Matter note: a cross-border SaaS or data Cyprus

A cross-border SaaS or data agreement that runs through Cyprus and Hong Kong sits at the intersection of European data-governance rules, licensing obligations under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, and contractual enforcement risk that neither party's domestic counsel is typically equipped to map alone. The matter described below illustrates the sequencing decisions that determine whether such an arrangement is commercially sound and regulatorily defensible – or a liability waiting to surface.

The note is drawn from an anonymised matter. No client-identifying information appears. Names, sectors, and precise sums are omitted or generalised. The cross-border interface at the centre of the matter is Hong Kong and Cyprus, with secondary exposure to European data-governance obligations and virtual-asset compliance requirements on the Hong Kong side.

The situation and the constraint

A technology group with its operating entity registered in Cyprus and a Hong Kong-incorporated affiliate had built a SaaS platform that processed subscriber data across both jurisdictions. The Cyprus entity was the contractual counterparty to a substantial roster of enterprise customers across Europe and the Middle East. The Hong Kong entity managed the technical infrastructure, held certain intellectual-property licences, and processed payment flows from the regional subscriber base.

The constraint was structural. The data-processing and payment arrangements had been drafted without reference to the licensing posture of the Hong Kong entity under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. The platform's functionality had evolved over time – it had moved from pure SaaS delivery into a model that processed tokenised payments and subscription credits with characteristics that brought it closer to the perimeter of the virtual-asset regulatory regime in Hong Kong, which commenced on 1 June 2023 under the mandatory licensing rules administered by the Securities and Futures Commission.

At the same time, the Cyprus entity's terms of service and data-processing agreements had been drafted on a European-facing model that did not address the Hong Kong processing node or the legal system that would govern disputes arising from the infrastructure layer. The customer base was asking questions. A prospective enterprise client – a regulated financial-services group in the Middle East – had placed a due-diligence hold on the contract pending satisfactory answers about data jurisdiction, regulator identity, and the enforceability of the service-level terms across the two legal systems.

The internal legal team was small and entirely Cyprus-based. The question put to us was whether the Hong Kong entity's activities fell inside the virtual-asset licensing perimeter, and if so, what the remediation sequence looked like for the data and SaaS contracting arrangements.

The issue and the route chosen

The central issue was a perimeter question: did the tokenised-payment functionality of the Hong Kong entity constitute operating a centralised virtual-asset trading platform, or provide virtual-asset-related services, within the meaning of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance? If so, the entity was operating without a licence in a mandatory regime, and the contracts it had signed – and the data-processing arrangements it had entered into with the Cyprus parent – were potentially unenforceable or subject to regulatory challenge.

The secondary issue was contractual: the data agreement between the Hong Kong and Cyprus entities had been written as an intra-group data-sharing arrangement under Cyprus and European data-governance conventions, but it did not designate a governing law for the infrastructure services, did not address the allocation of liability for regulatory action in Hong Kong, and did not include any mechanism for cross-border enforcement of the service levels that the Cyprus entity had represented to its customers.

The route chosen had two tracks running simultaneously. The first was a licensing-and-perimeter analysis of the Hong Kong entity's activities, conducted with reference to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the Securities and Futures Commission's published guidance on the scope of virtual-asset trading platforms and the definition of regulated activities for the purposes of the Securities and Futures Ordinance. Where a virtual asset meets the definition of a "security" or "futures contract" under the Securities and Futures Ordinance, the SFC's licensing requirements under that statute apply in addition to the virtual-asset-specific regime.

The second track was a contractual remediation exercise: rebuilding the intra-group and customer-facing agreements to address governing law, jurisdiction, data-processing responsibility across the two legal systems, and the allocation of regulatory risk. This required coordinating with locally licensed Hong Kong counsel on the Hong Kong-law elements, and with Cyprus counsel on the European-law data layer.

The sequence of these two tracks was itself a strategic decision. The contractual remediation could not be completed without knowing the outcome of the perimeter analysis – because the scope of the Hong Kong entity's licensed activities, or its decision to restructure them to fall outside the perimeter, would determine what the agreements needed to say about regulatory status, AML obligations, and customer due diligence duties. The licensing analysis had to come first.

