How to approach a compliance review before BVI

Q: How long does a compliance review before contracting with the BVI entity usually take?

A straightforward review typically takes between five and fifteen business days from the point of instruction, assuming the counterparty cooperates promptly with document requests. Where the ownership chain includes multiple offshore layers or where an adverse-media or sanctions flag requires a written risk assessment, the review takes longer. The timeline is controlled primarily by the speed of document production by the BVI registered agent and the counterparty's counsel.

A deal memo arrives. The counterparty is a British Virgin Islands entity. The commercial terms look workable. But before the contract is signed – and before any payment channel opens – the compliance question comes first. For in-house counsel at an Asian or European group with cross-border banking relationships, that question carries real weight. A misstep in the pre-contract review does not stay in the file. It surfaces in the bank's onboarding questionnaire, in the correspondent-bank's due diligence call, and, in a worst case, in an enforcement action.

A compliance review before contracting with a BVI entity is a structured pre-contract check of the counterparty's beneficial ownership, source of funds, sanctions status and structural legitimacy, conducted under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the United Nations Sanctions Ordinance, and documented before the first payment instruction is issued. The review is not optional for regulated entities. For unregulated principals, it remains the document that protects the banking relationship and the contract itself.

This guide sets out the decision the reader faces, the correct sequence, the gate at each step, the most common structural mistake, and a closing checklist. The cross-border interface is Hong Kong and the BVI – two common-law jurisdictions that interact daily across thousands of holding structures, but whose compliance expectations need to be matched precisely before a payment channel is opened.

Why the BVI context changes the compliance calculus

The BVI is the world's most widely used offshore holding jurisdiction. Its companies are legal, well-regulated, and commercially standard across Greater China, Southeast Asia, the Middle East, and the principal European markets. None of that means the compliance review is routine.

The structural feature that changes the calculus is opacity at the shareholder level. A BVI entity does not appear on a public shareholder register. Its beneficial owners are recorded with the BVI registry – or with a registered agent – but not visible to a counterparty by default. That opacity is the central compliance challenge, not a mark against the BVI itself.

For any contracting party that maintains banking relationships with Hong Kong correspondents or international clearing banks, the BVI counterparty's ownership chain will eventually be examined. The bank will ask. The question is whether the answer is already documented, organised, and defensible – or whether it is being assembled under pressure after the fact. In our cross-border practice, the second scenario is the one that stalls payment and kills the deal.

Hong Kong implements United Nations sanctions and does not give domestic effect to unilateral measures of other states. That means the sanctions check at the centre of any BVI compliance review is a UN-list check, applied across the entity, its directors, and its beneficial owners. The position in other jurisdictions engaged by the transaction – the US, the EU, or the UK – may differ, and those positions are assessed separately where the payment channel, the bank, or the underlying asset brings a second system into play.

Step one: establish what you are reviewing and why

The first step in any compliance review is scope-setting – deciding precisely what the review covers and what legal standard it is being designed to satisfy. This is not a formality. Scope determines the document set, the expert input required, and the time the review takes.

Three questions define scope at the outset. First: is your entity a regulated institution under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance? If yes, the review is a legal obligation with prescribed content – customer due diligence, beneficial-ownership verification, ongoing monitoring, and record-keeping. The Ordinance names the categories of regulated institution, and the relevant regulators – including the Hong Kong Monetary Authority and the Securities and Futures Commission – have published AML guidelines that specify what a compliant review looks like in practice. Second: does the transaction involve a banking channel that will itself conduct a review? Where a bank is processing the payment, the bank will apply its own customer due diligence standards, and those standards are often more demanding than the contractual position alone requires. Your review should anticipate the bank's questions, not merely satisfy the contract. Third: does the subject matter of the contract – the asset, the activity, the jurisdiction of performance – introduce a sector-specific compliance layer? Where the contract involves virtual assets, securities, or real property in a sensitive jurisdiction, additional checks apply.

