How to approach an AML and source-of-funds file for the CIS counterparty

A payment channel breaks down. A correspondent bank returns the wire and asks for documentation on the counterparty. The counterparty is incorporated in a CIS (Commonwealth of Independent States – the group of successor states to the Soviet Union, including Russia, Kazakhstan, Uzbekistan, Azerbaijan, and others) jurisdiction, and the in-house team has no standard file for it. That scenario, in some variation, reaches our desk regularly.

Building an anti-money laundering (AML) and source-of-funds file for a CIS counterparty in a Hong Kong cross-border context requires a structured sequence: identify the applicable obligations under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, gather the counterparty's legal identity and ownership documentation, trace the source of the funds involved in the transaction, assess the sanctions position under the United Nations Sanctions Ordinance, and assemble the compliance record in a form that a bank, regulator, or counterpart can interrogate. The sequence matters because each step is a gate: an unresolved issue at step two cannot be cured by excellent documentation at step four.

This guide walks through that sequence for in-house counsel managing a CIS counterparty relationship from a Hong Kong base or structure. It covers the decision the reader faces, the steps in order, the gates at each step, the common mistakes, and a short closing checklist.

Why the CIS counterparty creates a distinct file-building challenge

CIS counterparties are not a uniform category. A Kazakhstan-incorporated operating company with a decade of audited accounts presents a different starting profile from a recently established trading entity in a jurisdiction where beneficial ownership disclosure is limited. Both may appear in the same Hong Kong correspondent-banking relationship. Both require a file. But the content of that file differs substantially.

The challenge for in-house counsel is threefold. First, corporate registries in many CIS jurisdictions do not provide the same depth of beneficial ownership data that practitioners expect from, say, the United Kingdom or the British Virgin Islands. The burden of proof falls on the Hong Kong-side party. Second, several CIS states are on FATF (Financial Action Task Force – the international standard-setter for AML and counter-terrorist financing) grey lists or have been subject to enhanced follow-up. That status elevates the due-diligence standard that Hong Kong institutions apply. Third, the sanctions picture across CIS jurisdictions is not uniform. Some counterparties operate in states that are themselves subject to United Nations sanctions measures; others operate in states that are not, but have ownership chains that run through sanctioned persons.

These three features together mean that the standard know-your-customer (KYC) pack – a certificate of incorporation and a director list – will not close the file. A structured approach is required from the outset.

Step 1: Identify the governing obligations and the applicable threshold

The first gate is identifying what you are obligated to do and to whom you must account for it. In Hong Kong, the primary instrument is the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. That Ordinance imposes customer due diligence and record-keeping obligations on designated non-financial businesses and professions (DNFBPs – a category that includes solicitors, accountants, and corporate service providers in defined circumstances) as well as on financial institutions.

The question for in-house counsel is whether their entity is itself a reporting institution under the Ordinance, or whether the obligation runs to a financial institution in the payment chain – the bank processing the wire, the correspondent bank, or the trustee holding the relevant account. In practice, both obligations often arise simultaneously. The bank will run its own file on the transaction; the corporate entity will need to satisfy the bank's CDD requirements and, separately, maintain its own record.

The second part of this step is determining the risk classification. Under the Ordinance, enhanced due diligence is required where a counterparty or transaction presents a higher risk. A CIS counterparty with a complex ownership chain, or one that operates in a jurisdiction flagged by FATF, will ordinarily attract enhanced treatment. Counsel should establish this classification at the outset – not after the bank has asked.

The third part is the sanctions overlay. Hong Kong implements United Nations sanctions and does not give domestic effect to unilateral measures of other states. That distinction matters when a CIS counterparty's jurisdiction is subject to unilateral measures adopted by the United States, the European Union, or the United Kingdom but not to UN measures. The compliance analysis diverges depending on where in the payment chain the question arises. A Hong Kong-law obligation extends to UN-designated parties. The position for payments routed through correspondent banks in US-dollar clearing is a different and additional question, governed by US regulations, and must be assessed separately.

Step 2: Map the ownership and control structure

The second gate is establishing who actually controls the counterparty. For a CIS entity, that investigation rarely ends at the first layer. Nominees, holding companies in offshore centres, and foundations used as ownership vehicles are common.

The documentation objective at this step is a complete beneficial ownership chain to the ultimate beneficial owner – the natural person or persons who ultimately own or control the entity, applying the relevant threshold. The applicable threshold varies by context: the Ordinance uses its own definition; the bank may apply a lower threshold for practical file purposes; the FATF standard is a useful reference. Counsel should record which threshold they applied and why.