For a cross-border assessment of SaaS and data arrangements where the Hong Kong entity's activities may touch the virtual-asset or payment-services perimeter, the sequencing of legal analysis matters as much as the analysis itself. To discuss a preliminary read of your position, write to us at info@lockhartyip.com.

The sequence and the turning point

The licensing-perimeter analysis produced a nuanced answer. The tokenised-payment functionality, as it had been implemented at the time of the instruction, did not, on the facts, constitute operating a centralised virtual-asset trading platform in the sense engaged by the mandatory licensing regime. The credits processed were redeemable only within the platform's own ecosystem and did not represent a claim on a fungible virtual asset tradeable on an open market. They were, on a careful reading of the guidance and the statutory perimeter, closer to a stored-value instrument than to a virtual asset within the statutory definition.

That was the turning point. It meant the Hong Kong entity was not operating unlicensed in a mandatory regime. But it did not mean the entity was outside the regulatory perimeter entirely. The customer due-diligence and transaction-monitoring obligations of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance applied to the Hong Kong entity as a financial institution by virtue of its payment-processing role, regardless of whether it required a virtual-asset trading platform licence. The AML compliance posture – policies, procedures, record-keeping, the travel-rule obligations for virtual-asset transfers – needed to be documented and demonstrable.

This was the issue the due-diligence enquiry from the Middle Eastern financial-services client had identified, without quite naming it. The client's compliance team was asking about data jurisdiction and regulator identity precisely because they needed to satisfy themselves that the platform's payment flows were processed by an entity with a defensible AML posture. They were not asking whether the Hong Kong entity was licensed for virtual-asset trading. They were asking whether it was compliance-sound.

The sequence that followed was:

A documented perimeter analysis, prepared with locally licensed Hong Kong counsel, setting out the basis on which the tokenised-payment activity fell outside the mandatory virtual-asset trading-platform licensing requirement – to be available for disclosure in due diligence without becoming a legal-advice document produced for litigation purposes.
A remediated AML and customer-due-diligence policy for the Hong Kong entity, aligned with the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the FATF travel-rule obligations applicable to virtual-asset transfers where the entity's activity approached but did not cross the statutory definition.
A revised intra-group data-processing and services agreement between the Cyprus parent and the Hong Kong entity, governed by English law as the neutral common-law bridge, with a Hong Kong arbitration clause and a clear allocation of regulatory liability between the two entities.
Revised customer-facing terms for the Cyprus entity's enterprise contracts, incorporating a data-jurisdiction schedule that disclosed the Hong Kong processing node, designated the governing law and dispute-resolution mechanism, and included a regulatory-change provision allowing the Cyprus entity to restructure the service if the Hong Kong perimeter analysis changed.

If an earlier review of your data or SaaS agreements has left the Hong Kong-entity liability position unresolved, or if a due-diligence process has stalled on regulatory-status questions, a second read can identify the open points and the steps still available. Write to us at info@lockhartyip.com.

The qualitative outcome and the transferable lesson

The due-diligence hold was released. The enterprise contract with the Middle Eastern financial-services group was executed on the remediated terms, with the data-jurisdiction schedule and the AML posture documentation forming part of the disclosure package. The internal legal team in Cyprus had a documented framework for assessing future product changes against the Hong Kong licensing perimeter – a point they had not had before.

The transferable lesson is not about the specific perimeter question. It is about the architecture of cross-border SaaS and data agreements more broadly. Groups that operate a Cyprus-facing customer layer and a Hong Kong infrastructure or payment layer tend to treat these as separate legal problems: European data law on one side, Hong Kong licensing and AML on the other. They are not separate. The agreement between the two entities, and the customer-facing terms that the Cyprus entity presents to the market, have to reflect both legal systems simultaneously. When they do not, the gap surfaces in due diligence – usually at the worst possible moment in a commercial cycle.

Three structural points from this matter apply to almost any cross-border SaaS or data arrangement touching Hong Kong and Cyprus.

First, the perimeter question in Hong Kong is not static. The virtual-asset regulatory regime introduced under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, operative from 1 June 2023, was designed with a wide definitional reach. Product evolution – the addition of tokenised rewards, subscription credits, or payment-settlement functionality – can move an entity from outside to inside the perimeter without a deliberate decision to do so. Regular perimeter monitoring is a structural requirement for any platform processing payment flows through a Hong Kong entity.

