulatory approvals required; a risk assessment recording the conclusions of the review and the risk rating assigned to the counterparty; and an ongoing-monitoring protocol specifying the trigger events for re-screening and re-documentation.

For a mid-market acquisition by a Southeast Asian group of a Mainland operating entity's offshore holding structure in early 2027, the compliance review identified a beneficial-ownership chain that ran through three provincial holding companies to a natural person who was also a director of a state-linked entity. No United Nations sanctions list entry applied. The correspondent bank, however, required enhanced documentation of the source of the acquisition consideration. The review had anticipated this: the source-of-funds analysis was pre-positioned in the file. The transaction proceeded without a hold. The file did the work that the contract could not.

The detail of the file matters. A list of documents is not a compliance file. A compliance file is a reasoned analysis, supported by documents, that a compliance officer or regulator can read and evaluate. The difference between the two is the difference between a transaction that clears and one that does not.

What should a group do before contracting with a Mainland entity?

The sequencing question is practical: what is the order of steps, and where in that sequence does outside counsel add value?

The first step is to identify the actual counterparty. Not the commercial contact; the legal entity that will sign the contract and make or receive payments. In Mainland structures, these are not always the same. The operating entity, the payment entity, and the group parent may be three different legal persons, each requiring separate screening.

The second step is to map the payment channel. Which currency? Which clearing mechanism? Which correspondent banks are in the chain? This step precedes the compliance review in the sense that it defines the compliance standard to be met: a US dollar flow through New York clearing attracts a different set of practical standards from a renminbi flow through the cross-border clearing arrangement.

The third step is to conduct the review. This is the structured process described above: entity identification, beneficial-ownership mapping, sanctions screening, source-of-funds analysis, and payment-channel assessment. The review should be documented contemporaneously. A retroactive file constructed after a bank's query is materially less useful than a contemporaneous one.

The fourth step is to assess the residual risk and make a documented decision. The compliance review is an input to a commercial decision, not a substitute for it. The group's decision-maker should review the conclusions of the review, record the decision to proceed or not, and note the conditions or additional steps that apply. That record is the compliance file.

The fifth step is to establish the ongoing-monitoring framework. The relationship does not end at contract execution. Changes in the counterparty's ownership, changes in the sanctions lists, and changes in the regulatory environment on either side of the border all require re-assessment. The framework for doing that should be in place before the contract is signed.

For groups with existing Mainland commercial relationships that predate a structured compliance framework, a retrospective review is the appropriate starting point. The position can usually be regularised. The cost of not doing so – in banking-access terms – is disproportionate.

To discuss how the compliance framework applies to your cross-border position with a Mainland entity, contact info@lockhartyip.com.

Related practices

• Sanctions & AML – cross-border sanctions compliance and AML file management for international groups
• Corporate Counsel – ongoing compliance counsel for cross-border commercial relationships

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Sanctions Aml
• Aml Source Funds File Cayman Islands Counterparty Cayman 4
• Aml Source Funds File Mainland China Counterparty Mainland 3

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.