Once scope is set, the review has a defined purpose. That purpose drives every step that follows. Without a clear scope document – even a one-page internal note – the review drifts, gaps appear, and the resulting file does not hold up when a correspondent bank requests the underlying due diligence.

Step two: collect the ownership and control chain

The ownership and control chain for a BVI entity runs from the operating entity upward through any intermediate holding layers to the natural persons who ultimately own or control it. Collecting that chain is the substantive core of the review.

The standard document set for a BVI entity includes: the certificate of incorporation, the memorandum and articles of association, a certificate of good standing, a register of directors, and – critically – a certified beneficial ownership declaration identifying all persons who hold, directly or indirectly, a defined ownership or voting interest. The BVI Business Companies Act imposes beneficial-ownership record-keeping obligations on BVI entities. That statutory regime means the documents exist at the registered-agent level. Getting them into your file is a documentation step, not an investigative one – but it requires formal instruction to the BVI registered agent or to the counterparty's counsel, with a clear statement of what is being requested and why.

Where the ownership chain runs through a second offshore layer – a Cayman holding company above the BVI entity, or a trust structure at the apex – each layer is traced separately. The review does not stop at the first entity. It stops at the natural person. That rule applies regardless of whether the intermediate structure is in a trusted jurisdiction. In our experience, the gap most commonly found in a first-attempt review is a missing layer between the BVI entity and its ultimate beneficial owner, typically because the review was scoped at the entity rather than at the chain.

Once the chain is documented, the persons identified are verified. Verification means identity documents for natural-person beneficial owners and, where the beneficial owner is a corporate or fiduciary entity, appropriate entity-level documents. The standard applied should match the risk classification of the transaction: lower-value, lower-risk contracts may use simplified verification; higher-value transactions with cross-jurisdictional payment flows require enhanced due diligence.

Step three: run the sanctions and adverse-media check

With the ownership chain documented and the persons identified, the sanctions and adverse-media check is conducted against every named individual and entity in the chain. This is a distinct step, not an add-on to the ownership review.

The sanctions check under Hong Kong law is a check against the UN consolidated sanctions list and any Hong Kong-specific designations made under the United Nations Sanctions Ordinance. The check covers the BVI entity, each director, and each beneficial owner identified in step two. Where the transaction has connecting factors to other jurisdictions – the payment bank is a US-correspondent institution, for example, or the underlying asset is located in the European Union – the relevant lists for those systems are checked in parallel. The Hong Kong position and the position in other engaged jurisdictions are assessed and documented separately.

Adverse-media review is not a statutory requirement in the same sense, but it forms part of a well-constructed enhanced-due-diligence file for higher-risk transactions. The review covers adverse judicial or regulatory findings, press coverage of enforcement action, association with politically exposed persons (PEPs – individuals who hold or have held prominent public functions – whose relationships require enhanced scrutiny under AML guidelines), and any known history of sanctions designations that have subsequently been lifted. A clean list-check result alongside a flagged adverse-media result still requires a risk assessment and, in most cases, a decision-maker sign-off before the contract proceeds.

The output of this step is a completed and dated sanctions-check record, a named adverse-media review record, and a written risk assessment. These three documents are the core of the compliance file. They are what the bank will request if the payment is queried. They should exist before the contract is executed, not after.

Step four: assess the source of funds and the payment channel

The source-of-funds assessment is the step most commonly misunderstood by contracting parties who approach the review as a box-ticking exercise. It is not a question about where the money is coming from in the narrow sense of the originating bank account. It is a question about the commercial and economic origin of the funds that will flow through the contract.

A BVI entity that receives funds from its operating subsidiaries in the Mainland, pays a dividend to a trust, and then settles a contract with a Hong Kong-incorporated group has a payment chain that a bank – and a compliance function – will trace. The question is whether each leg of that chain is explicable by reference to legitimate commercial activity, supported by documentation, and consistent with the beneficial ownership structure already identified. Where a leg of the chain cannot be explained, it is flagged, assessed, and either resolved or escalated.