Second, governing-law and dispute-resolution clauses in intra-group agreements between a Cyprus entity and a Hong Kong entity require deliberate choices. Cyprus law and Hong Kong law are both common-law systems, which can create a false sense of compatibility. The applicable mandatory rules, the data-governance regimes, and the enforcement mechanisms differ significantly. Choosing English law as the governing law of the intra-group agreement, and Hong Kong-seated arbitration as the dispute-resolution mechanism, is a considered structural choice – not a default. It creates a neutral, internationally enforceable framework that neither entity's domestic law alone provides. The governing body for Hong Kong-seated arbitrations, the HKIAC, administers rules effective since 1 June 2024 that support this choice with a well-tested international institutional framework.

Third, the AML obligations of the Hong Kong entity exist independently of the licensing question. A group that concludes its Hong Kong entity does not require a virtual-asset trading platform licence does not thereby conclude that AML compliance obligations are absent. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance imposes obligations on a range of financial institutions and designated non-financial businesses and professions. Where the Hong Kong entity processes payments or handles funds on behalf of customers – even in a SaaS context – the question of whether it falls within the Ordinance's scope is a distinct analysis from the licensing-perimeter question, and must be conducted separately.

In our cross-border practice, we regularly advise technology groups that have built their legal architecture in one jurisdiction and then expanded into another without revisiting the original documents. The Cyprus–Hong Kong interface is one of the more common patterns we see, precisely because Cyprus is a European-law holding and operational centre with good treaty infrastructure, and Hong Kong is the natural gateway for payment and data flows with Greater China and the wider Asia-Pacific region. When the two legal systems are not mapped together from the outset, the gaps are predictable – and addressable, if identified early.

Related to this matter, our Tech & Web3 practice covers the full range of licensing, AML, and structural questions for technology groups with cross-border exposure. For digital-asset fund structures with a Hong Kong-Singapore dimension, see our matter note on a digital asset fund structured through Hong Kong and Singapore. For the Cayman-structured variant, our briefing on a digital asset fund structured through Hong Kong and the Cayman Islands addresses the comparable structural and regulatory considerations.

Related practices

Tech & Web3 – licensing, AML, and structural advice for cross-border technology and digital-asset groups
Sanctions & AML – AML compliance posture, customer due diligence, and travel-rule obligations for Hong Kong-regulated entities

Frequently asked questions

What documents are needed for a cross-border SaaS or data agreement touching Cyprus?

A cross-border SaaS or data agreement between a Cyprus entity and a Hong Kong entity requires, at minimum, an intra-group services or data-processing agreement with a deliberate governing-law clause, a dispute-resolution mechanism, a regulatory-liability allocation, and a data-jurisdiction schedule. Customer-facing terms must reflect the processing node in Hong Kong and address the applicable mandatory rules in each jurisdiction. Where the Hong Kong entity has AML obligations under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, those obligations should be reflected in the agreement's compliance provisions and in any due-diligence disclosure package.

Do I need a Hong Kong adviser for a cross-border SaaS or data agreement touching Cyprus?

Where the agreement involves a Hong Kong-incorporated or Hong Kong-operating entity, a Hong Kong-positioned adviser is necessary to assess the licensing perimeter under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the Securities and Futures Ordinance, the AML obligations of the Hong Kong entity, and the enforceability of the agreement's dispute-resolution clause in Hong Kong. Cyprus-based and European counsel can address the data-governance layer, but they cannot assess the Hong Kong regulatory exposure, which is a distinct analysis. The two need to be coordinated, not conducted separately.

What does the route look like for a cross-border SaaS or data agreement touching Cyprus?

The route begins with a licensing-perimeter analysis of the Hong Kong entity's activities under the governing ordinances, conducted before any contractual remediation. Once the perimeter position is established, the intra-group agreement and customer-facing terms are rebuilt to reflect both legal systems: governing law, jurisdiction, data-processing responsibility, regulatory-change provisions, and AML compliance obligations. Where a due-diligence process is already under way, the perimeter analysis and AML posture documentation form the core of the disclosure package. The sequence – licensing analysis first, contractual remediation second – is itself a strategic decision that determines the defensibility of the resulting documents.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

Matter note: a cross-border SaaS or data agreement touching Cyprus