How to approach sanctions due diligence for a Cyprus

Cyprus sits at a structural intersection that most deal teams underestimate until the payment fails. It is a European Union member state, so EU sanctions apply in full. It is also a common holding and treasury location for groups with Mainland Chinese, CIS and Middle Eastern ownership – groups whose counterparty networks frequently include names that appear on multiple, and sometimes conflicting, list regimes. When a Hong Kong entity is party to the transaction, a third layer enters: Hong Kong implements United Nations sanctions and does not give domestic effect to unilateral measures of other states. That triangulation – EU rules on the Cyprus side, UN-only posture on the Hong Kong side, and a deal in between – is where due diligence either holds or breaks down.

Sanctions due diligence for a deal touching Cyprus requires a structured, sequential review of all parties, their ownership chains and the payment routes across at least two regulatory regimes – EU sanctions law governing the Cyprus-side entities and the United Nations sanctions framework applicable in Hong Kong. The review must be completed before signing and before any funds move, because both regimes impose liability on the counterparty that proceeds without a clean file.

This guide sets out the steps in order, identifies the gate at each stage, and flags the single most common mistake that causes a clean deal to be stopped at the correspondent bank. It is written for in-house counsel and compliance officers who are approaching this intersection for the first time or who have had a deal stalled and need to understand why.

Why does Cyprus create a distinct sanctions question for Hong Kong parties?

Cyprus presents a distinctive compliance profile precisely because of its dual function in international deal structures. As an EU member state, Cyprus gives domestic effect to EU regulations, including the full suite of EU autonomous sanctions programmes – programmes that extend well beyond the measures adopted by the United Nations Security Council. Those EU programmes cover individuals and entities in relation to Russia, Belarus, Syria, Iran, Myanmar and other designations that are not mirrored, or are only partially mirrored, in UN Security Council resolutions.

A Cyprus-incorporated holding company is subject to EU sanctions law. Its bank accounts are held at EU-regulated institutions. Its directors, if EU nationals or EU residents, are themselves subject to EU primary prohibitions. Any professional service provider in Cyprus – a law firm, an administrator, an audit firm – operates under the same EU regime. This means that even a transaction which is entirely clean from a Hong Kong and UN perspective may be blocked or flagged the moment it involves a Cyprus-side counterparty whose bank applies EU rules.

The reverse is also true. A Hong Kong-side party may carry counterparty exposure – through its own ownership chain, through a Mainland Chinese parent, through a CIS shareholder, or through an underlying asset located in a sanctioned territory – that the Cyprus-side bank will regard as disqualifying. Correspondent banks in the EU apply EU rules, and some also apply extraterritorially motivated rules from US or UK regimes in their internal policies, even where those regimes are not directly applicable to Hong Kong-law contracts.

In our cross-border practice, the deals that encounter the most serious payment-channel problems are not those involving obvious red-flag names. They are deals where one party assumed its own clean position was sufficient – and did not map the full counterparty network before the transaction documents were executed.

Step 1 – Map the parties and the applicable regimes before any other step

The first gate is identification: before any search is run, every legal and beneficial party to the transaction must be identified, together with the applicable sanctions regimes that govern each. This step is frequently compressed or skipped when deal teams are under time pressure. It is the step whose omission accounts for most stalled closings.

The mapping exercise covers four categories.

Legal entities. Identify every company, trust, partnership or fund that is a party or a payment counterparty, including the Cyprus entity, its parent chain, and any Hong Kong or offshore entities through which payment or ownership flows.

Beneficial owners. Trace beneficial ownership to the natural person level, applying at minimum the standard used by EU AML directives – in practice this means ownership or control at or above 25%, though many EU banks apply a lower threshold in their own customer-due-diligence policies. Record nationality, country of residence, and any known political exposure.

