Update: a cross-border SaaS or data agreement touching the BVI

A SaaS or data-processing agreement structured through the British Virgin Islands and served across the Hong Kong corridor carries a compounding set of regulatory exposures: the BVI's economic-substance regime (requiring in-scope entities to demonstrate genuine activity in the BVI), Hong Kong's Anti-Money Laundering and Counter-Terrorist Financing Ordinance obligations where a virtual-asset or data-services element arises, and data-flow restrictions that differ sharply between the two systems. None of those layers is static, and the sequencing of which regime governs first has shifted.

This briefing sets out what the current position means for principals operating on the Hong Kong–BVI corridor and where the immediate action sits.

What has changed and why it matters now

The BVI's substance requirements apply to entities conducting relevant activities – which now extend beyond financial services to holding and certain intellectual-property structures commonly used to house SaaS rights and data licences. Where a BVI entity is the contracting party to a cross-border SaaS agreement, it must be able to show that its core income-generating activities occur in the BVI. A dormant shelf entity executing an agreement from a Hong Kong office does not meet that standard.

At the same time, Hong Kong's regulatory posture toward data-services and technology agreements has sharpened. Where a SaaS platform touches virtual assets – processing transactions, providing infrastructure, or acting as a data layer for a virtual-asset trading platform (a VATP, licensed under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance with the Securities and Futures Commission as licensing authority) – the AML obligations attach to the platform as well as the trading entity. That position was confirmed operationally from 1 June 2023, when the mandatory VATP licensing regime commenced.

For agreements that do not touch virtual assets, the question is whether the BVI entity has substance to perform the contract, and whether the Hong Kong counterparty or customer is comfortable contracting with an entity whose functional activity sits elsewhere. In our cross-border practice, we regularly see agreements that pass initial due diligence but stall at the enforcement or onboarding stage precisely because the substance question was not addressed at drafting.

Who is affected across the Hong Kong–BVI corridor

The briefing applies directly to three categories of principal. First, technology groups that have incorporated a BVI holding or licensing entity to hold SaaS intellectual-property rights and are now contracting with Hong Kong or Greater China counterparties. Second, data-services businesses using a BVI special-purpose vehicle as the contracting party for regional data-processing or infrastructure agreements. Third, virtual-asset infrastructure providers whose data or API agreements route through a BVI entity and whose counterparties are licensed or regulated in Hong Kong.

Each category faces a distinct regulatory interface. The substance-compliance exposure is primarily a BVI tax and registry matter. The AML and licensing exposure runs through Hong Kong. The enforcement risk – what happens if a counterparty challenges the validity of an agreement executed by a non-compliant entity – sits in whichever court or arbitral forum the agreement names. Parties should verify the current position of their BVI entity's substance filings before the next agreement cycle.

The interaction between these layers is where foreign counsel most frequently misjudge the position. A BVI-law opinion on corporate authority does not address the Hong Kong AML or licensing layer. A Hong Kong solicitor's note on the agreement's governing law does not address BVI substance. The cross-border file needs both, read together.

Immediate action

Three steps are relevant now. First, review whether the BVI entity named as contracting party in any SaaS or data agreement satisfies the economic-substance requirement for its declared activity. If the entity is in a relevant-activity category, a substance report will be due to the BVI International Tax Authority; the filing calendar should be confirmed.

Second, assess whether the SaaS or data service touches virtual assets in any form – including providing infrastructure, data feeds, or settlement rails to a VATP or similar entity in Hong Kong. Where it does, the AML obligations under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance are engaged, and a compliance review of the contracting approach, the customer due-diligence procedure, and the travel-rule implications for any asset-transfer data is required.

Third, check the governing-law and dispute-resolution clause. An agreement between a BVI entity and a Hong Kong counterparty that names a neutral forum – Hong Kong-seated arbitration under the HKIAC Administered Arbitration Rules, for example – provides a well-tested enforcement path. One that relies on the courts of a third jurisdiction for a dispute between parties on this corridor introduces unnecessary procedural complexity.

For a preliminary review of your cross-border SaaS or data agreement and the BVI–Hong Kong compliance position, write to us at info@lockhartyip.com.

Further reading on related positions: our practice overview at Tech & Web3; the parallel briefing on the UAE corridor for cross-border SaaS and data agreements; and our analysis of digital-asset funds structured through Hong Kong and the BVI.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Tech Web3
• Cross Border Saas Or Data Agreement Touching Uae 3
• Digital Asset Fund Structured Through Hong Kong Bvi 7

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.