Matter note: a cross-border SaaS or data Cayman

A technology group structured across multiple jurisdictions can spend months finalising a SaaS or data-sharing arrangement only to discover, late in the process, that the agreement sits across a legal and regulatory gap none of the parties anticipated. The counterparty is a Cayman Islands entity. The data flows through Hong Kong. The licensing and compliance obligations span both – and they do not map neatly onto each other.

A cross-border SaaS or data agreement touching the Cayman Islands typically requires a sequenced approach that addresses the governing law and dispute resolution choice, the data-processing and licensing obligations of each entity in the chain, and the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (the Hong Kong AML statute that governs technology businesses touching virtual assets or regulated financial services). Since the virtual-asset trading platform licensing regime commenced on 1 June 2023, the question of whether any part of the SaaS service touches a licensable activity has become the threshold question for every such arrangement in the Hong Kong–Cayman corridor.

This note describes how a matter of that kind presented, the structural issues it raised, and the route our desk took. All identifying detail has been removed.

The situation: a Cayman issuer, a Hong Kong service layer, and an unresolved perimeter

The client was a technology services provider incorporated in Hong Kong, offering a SaaS platform to financial-services and asset-management groups operating across Asia and the offshore centres. A prospective counterparty – a fund administration entity registered in the Cayman Islands – wished to use the platform for data aggregation and reporting. The commercial terms were largely agreed. The problem was the structure.

The Hong Kong entity had not analysed whether its platform, when used by a Cayman-regulated financial services entity, brought any part of its own activity within the perimeter of the licensing regime administered by the Securities and Futures Commission (SFC) or, separately, the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. The Cayman counterparty had its own regulatory obligations under the regime administered by the Cayman Islands Monetary Authority (CIMA) and had not considered how those obligations extended to the data and systems it was contracting to use.

Neither party had flagged the gap. Their respective external advisers had focused on the commercial terms. No one had mapped the regulatory perimeter of the agreement itself.

Our desk sees this pattern regularly. In cross-border technology arrangements involving Hong Kong and the Cayman Islands, the governing-law and dispute-resolution choice tends to be settled early, while the regulatory-perimeter question is deferred – or missed entirely. The deferral is the risk.

The issue: when does a SaaS platform touch a licensable activity?

The licensing threshold in Hong Kong for virtual-asset and financial-services technology is not defined by the label the parties apply to the agreement. It is defined by the function the platform performs and the nature of the activity it enables. A SaaS product that aggregates portfolio data for a fund administrator may, depending on its design, come within the perimeter of a licensing requirement, trigger customer due-diligence obligations under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, or require specific contractual provisions about data handling that the parties had not drafted.

The Securities and Futures Ordinance applies where a virtual asset is a "security" or "futures contract" within its definition. If any part of the SaaS service involves the handling, transmission, or reporting of data relating to such assets, the licensing overlay of the SFC becomes relevant. Separately, the mandatory licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance for centralised virtual-asset trading platforms – commenced 1 June 2023 – had created a new question that had not existed when earlier iterations of similar agreements had been drafted: was the SaaS provider, by enabling data flows relating to virtual-asset positions, providing a service that required its own licensing review?

The answer in this matter turned on a careful reading of what the platform actually did. That reading had not been done.

The route: sequencing the analysis before the agreement

The first step was to stop the drafting process. An agreement that locks in a structure without resolving the regulatory-perimeter question does not just expose the parties to enforcement risk – it creates contractual obligations that may be impossible to perform lawfully without a structural change. Signing first and analysing later is the single most common error in cross-border technology agreements of this kind.

Our instruction was to work through the analysis in a defined sequence. First: identify the regulated activities, if any, performed by or through the platform in Hong Kong. Second: assess whether the Cayman entity's use of the platform, and the data flows it generated, created any obligation on the Hong Kong entity under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance or the SFC's applicable guidelines. Third: advise on the contractual provisions the agreement needed to include to reflect the actual regulatory position rather than the parties' commercial preference.

The analysis produced a clear dividing line. The platform's core data-aggregation function did not, on the facts as described, constitute a licensable activity under either the Securities and Futures Ordinance or the virtual-asset trading platform regime. However, a specific reporting module – which transmitted certain position data for assets that fell within the definition of a "security" under Hong Kong law – was a different question. That module required specific carve-out provisions in the agreement and a defined data-handling protocol to ensure the Hong Kong entity was not inadvertently performing a regulated function without the appropriate licence or notification.

The Cayman dimension added a separate layer. CIMA's oversight of the counterparty extended to the systems and third-party services the counterparty used in its regulated functions. The agreement therefore needed to reflect CIMA's data-sovereignty and audit-access expectations, not just the Hong Kong regulatory position. The two sets of requirements did not conflict, but they did need to be addressed in the same document.

The sequence above describes the standard position. Your matter turns on the documents, the jurisdictions actually engaged, and the order of steps – which is where the route is won or lost. For a preliminary read on your cross-border technology agreement and the applicable regulatory perimeter, email info@lockhartyip.com.

The turning point: the data-flow map

The analytical turning point in the matter was the production of a data-flow map that traced each category of data processed by the platform, identified the Hong Kong or offshore entity that processed it at each step, and flagged the regulatory hook – if any – that applied at that step. This is not a document that commercial negotiators typically prepare. It is a document that a cross-border counsel with a technology and regulatory practice will insist upon before any drafting commences.

The map identified a processing step that neither party had noticed: a data transformation function performed by the Hong Kong entity converted raw position data from one format to another before transmission to the Cayman counterparty. That function, in the context of the assets involved, was the step that created the licensing question. Once it was visible, it was manageable. The solution was a structural one – the transformation function was assigned to a separate entity outside Hong Kong, and the agreement was drafted to reflect the revised flow.