Governing regimes. For each party, record which sanctions regimes apply: UN Security Council measures (applicable in Hong Kong under the United Nations Sanctions Ordinance); EU autonomous sanctions (applicable to Cyprus-incorporated entities, EU-national directors, and EU-bank payment channels); and any other applicable domestic measures in the jurisdiction of incorporation or operation. Do not assume that a regime which does not apply directly to the Hong Kong party is irrelevant – if the payment route passes through an EU correspondent, that bank will apply EU rules regardless of the governing law of the underlying contract.

Payment routes. Map the anticipated flow of funds: the sending institution, any correspondent or intermediary banks, the receiving institution, and the currency. A EUR or USD payment from Hong Kong to Cyprus will ordinarily transit one or more correspondent institutions in the EU or the United States. The correspondent's own compliance programme is a separate gate that sits outside the parties' control.

Only when this map exists can a meaningful sanctions search be designed. Running a search on the named counterparty alone, without the ownership chain or the payment-channel analysis, produces a file that will not withstand scrutiny from the Cyprus-side bank or from a compliance reviewer.

Step 2 – Screen against the correct lists and document the outcome

With the party map in hand, the second step is structured list screening. The lists to be searched are determined by the regime analysis from Step 1 – not by convenience or the tools that happen to be available.

For a deal with a Cyprus nexus and a Hong Kong party, the minimum screen covers the United Nations consolidated list (the list maintained by the UN Security Council Sanctions Committee, which is the basis of Hong Kong's own sanctions implementation under the United Nations Sanctions Ordinance); the EU consolidated list of persons, groups and entities subject to EU financial sanctions; and any EU sectoral restrictions that apply to the industries, assets or territories involved, including restrictions on services and goods that go beyond named-person designations.

For each search, the output must be retained in the file. A clean result is not self-evidently clean: a name that does not appear as an exact match may still require examination for variant spellings, related entities, or politically exposed status. Document what was searched, when it was searched, and the result. Sanctions lists are updated frequently – a screen completed before a term sheet is signed needs to be refreshed before closing.

A note on EU sectoral measures: they operate differently from designated-person lists. They restrict certain categories of transaction – types of services, classes of goods, specific industries – irrespective of whether any individual party is designated. A deal in the energy sector, in financial services, or involving technology goods with dual-use potential requires analysis of the sectoral restrictions applicable under the relevant EU measures, not just a name search. This is the analysis that in-house teams most frequently omit when they are working without specialist input.

We regularly advise clients whose screening programme was limited to named-person searches and who subsequently encountered a correspondent bank refusal based on sectoral analysis. Rebuilding the file after that point is significantly more difficult than doing the analysis at the outset.

Step 3 – Assess the payment channel and obtain any necessary authorisations

The payment channel is where deals that have passed a clean substantive screen are stopped. A bank – whether the sending institution in Hong Kong, a correspondent in the EU or the United States, or the receiving institution in Cyprus – is an independent compliance decision-maker. Its refusal to process a payment is not a legal finding, but it is a practical barrier that can take weeks or months to resolve after the fact.

Before a payment instruction is issued, counsel should assess the likely compliance posture of each bank in the chain. That assessment turns on the following questions. Does the sending institution have its own policy on counterparty jurisdictions or sectors that goes beyond the UN list? Does the anticipated payment route transit a correspondent that applies extraterritorial rules? Does the Cyprus receiving bank have enhanced due diligence obligations that will require documentation the parties have not yet assembled?

Where the analysis raises a realistic prospect of delay or refusal, the correct step is to assemble a supporting file in advance and, where the institution permits it, to pre-notify the compliance desk. This is not standard practice in most deal teams. It is, however, what distinguishes a transaction that closes on schedule from one that is delayed at the payment stage.

Where a transaction genuinely requires a departure from the ordinary position – for example, because an asset is in a territory subject to sectoral measures, or because a party holds a status that would ordinarily engage a restriction – authorisation from the relevant competent authority may be available. On the EU side, applications for specific licences or authorisations are made to the relevant national competent authority of the EU member state whose rules are engaged. Timing for such applications is measured in weeks to months. Parties that discover the need for authorisation only after executing binding documents are in a significantly worse position than those who identified it in Step 1.