For the contracting party on the Hong Kong or international side, this means understanding – not just accepting – the source of the funds that will flow to it. That understanding should be documented. A short source-of-funds summary, with supporting documents (audited accounts, the group structure chart, a description of the underlying business) is the standard form. Where the funds flow involves multiple jurisdictions, the summary describes the cross-border path explicitly.

The payment channel itself is a separate but related point. A contract that on its face settles between a BVI entity and a Hong Kong entity may, in practice, involve a payment routing through a bank that is subject to US dollar clearing rules, or through a correspondent bank that applies its own enhanced-due-diligence standards. Identifying the likely payment channel before the contract is signed allows the compliance review to address the channel's requirements, not just the contract's. For more on responding to source-of-funds requests from banks once a payment is in transit, see our guide on responding to a bank's source-of-funds request.

Step five: document the review and obtain sign-off

The compliance review is only as useful as its documentation. A review that was conducted but not documented is, from a regulatory and banking perspective, a review that did not happen.

The documentation standard for a BVI counterparty compliance review should include: the scope-setting note from step one; the ownership-chain documents and verification records from step two; the dated sanctions-check and adverse-media records from step three; the source-of-funds summary and supporting documents from step four; and a sign-off record naming the decision-maker who approved the review as complete and the transaction as cleared to proceed.

The sign-off step is not bureaucratic formality. It is the point at which the compliance function – or, for a non-regulated entity, the in-house counsel or the designated compliance officer – confirms that the review was complete, that no material risks were unresolved, and that the decision to contract was made with full visibility of the compliance position. Where a risk was identified but assessed as acceptable, the sign-off note explains the basis for that assessment.

The completed file is retained for a period that, at minimum, satisfies any applicable statutory record-keeping requirement. For regulated institutions under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, the record-keeping period is prescribed. For unregulated contracting parties, a minimum of five years from the date of the transaction is a standard prudent practice – long enough to address any subsequent inquiry by a bank, a regulator, or a counterparty. Parties should verify the current position before acting.

For matters where the BVI counterparty has a complex beneficial-ownership structure or where the source-of-funds chain crosses multiple jurisdictions, allied counsel in the relevant jurisdiction may be engaged to confirm the local position. The Sanctions & AML practice at Lockhart & Yip coordinates that engagement where it arises.

The most common mistake: treating the review as a single-point check

The most frequent structural error in BVI counterparty compliance is treating the review as a one-time, pre-contract exercise that, once completed, does not need to be revisited. That approach is correct in structure but incomplete in application.

The compliance position of a BVI entity changes. Beneficial owners change. Sanctions lists are updated – sometimes with short notice between the designation date and the effective date. The financial crime risk environment in the BVI entity's operating jurisdiction may change. A payment that was compliant at the point of contract may become a live compliance issue two months later if a beneficial owner is designated on a relevant list, or if the adverse-media position changes materially.

Ongoing monitoring is a requirement under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance for regulated institutions. For unregulated contracting parties, it is best practice. The minimum form is a periodic re-check of the sanctions list against the identified beneficial owners, and a standing instruction to reopen the file if the commercial relationship changes materially – for example, if the transaction value increases substantially, if the payment routing changes, or if the ownership structure is amended.

A second common error is a related one: scoping the review at the entity level rather than the chain level. A BVI entity may be clean on the face of the public record, while a beneficial owner at the apex of the chain is a designated person. The review that stops at the entity misses the risk. The review that traces the chain to the natural persons catches it. What foreign counsel – and foreign in-house teams unfamiliar with BVI structural convention – frequently misread is the depth of chain required. In our cross-border practice, we regularly see files that have a clean certificate of incorporation and a blank on the beneficial-owner line. That gap is the one the bank finds first.

For matters where the source-of-funds question intersects with AML file-building for a BVI counterparty, see the related guide on constructing an AML source-of-funds file for a BVI counterparty.

Decision checklist: is the review complete?

The checklist below is a functional gate, not a certification. Each item represents a step that should be completed and documented before the contract is executed and the payment channel is opened.

