Matter note: managing payment-channel

Banking-access and payment-channel risk is among the most operationally disruptive exposures a cross-border group can face. A correspondent bank's de-risking (the commercial withdrawal of correspondent banking services, typically driven by a bank's own compliance calculus rather than a regulatory order) can interrupt trade settlement, freeze receivables and delay payroll across an entire operating group within days of a notice. The governing instrument in Hong Kong is the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (the AMLO), which sets the legal basis for customer due diligence and the compliance obligations that institutions assess when deciding whether to maintain a relationship. This matter note describes, in fully anonymised form, a file our desk handled where payment-channel disruption became an acute operational problem – and the steps that resolved it.

The note is organised as follows: the situation and the constraint; the cross-border interface and the legal issue; the sequence and the turning point; and the qualitative outcome with a transferable lesson for similar fact patterns.

The situation: a cross-border operating group and a sudden banking constraint

The principal was an Asia-based operating group with entities in Hong Kong, a mid-size offshore holding structure and operating subsidiaries across two emerging-market jurisdictions. The group ran its treasury function through Hong Kong, using the city's well-developed correspondent-banking infrastructure to settle intercompany payments and collect export receivables from counterparties in multiple currencies.

In the second quarter of 2026, the group's primary clearing bank issued a notice of account review. The review concerned the group's links – through one of its counterparties – to a jurisdiction that had recently attracted enhanced scrutiny from several large correspondent institutions. The bank did not allege any breach of law. It was exercising its own internal risk-appetite policy. That distinction matters: the constraint was commercial and reputational, not statutory – but the practical effect on the group was identical to a regulatory action. Payments stalled. A major export settlement fell into delay. Working-capital pressure built within weeks.

The group's in-house team had already tried the conventional route: direct engagement with the bank's relationship manager, submission of a summary compliance file and an offer to move the affected counterparty transactions to a separate account. None of that moved the position. The bank's risk committee had classified the relationship, and a relationship-manager conversation was not going to reclassify it.

What was the real legal and compliance issue?

The real issue was not whether the group had broken a rule. It had not. Hong Kong implements United Nations sanctions and does not give domestic effect to unilateral measures of other states; the group's counterparty was not on any UN-designated list and the transactions were ordinary commercial flows. The issue was that the group's compliance file did not, in its existing form, allow the bank's own compliance team to reach that conclusion efficiently and with confidence. Correspondent banks – particularly those with significant US-dollar clearing exposure – apply their own layered due-diligence process on top of the minimum statutory requirements. A file that satisfies the AMLO may not satisfy a large correspondent's internal enhanced due diligence (EDD) standard.

The second issue was structural. The group's offshore holding layer was a legitimate and common arrangement, but its corporate records were not current. The beneficial-ownership disclosure to the bank predated a restructuring that had taken place eighteen months earlier. The bank's compliance team had identified a gap between the disclosed ownership chain and the group's current structure on public registries. That gap – innocent in origin – was, from the bank's perspective, a material unexplained discrepancy in the source-of-funds file. It is exactly the kind of gap that triggers an escalated review.

Our cross-border read was this: the group needed to close the disclosure gap, rebuild the compliance file to EDD standard, and then re-engage the bank through the correct internal channel – the bank's compliance function, not the relationship manager. That sequence matters. Going back to the relationship manager before the file is right simply prolongs the stall.

The cross-border interface: Hong Kong, the offshore layer, and the counterparty jurisdiction

The file touched three legal systems simultaneously. In Hong Kong, the AMLO governed the group's own obligations as a customer and defined what adequate due-diligence documentation looks like from the regulated institution's perspective. The offshore holding jurisdiction – a common-law centre used widely above Hong Kong operating companies – had its own economic-substance regime, which required the group to demonstrate that the holding entity was not a pure letterbox. The counterparty jurisdiction raised the enhanced-scrutiny concern that had triggered the review in the first place.

Each leg of the file required different documentation. For the Hong Kong entities, the task was straightforward: updated corporate records, a current beneficial-ownership declaration aligned with the Significant Controllers Register (the SCR, Hong Kong's register of individuals exercising significant control over a company, in force since 1 March 2018), and a clear source-of-funds narrative supported by audited financials and bank statements. For the offshore holding entity, the group needed to produce evidence of substance – board minutes, director engagement records, and the economic-substance return filed with the offshore registry. For the counterparty-jurisdiction exposure, the task was to build an auditable paper trail showing the commercial rationale for each relevant transaction.

The Hong Kong nexus was critical not just because the accounts were held here but because Hong Kong law – and the AMLO in particular – provides the baseline that a sophisticated correspondent bank will use to assess whether the customer's file is credible. A file built to AMLO standard, supplemented to EDD level, carries credibility with international correspondent banks in a way that a file built to the standard of a smaller or less-established jurisdiction does not. That is a structural advantage of using Hong Kong as a treasury hub, but only if the file is actually built correctly.

The sequence and the turning point

The work fell into four stages. Each stage was contingent on the one before it; the sequence could not be collapsed or reordered without risk of a second adverse outcome.

Stage one: the compliance audit. We reviewed the group's existing documentation across all three jurisdictions. The gaps were: the outdated beneficial-ownership disclosure; missing substance records for the offshore entity; and a counterparty file that contained contract summaries but no payment-flow narrative explaining why funds moved through the specific correspondent route they did.

Stage two: rebuilding the file. The group updated its SCR disclosures and reconciled the ownership chain documentation. The offshore entity's substance records were compiled from internal records and the relevant registry filings. A source-of-funds memorandum was prepared for the counterparty flows, tracing the commercial origin of each material payment, linking it to the underlying contract and the group's audited accounts, and addressing the enhanced-scrutiny concern directly rather than hoping the bank's team would reach a benign inference on its own.