For CIS entities, the practical sequence is as follows. Start with the corporate registry in the country of incorporation, noting that registry data in many CIS jurisdictions is available online but may not be current or may require a local agent to obtain certified extracts. Obtain the founding documents, the charter or articles, and any register of participants or shareholders. Then move to the ownership layers above. If a BVI or Cayman Islands holding company sits above the CIS entity, obtain the register of members and the beneficial ownership declaration for that entity. Where a trust sits in the chain, obtain the trust instrument, the trustee identification, and confirmation of the settlor and beneficiary class.

A common error at this step is treating a nominee shareholder declaration as closing the beneficial ownership question. It does not. The declaration confirms a nominee relationship; it does not identify the principal. The file requires the identification of the principal as well as evidence of the nominee relationship. That distinction regularly causes file rejections at the bank review stage.

For cross-border transactions where the ultimate beneficial owner is a national of a CIS state but resident elsewhere – a pattern our desk sees frequently – the file should document both the original jurisdiction of citizenship and the current residence status, with supporting evidence for each.

Step 3: Build the source-of-funds and source-of-wealth record

This step is where most files stall. Source-of-funds refers to the origin of the specific monies being transacted. Source-of-wealth refers to the broader question of how the beneficial owner accumulated their assets. For a large or complex transaction, both are required.

The distinction matters practically. A counterparty may be able to demonstrate clean source-of-funds for the specific payment – a receivable from a disclosed trade contract, for example – while the source-of-wealth question remains open. A bank conducting enhanced due diligence will ask both questions. The file must answer both.

For CIS beneficial owners, source-of-wealth documentation commonly includes: audited financial statements for the underlying operating business, tax return records from the relevant jurisdiction, documentation of any significant asset realisation event (a business sale, a real estate transaction, a dividend record), and, where the wealth was accumulated during the privatisation period of the 1990s or early 2000s, contemporaneous or later-certified records of the acquisition.

That last category is frequently the hardest. Documentation from the privatisation period is often incomplete, was not produced with an AML file in mind, and may not exist in a form that a Hong Kong bank's compliance team can readily process. The practical response is a documented narrative supported by the best available contemporaneous evidence, supplemented by a legal opinion or professional attestation where the underlying documents are in a non-English CIS language. A bare narrative without supporting documents will not close the file.

The source-of-funds record for the specific transaction should document the payment route from origination: the account from which the funds move, the basis for the payment (a contract, an invoice, a board resolution), and any prior steps in the payment chain. A payment chain diagram is not legally required but materially assists the bank's review and, in our experience, reduces the number of follow-up requests.

Step 4: Screen against the sanctions lists and run the negative-news check

This step runs in parallel with steps two and three, but it has its own gate logic: a positive match at this step may halt the file entirely, regardless of how well steps two and three are constructed.

The screening obligation under Hong Kong law runs to UN-designated parties. That means the UN Security Council consolidated list, plus any specific lists promulgated under the United Nations Sanctions Ordinance for the regimes engaged. For a CIS counterparty, the relevant UN regimes to check include any measures applicable to the specific CIS jurisdiction and any measures applicable to individuals in the ownership chain.

The additional screening question is whether the counterparty or its beneficial owners appear on unilateral measures lists. As noted above, Hong Kong does not give domestic effect to unilateral measures. However, the practical effect of a match on, say, an Office of Foreign Assets Control (OFAC) designation list is significant for any dollar-clearing or US-correspondent-bank element in the payment route. That question requires a separate compliance analysis and, where the answer is unclear, specialist input.

The negative-news check is distinct from sanctions screening. It is a structured search of available public record – regulatory decisions, court proceedings, adverse media – for the counterparty and its beneficial owners. A negative-news hit does not create a prohibition, but it elevates the risk classification and requires a documented response in the file. In our practice, we see files that have run thorough sanctions screens but have not conducted a negative-news check: that gap is consistently identified by bank compliance teams as a reason to return the file.

Step 5: Document and assemble the file in a bankable form

A technically complete file that is not legible to the reviewing institution will not pass. The assembly step is not administrative box-ticking. It is an act of communication: the file tells a coherent story, in a sequence a compliance officer can follow, with every claim supported by an identified document.

The structure that works in our experience follows this order. A one-page executive summary: who the counterparty is, what the transaction is, the risk classification applied, and the conclusion. Then the supporting sections in the order the compliance officer will look: corporate identity documents; ownership and beneficial ownership chain; sanctions and negative-news screen results; source-of-funds for the transaction; source-of-wealth for the beneficial owner; any enhanced due diligence narrative.

Each document in the file should be indexed, with a clear reference in the narrative to the document it supports. Certified translations are required for documents in a non-English language. The certification standard varies by institution, but a certified translation by a qualified translator, with a statement of qualifications, ordinarily satisfies the requirement.