Scope defined: the applicable legal standard has been identified, the regulated or unregulated status of the reviewing entity has been confirmed, and the payment channel has been identified.
Ownership chain traced: the beneficial-ownership chain from the BVI entity to the natural persons has been documented, with no intermediate layer missing.
Identity verified: identity verification documents have been obtained for each natural-person beneficial owner at the applicable standard (standard or enhanced, based on risk classification).
Sanctions check completed: a dated check has been run against the UN consolidated list and any applicable jurisdiction-specific lists, covering the entity, all directors, and all beneficial owners. The check record has been saved to the file.
Adverse-media review completed: for higher-risk transactions, a named adverse-media review has been conducted and the result documented.
Source-of-funds summary prepared: the commercial and economic origin of the funds flowing through the contract has been documented, with supporting materials.
Risk assessment written: any flagged item – a match, a near-match, an adverse-media result, a gap in documentation – has been assessed in writing, with a conclusion.
Sign-off obtained: a named decision-maker has reviewed the file and authorised the transaction to proceed, with the date and basis recorded.
Monitoring instruction in place: a standing instruction to re-check the sanctions position periodically, or on a material change, has been recorded.
File stored: the complete file is stored in a retrievable format for the applicable retention period.

If any item is incomplete, the review is not complete. The contract may still proceed to negotiation. But the payment channel should not open until the file can pass this checklist.

The sequence above describes the standard position for a BVI counterparty compliance review with a Hong Kong connecting factor. Your matter turns on the specific ownership structure, the jurisdictions actually engaged, and the payment channel in use – which is where the practical difficulty usually sits.

If a prior review produced a stalled payment or a bank query that was not resolved, a second read of the file can identify the gap and the steps still available to address it. Write to us at info@lockhartyip.com to discuss the position.

Related practices

Sanctions & AML – compliance file construction, counterparty review, and payment-channel risk management across Greater China and offshore centres
Holding Structures – BVI and Cayman holding entity structuring and cross-border ownership chain advice

Frequently asked questions

Which jurisdiction's law applies to a compliance review before contracting with the BVI entity?

The applicable law depends on the legal position of the reviewing party and the payment channel, not only the location of the BVI entity itself. A Hong Kong-regulated entity conducts its review under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the United Nations Sanctions Ordinance. Where the payment channel involves a US dollar correspondent bank or a clearing institution in the European Union or the United Kingdom, those systems' requirements apply in parallel. The review should identify each engaged system and address its requirements separately – a single-jurisdiction review is rarely sufficient for a cross-border transaction with an offshore counterparty.

Do I need a Hong Kong adviser for a compliance review before contracting with the BVI entity?

Where the reviewing party maintains banking relationships in Hong Kong, is incorporated in Hong Kong, or uses a Hong Kong payment channel, the review will be assessed against Hong Kong regulatory standards. International counsel with a cross-border practice – coordinating with locally licensed Hong Kong firms and BVI counsel where needed – provides the most useful input in that situation. The specific content of the review turns on the AML guidelines published by Hong Kong's regulators, and those guidelines interact with the BVI entity's own registered-agent obligations. A purely domestic review, conducted without reference to the Hong Kong regulatory position, frequently misses the layer the bank will examine.

How long does a compliance review before contracting with the BVI entity usually take?

A straightforward review – where the BVI entity has a simple ownership chain, the beneficial owners are readily identifiable, and no adverse indicators are flagged – typically takes between five and fifteen business days from the point of instruction, assuming the counterparty cooperates promptly with document requests. Where the ownership chain includes multiple offshore layers, where a beneficial owner is a trust or a corporate structure requiring further tracing, or where an adverse-media or sanctions flag requires a written risk assessment, the review takes longer. The timeline is controlled primarily by the speed of document production by the BVI registered agent and the counterparty's counsel. Parties should plan the compliance review as a preliminary step, not a concurrent one.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

How to approach a compliance review before contracting with the BVI entity