Step 4 – Review the contractual provisions

Sanctions due diligence is not complete when the party screen and payment-channel analysis are done. The transaction documents themselves need to reflect the outcome of the review and allocate the risks that the review has identified.

Standard deal documents rarely address the full sanctions-compliance picture for a multi-jurisdictional transaction of this kind. The provisions that matter fall into three categories.

Representations and warranties. Each party should warrant, as at signing and closing, that it is not a designated person under the applicable regimes, that its beneficial owners are not designated, that the transaction does not involve a prohibited country or sector, and that no payments will be processed through a channel that would engage a restriction. The scope of the warranted regimes must match the regime analysis from Step 1 – a warranty that references only one regime when two or three are engaged is inadequate.

Undertakings. Where the transaction has a continuing character – a joint venture, a service arrangement, a loan – ongoing undertakings to maintain compliance and to notify promptly on any change in designation status or beneficial ownership are appropriate. These undertakings protect the compliant party if the position changes after closing.

Termination and suspension rights. A right to terminate or suspend performance without liability in the event that continued performance would require a breach of applicable sanctions law is a standard provision in well-drafted cross-border agreements. Its absence is a common drafting omission on deals where sanctions analysis was treated as a back-office step rather than a structuring question.

The governing law of the contract does not determine which sanctions regime applies to the parties. A contract governed by Hong Kong law between a Hong Kong entity and a Cyprus entity does not displace EU sanctions obligations – the Cyprus party and its bank remain subject to EU law regardless of the choice-of-law clause.

Step 5 – Assemble and retain the compliance file

The output of the due diligence process is a compliance file. It serves three purposes: it demonstrates to the banks in the payment chain that a structured review was completed; it protects the parties in the event of a regulatory enquiry; and it provides the baseline for the ongoing monitoring required if the transaction has a continuing character.

The file should contain the party map from Step 1; the list-search results from Step 2, with date and scope; the payment-channel assessment from Step 3; any correspondence with institutions or competent authorities; and the signed transaction documents incorporating the provisions from Step 4. Each document in the file should be dated.

Retention periods are set by the applicable AML and regulatory regimes. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance governs the record-keeping obligations of regulated persons in Hong Kong. On the Cyprus and EU side, AML obligations under the applicable EU directive impose their own retention requirements. Where the transaction involves a regulated entity on either side, those obligations apply. Even where neither party is formally regulated, a well-kept compliance file is the primary defence against a bank's later assertion that the transaction was not adequately reviewed.

A second screen of the party list immediately before closing – and before any payment instruction – is not optional. It is the gate between a clean file and a file that was clean at the time of preparation.

The common mistake: conflating the applicable regimes

The single most consistent error in sanctions due diligence for deals of this type is treating the applicable sanctions regime as a single question with a single answer. It is not.

A Hong Kong party's own obligations run to UN Security Council measures, implemented through the United Nations Sanctions Ordinance. Hong Kong does not give domestic effect to EU autonomous sanctions, US OFAC programmes, or UK autonomous measures. A Hong Kong-incorporated entity contracting on Hong Kong law does not breach Hong Kong law by transacting with an entity that is on an EU list but not a UN list – as a matter of Hong Kong's own applicable law.

That is the correct analysis as far as Hong Kong law goes. The error is stopping there. The Cyprus counterparty, its bank, and every institution in the payment chain that is subject to EU law are bound by EU rules. They will not process a transaction that their own analysis flags as non-compliant, regardless of what Hong Kong law says. The payment refusal is not a legal adjudication – it is a practical outcome that has the same economic effect as a legal prohibition.

This is why the due diligence file must address each applicable regime on its own terms, and why the payment-channel analysis in Step 3 is not a formality. Counsel whose practice is limited to one jurisdiction will address one regime. A cross-border matter of this kind requires advice that spans the full set of regimes engaged.