Originals or certified copies are required for the core corporate documents. Photocopies or screenshots of a registry website are not acceptable as the primary record, though they may be included as secondary references.

The file should also record the date of each check and the version of each list screened. Compliance reviews are time-sensitive. An undated screen is not evidence of a screen. Record the date, the list version, and the result for every sanctions and negative-news check.

What foreign counsel get wrong – and how this route avoids it

In-house teams without a structured approach to CIS counterparty files commonly make one of three errors. The first is conflating the KYC pack with the source-of-funds file. They are not the same. A KYC pack establishes who the counterparty is. A source-of-funds file establishes where the money comes from. Both are required, but they answer different questions.

The second error is running the file for the bank's purposes only, without maintaining an internal compliance record. When a regulator or enforcement authority later asks the in-house team what due diligence it conducted, a copy of the pack sent to the bank is not sufficient. The internal record should document the team's own analysis, the risk classification it applied, and the basis for proceeding.

The third error is treating the file as a one-time exercise. A CIS counterparty relationship that extends over multiple years or involves repeat transactions requires periodic refresh. The ownership structure may have changed. A beneficial owner may have become subject to a new UN designation. The file must be kept current, not created once and filed away.

The sequence in this guide addresses all three errors: it builds both the counterparty identification layer and the source-of-funds layer; it is explicitly structured as an internal compliance record, not just a bank pack; and its step-by-step structure can be applied to each significant transaction or on a periodic refresh cycle.

A mid-market trading group based in Hong Kong, transacting with a Kazakhstan-incorporated counterparty whose ultimate beneficial owner was a national resident in Cyprus, came to us in the second half of 2026. The bank had returned the file twice. The problem was not the documents themselves – the counterparty had provided a reasonable corporate pack – but the source-of-wealth narrative, which referenced a business sale from the early 2000s without contemporaneous documentation. We restructured the file around a supported narrative, obtained a professional attestation on the original transaction, and prepared a certified translation of the relevant documents. The file was accepted on the next review cycle.

Decision checklist: the six questions before you file

Before assembling the final file, in-house counsel should be able to answer each of the following six questions affirmatively or with a documented explanation of why a particular item is not applicable.

First: have you identified and documented the applicable AML obligation – under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and any additional obligation from your institution's own policies – and the risk classification you have applied to this counterparty?

Second: is the beneficial ownership chain complete to the ultimate natural person, with documentation for each layer, and is the nominee/principal distinction resolved with evidence at every step where a nominee relationship exists?

Third: does the source-of-funds record trace the specific monies in the transaction from origin, with the contract, invoice, or other basis for payment identified?

Fourth: does the source-of-wealth record document how the beneficial owner accumulated their assets, with contemporaneous or contemporaneously certified supporting documents for the significant wealth events?

Fifth: has a sanctions screen been run against the UN consolidated list and the specific UN regime lists applicable to the CIS jurisdictions engaged, with the date, list version, and result recorded? And has the additional question of unilateral measures been separately assessed for any dollar-clearing or non-Hong Kong correspondent-bank element in the payment route?

Sixth: is the file assembled in a legible sequence – summary, corporate identity, ownership, screen results, source-of-funds, source-of-wealth – with every claim indexed to a supporting document, certified translations in place, and each check dated?

If any question cannot be answered affirmatively, that is where the work remains.

The sequence described in this guide runs consistently whether the counterparty relationship is new or ongoing. The documents change; the structure does not. In our cross-border practice, the files that pass bank and regulatory review are not necessarily the longest. They are the ones that tell a coherent, documented story with no unresolved gaps in the sequence.

For more on the broader obligations that apply in a Hong Kong context, the firm's Sanctions & AML practice page sets out the governing regime and where cross-border work in this area typically concentrates. Counsel dealing with a related matter involving a corporate services provider context may also find the analysis in our matter note on AML obligations for Hong Kong corporate services providers of practical use. Where the counterparty relationship touches Cyprus as an intermediate jurisdiction, our guide on sanctions due diligence for deals touching Cyprus addresses the overlapping considerations.

The governing rules are technical and the standards applied by institutions vary. If an earlier file was returned or a counterparty relationship has stalled pending documentation, a second read can often identify the gap and the steps still available.

To discuss the file-building sequence for your CIS counterparty position across the relevant jurisdictions, write to us at info@lockhartyip.com.

Related practices

• Sanctions & AML – cross-border AML compliance, sanctions screening, and counterparty due diligence from Hong Kong
• Holding Structures – structuring and review of multi-jurisdiction holding chains for CIS and international groups

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Sanctions Aml
• Aml Obligations Hong Kong Corporate Services Provider Matter
• Sanctions Due Diligence Deal Touching Cyprus Cyprus Guide

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.