The turning point came during stage two. As we worked through the payment-flow narrative, we identified a set of transactions that had been structured – by the group's treasury team, in good faith, for cash-management efficiency reasons – in a way that created an unnecessary appearance of layering. The transactions were legitimate, but the pattern looked, to an outside reviewer, like the kind of payment routing that AML typologies flag. We recommended restructuring those flows going forward and prepared a clear explanatory note for the historical transactions. That proactive disclosure – acknowledging the pattern and explaining it on the record – was the single most important step in the process. Banks are far more comfortable with a client who identifies and explains an issue than with one who does not appear to have seen it.

Stage three: re-engaging the bank. With a complete file in hand, we prepared a structured submission addressed to the bank's compliance function rather than to the relationship team. The submission followed the format that EDD processes typically expect: a narrative overview, a beneficial-ownership diagram with supporting documentation, the source-of-funds analysis, the counterparty rationale, and a brief statement of the group's compliance governance (internal AML policy, training records, and the point of contact within the group for compliance queries). We coordinated the delivery with locally licensed Hong Kong firms who handled the local-law aspects of the submission.

Stage four: monitoring and fallback planning. While the bank's review was ongoing, we mapped a fallback structure using an alternative payment channel that did not depend on the same correspondent route. This was not presented to the bank – doing so would have signalled that the group was prepared to move the relationship regardless of outcome, which was not the message we wanted to send during an open review. It was internal contingency planning. As it happened, the fallback was not needed. But having it ready changed the group's posture in the engagement: they were managing a process, not waiting for a decision.

If you are at the stage where a bank review has been opened and the initial submission has not produced movement, a second read of the file is warranted. In our cross-border practice, we regularly identify the specific documentation gap or framing issue that is holding a bank's decision. Email us at info@lockhartyip.com to discuss your position.

The qualitative outcome and the transferable lesson

The bank's review concluded without adverse action. The account relationship continued, and the stalled payment settlements were processed. The group made a set of structural adjustments to its compliance governance – a formal AML policy, a documented counterparty-assessment process, and a quarterly SCR review – that placed it in a substantially better position for any future bank review or regulatory inquiry.

The transferable lesson is this: payment-channel disruption caused by a bank's internal risk-appetite decision is a compliance problem, not a legal one in the first instance. Trying to resolve it by legal argument – or by asserting that no law has been broken – rarely works. The bank knows no law has been broken; that is not its concern. Its concern is whether it can demonstrate, to its own regulators and correspondent partners, that it has conducted adequate due diligence on your group. The task is to make that demonstration easy for the bank, not to win an argument about legal compliance.

A second lesson: the offshore holding layer is often where the compliance file breaks down, not the operating entities. Groups that maintain meticulous records at the Hong Kong or Singapore operating level frequently have sparse or stale records at the BVI or Cayman holding layer. Correspondent banks see the whole group. They apply their EDD standard to the group as presented, not just to the entities they hold accounts for. Keeping substance and beneficial-ownership records current across the entire structure is not administrative overhead; it is the foundation of banking-access resilience.

A third lesson concerns the disclosure instinct. The groups that resolve payment-channel issues quickly are, in our experience, the ones who are prepared to put their complete position on the record – including the parts that look complicated – and explain them clearly. The groups that struggle are those who submit minimal documentation and hope the bank will not ask further questions. In a world of enhanced due diligence and correspondent-bank pressure, that approach reliably fails.

For related guidance on building a source-of-funds file that meets the standard expected by international correspondent banks – particularly where a Cyprus or other European counterparty is involved – see our analysis of AML source-of-funds files for Cyprus counterparties. For the due-diligence dimension in transactions where a Cyprus structure or similar offshore element is present, see our sanctions due-diligence analysis for deals touching Cyprus.

For the full scope of our work across banking access, counterparty compliance and cross-border AML files, visit our Sanctions & AML practice page.

Related practices

Holding Structures – structuring offshore and Hong Kong holding layers for banking and compliance resilience
Corporate Counsel – ongoing governance, SCR compliance and entity-management across jurisdictions

Frequently asked questions

What documents are needed for managing payment-channel and banking-access risk?

The core file typically includes: a current beneficial-ownership declaration aligned with Hong Kong's Significant Controllers Register requirements; corporate records for all group entities including any offshore holding companies; a source-of-funds narrative supported by audited financials; counterparty due-diligence documentation; and evidence of economic substance for offshore entities. Where a specific counterparty or jurisdiction has attracted enhanced scrutiny, additional payment-flow documentation tracing the commercial rationale for each material transaction will ordinarily be required. The precise scope depends on the bank's internal EDD standard and the specific risk flags in play.

What is the first step in managing payment-channel and banking-access risk?

The first step is a compliance audit of the existing file: identifying the gaps between what the group has on record and what a correspondent bank's enhanced-due-diligence process will require. Engaging the bank before that audit is complete – and before the gaps are closed – typically prolongs the stall rather than resolving it. Once the file is rebuilt to the appropriate standard, re-engagement should be directed to the bank's compliance function rather than to the relationship team, with a structured submission rather than an informal conversation.

How long does managing payment-channel and banking-access risk usually take?

The timeline depends on the number of entities in the structure, the complexity of the counterparty relationships and how current the group's existing records are. A single-entity file with up-to-date records can be prepared and submitted within a few weeks. A multi-jurisdiction group with stale records across an offshore holding layer may require two to three months to compile the full file and obtain the necessary supporting documentation from offshore registries and auditors. Bank-side review timelines vary and are outside the group's control; having a well-constructed file is the primary factor within the group's control.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

Matter note: managing payment-channel and banking-access risk