What foreign or single-jurisdiction counsel often get wrong is advising the client that a clean UN screen is sufficient. It is sufficient only for the client's own Hong Kong-law compliance position. It says nothing about whether the Cyprus counterparty can proceed, whether the EU bank will make the payment, or whether the transaction documents adequately allocate the risk that one party is subject to a restriction the other is not. Those are separate questions requiring separate analysis.

The sequence above describes the standard position. Your matter turns on the documents, the jurisdictions actually engaged, and the order of steps – which is where the route is won or lost. For a structured assessment of your position across the EU, UN and Hong Kong regimes, write to us at info@lockhartyip.com.

Decision checklist for in-house counsel

The following checklist covers the gates described above. It is not a substitute for legal analysis on the specific facts, but it identifies the questions that must be answered before a deal touching Cyprus is signed or funded.

Have all legal entities and beneficial owners been identified, including the full Cyprus ownership chain?
Has the applicable sanctions regime been determined for each party – UN, EU, and any other – and has the payment route been mapped?
Has a list screen been run against each applicable list, with results documented and dated?
Have the EU sectoral restrictions been reviewed for the industry, goods or services involved, not just the named-person list?
Has the payment channel been assessed for correspondent-bank compliance risk before the payment instruction is issued?
Do the transaction documents contain representations, undertakings and termination rights that reflect the regime analysis?
Has the compliance file been assembled with all documents dated?
Is a closing-day re-screen scheduled before any payment is released?

If an earlier filing, structure or enforcement attempt produced a stalled result – a bank refusal, a compliance hold, or a rejection of the counterparty's documentation – a second read can identify the strategic error and the routes still open. Contact info@lockhartyip.com to discuss the position.

For related analysis on the practical framework for sanctions compliance in our practice, see our Sanctions & AML practice page. Counsel on our desk also regularly advise on the pre-contracting review process for transactions with UAE-connected entities; the methodology is addressed at Compliance review before contracting with a UAE entity. Where a bank has raised a source-of-funds query in the context of a cross-border transaction, the approach to that request is described in our matter note on responding to a bank's source-of-funds request.

Related practices

Sanctions & AML – cross-border sanctions compliance, AML file preparation and counterparty screening
Corporate Counsel – contract review and transaction-document structuring across jurisdictions

Frequently asked questions

Which jurisdiction's law applies to sanctions due diligence for a deal touching Cyprus?

No single jurisdiction's law governs the full sanctions analysis. Each party is subject to the sanctions regime of its own jurisdiction: a Cyprus entity is bound by EU sanctions law; a Hong Kong entity is bound by UN Security Council measures as implemented in Hong Kong under the United Nations Sanctions Ordinance. The governing law of the contract does not alter those obligations. In addition, every bank in the payment chain applies the rules of its own regulatory regime, which may be EU, US or UK law regardless of the parties' positions. A complete due diligence exercise addresses each applicable regime separately.

How long does sanctions due diligence for a deal touching Cyprus usually take?

A straightforward transaction between two clean parties with uncomplicated ownership structures can be completed in a matter of days once the party map and documents are available. Deals with complex ownership chains, politically exposed beneficial owners, sectoral-restriction questions, or a need to engage competent-authority authorisation processes take longer – authorisation applications to EU national authorities are measured in weeks to months. The most reliable approach is to begin the review at the same time as commercial due diligence, not after heads of terms are signed. Late starts produce the delays that parties subsequently attribute to sanctions complexity, when the real cause is timing.

Do I need a Hong Kong adviser for sanctions due diligence for a deal touching Cyprus?

Where the Hong Kong party, a Hong Kong payment leg, or a Mainland Chinese ownership chain is part of the transaction, a Hong Kong cross-border perspective is material. The relevant question is not only whether the Cyprus-side rules are satisfied, but whether the Hong Kong party's own compliance position is documented – and whether the deal structure and the transaction documents reflect both regimes. Single-jurisdiction advice covers one side of that question. For deals where the payment route, the governing contract, or the ownership structure engages both Hong Kong and EU rules, advice spanning the full cross-border picture is the more reliable approach.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

How to approach sanctions due diligence for a deal touching Cyprus