What would have happened without the map? The agreement would have been executed in a form that exposed the Hong Kong entity to a compliance question it could not answer cleanly. The Cayman counterparty would have had an agreement that did not satisfy CIMA's audit-access expectations. Both parties would have proceeded on the assumption that their external advisers had covered the regulatory ground. Neither assumption would have been correct.

This is a pattern. Cross-border technology agreements fail at the regulatory layer, not the commercial layer. The commercial terms are usually fine. The regulatory analysis is usually absent.

If an earlier draft, structure or filing has produced a stalled or adverse result, a second read can identify the gap and the routes still open. Write to info@lockhartyip.com to discuss the position.

The outcome and the transferable lesson

The matter concluded with an executed agreement that reflected the revised data-flow structure, included appropriate provisions for CIMA audit access and data-handling obligations under Cayman regulatory requirements, and contained a clear carve-out for the reporting module that had raised the Hong Kong licensing question. The Hong Kong entity had a documented regulatory analysis supporting its position that the platform, as restructured, did not require a licence. The Cayman counterparty had an agreement it could present to its regulator without qualification.

Neither outcome was remarkable in isolation. Together, they represented a result that the parties could not have reached without a structured cross-border analysis conducted before the agreement was finalised.

The transferable lesson is straightforward. In any SaaS or data agreement that touches Hong Kong and the Cayman Islands, three questions need answers before the drafting starts.

First: which entity in the chain performs the regulated function, if any, and in which jurisdiction? The answer determines which licensing regime applies and which regulator has oversight. In Hong Kong, that question is answered by reference to the Securities and Futures Ordinance, the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, and – for virtual-asset activity – the SFC's licensing regime for centralised platforms. In the Cayman Islands, it is answered by reference to the CIMA-administered regulatory perimeter for the counterparty's own licensed activities.

Second: does the data flow create an obligation independent of the commercial function the parties have agreed? Data that moves across the Hong Kong–Cayman border in the context of a financial-services or technology arrangement may trigger AML, customer due-diligence, or audit-access obligations that the parties have not addressed in the commercial terms.

Third: does the governing-law and dispute-resolution choice reflect the actual regulatory environment, or does it reflect the path of least resistance? A Cayman-law agreement with a Cayman arbitration clause is sometimes appropriate. It is not appropriate when the primary performance obligations sit in Hong Kong, the regulated activity is performed by a Hong Kong entity, and the enforcement route for a breach will run through the Hong Kong courts or the Hong Kong arbitration institutions.

For cross-border technology agreements of this kind, the Arbitration Ordinance (Cap. 609) – Hong Kong's governing statute for arbitration, modelled on the UNCITRAL Model Law – provides a well-tested and internationally recognised framework for dispute resolution. The HKIAC Administered Arbitration Rules, including the 2024 Rules effective 1 June 2024, provide the procedural architecture. Hong Kong's status as a New York Convention seat means that an award obtained in Hong Kong arbitration can be enforced in the principal offshore and onshore jurisdictions where the parties operate. That combination is often more relevant to a cross-border SaaS dispute than a purely Cayman-law and Cayman-forum approach.

Our Tech & Web3 practice covers the full range of licensing, AML, and contract-structure questions that arise in cross-border technology agreements of this kind. For related matter notes on cross-border technology agreements in other jurisdictions, see our matter note on a SaaS or data agreement touching Cyprus. Practitioners advising clients on virtual-asset licensing in Hong Kong may also find our guide to virtual-asset trading platform licensing in Hong Kong a useful reference.

Related practices

Tech & Web3 – licensing, AML and contract structure for cross-border technology arrangements
Sanctions & AML – compliance review and source-of-funds analysis for regulated technology businesses

Frequently asked questions

What does the route look like for a cross-border SaaS or data agreement touching the Cayman Islands?

The route begins with a regulatory-perimeter analysis before any drafting is finalised. That means identifying which entity in the chain performs a regulated function, whether the data flows trigger obligations under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance or the SFC's licensing regime in Hong Kong, and whether the Cayman counterparty's own regulatory obligations extend to the systems and data it contracts to use. Governing-law and dispute-resolution choices are then made to reflect the actual regulatory environment, not simply the commercial preference of the parties. A well-structured agreement also addresses audit-access and data-handling requirements specific to the Cayman institutional context.

What documents are needed for a cross-border SaaS or data agreement touching the Cayman Islands?

The core document is the agreement itself, drafted to reflect the revised data-flow structure and the regulatory position of each entity. Supporting that agreement will typically be a data-flow map identifying the processing steps and the regulatory hook – if any – at each step, a regulatory analysis addressing the Hong Kong perimeter under the applicable ordinances, and a set of data-handling provisions responding to the Cayman counterparty's regulatory obligations. Where the arrangement touches virtual assets or financial-services data, a documented position on the licensing question is advisable before execution, even where the conclusion is that no licence is required.

How long does a cross-border SaaS or data agreement touching the Cayman Islands usually take?

The timeline depends primarily on the complexity of the data flows and the number of regulatory hooks identified during the perimeter analysis. A matter with a straightforward data-flow structure and a clearly non-licensed function can be worked through and documented relatively quickly once the analysis is instructed. A matter that requires a structural change – such as the reassignment of a data-processing function to a different entity – takes longer, because the revised structure needs to be reflected in the agreement and confirmed against the regulatory position before execution. Parties should not assume that an existing commercial timetable can accommodate the regulatory analysis without dedicated resource and proper sequencing.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

Matter note: a cross-border SaaS or data agreement touching the Cayman Islands