Matter note: sanctions due diligence for a deal Cyprus

Cyprus sits at an intersection that compliance teams find uncomfortable. It is a European Union member state, subject to EU autonomous sanctions, and a jurisdiction whose banking sector has historically served as a conduit for capital moving between the CIS region and Western Europe. For a cross-border deal with a Cyprus-incorporated entity or a Cyprus-domiciled payment channel, the sanctions question is never simply whether a listed person is involved. The question is whether the corporate structure, the payment route, and the underlying beneficial ownership can each be documented to a standard that banks and counterparties will accept.

Sanctions due diligence for a deal touching Cyprus requires a multi-layered review that runs from beneficial ownership through to the payment channel, governed by the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Hong Kong's primary AML instrument) and aligned with the United Nations sanctions framework that Hong Kong implements. Where a transaction involves a Cyprus entity, the EU autonomous sanctions perimeter must also be mapped, not as a matter of Hong Kong law, but because counterparty banks operating under EU or EU-equivalent rules will apply it to the payment leg.

This note sets out an anonymised matter from our cross-border practice. It describes the situation, the issue that emerged, the sequence we followed, and the lesson that transfers to similar deals.

The situation and the constraint

A mid-market acquisition was being structured through Hong Kong. The target group had an operating subsidiary in a manufacturing jurisdiction in Eastern Europe and a holding entity incorporated in Cyprus. The buyer was an Asian principal with no direct nexus to any sanctions list.

The deal was commercially straightforward. The legal structure was not. The Cyprus entity had been incorporated a number of years before the deal, originally for the purpose of holding intellectual property and receiving intercompany royalties. Its share register showed two corporate shareholders, neither of which was the ultimate beneficial owner. The corporate chain led, through two intermediate layers, to individuals domiciled in a jurisdiction subject to heightened scrutiny under multiple sanctions regimes.

The constraint was practical. The transaction required a payment leg to be routed through a correspondent banking network. Correspondent banks – particularly those operating in the EU or under EU-equivalent rules – were declining to process transfers connected to Cypriot entities where the beneficial ownership chain ran to that region without a clean compliance file. The deal had stalled at the banking stage.

We were engaged after the first attempt to open the payment channel had produced a request for additional documentation that the client's existing advisers had been unable to satisfy.

The issue: what was actually being asked

The bank's request was superficially administrative. It asked for beneficial ownership documentation, source-of-funds confirmation, and a sanctions screen. What it was actually asking was whether the transaction could be documented to a standard consistent with the bank's own obligations under the EU's Anti-Money Laundering directives and, separately, the EU autonomous sanctions regulations in force at the time of the transfer.

Hong Kong implements United Nations sanctions. It does not give domestic effect to unilateral measures of other states. That is the correct legal position in Hong Kong, and it is the position our desk applies. But a deal does not exist only in Hong Kong. The payment leg existed in a correspondent banking network that operated under EU rules. The compliance question was therefore not whether Hong Kong law required the buyer to comply with EU autonomous sanctions. It did not. The question was whether the transaction could be structured and documented so that the banks involved could process it consistently with their own regulatory obligations.

That distinction – between the Hong Kong legal position and the practical requirements of the payment infrastructure – is the point that foreign principals most commonly misread when they arrive at our desk. The law of the forum governs the parties. The rules of the correspondent banking network govern the payment.

The route chosen: compliance architecture, not avoidance

The route we took was a structured compliance review, designed to produce a file that the bank could accept. There was no question of circumvention, restructuring to obscure ownership, or use of a substitute payment channel to sidestep the bank's obligations. The objective was to document the transaction honestly and completely, to the standard required.

We identified four workstreams. First, a full beneficial ownership trace for the Cyprus holding entity, running from the share register to the natural persons at the end of the chain and producing a documented ownership map. Second, a source-of-funds review for the consideration payable to those ultimate owners, tracing the funds to their origin and producing a timeline with supporting documentation. Third, a sanctions screen against UN consolidated lists and, for the purposes of the correspondent bank's own review, the EU autonomous sanctions lists in force at the date of the transaction. Fourth, a review of the Cyprus entity's own corporate compliance record – its Significant Beneficial Owners register entry (a Cyprus registry requirement broadly comparable to Hong Kong's Significant Controllers Register), its tax identification, and its audited accounts.

The turning point came in the third workstream. One of the intermediate corporate shareholders in the chain – not an ultimate beneficial owner and not a person on any UN list – appeared on an EU autonomous sanctions list that had been updated in the months preceding the deal. The entity was not the buyer. It was not the seller. It held a minority economic interest through one of the intermediate layers. But its appearance in the ownership chain was the reason the bank had paused.

The sequence and the turning point

Once the intermediate entity was identified, the question became how to document the transaction in a way that was accurate, compliant with applicable Hong Kong law, and acceptable to the correspondent bank. The answer required a legal opinion on the position under Hong Kong law, a factual description of the intermediate entity's role and economic interest, and a written assessment of whether the transaction as structured would cause the bank to breach any of its own regulatory obligations.

We prepared the legal opinion on the Hong Kong position. We coordinated with allied counsel admitted in Cyprus to produce a parallel opinion on the position under Cyprus company law and the EU regulatory perimeter. The two opinions were structured to address the bank's specific questions, not as general documents.

The factual description required care. The intermediate entity held an economic interest through a chain of nominees. Its interest was minority and passive – it had no management rights, no board representation, and no ability to direct the Cyprus entity's operations or the transaction. Documenting that position accurately, with supporting corporate records, was the step that moved the compliance file from stalled to approvable.

The bank received the file. Its compliance team reviewed the UN list position, the EU autonomous sanctions position, and the structure of the intermediate entity's interest. The payment was processed. The acquisition completed.

The sequence, in order: beneficial ownership trace; source-of-funds review; sanctions screen (UN and, for banking purposes, EU); identification of the intermediate entity issue; legal opinions on both applicable jurisdictions; factual documentation of the intermediate entity's role; submission to the bank's compliance team; processing.

The lesson from the sequence is that the turning point was not a legal argument. It was documentation. The bank did not require the intermediate entity to be removed from the structure. It required a clear, accurate picture of that entity's position and an assessment that processing the transaction would not place the bank in breach of its own obligations. That is the standard a compliance file must reach.

The sequence above describes the standard position in matters of this kind. Your matter turns on the documents, the jurisdictions actually engaged, and the order of steps – which is where the route is won or lost. To discuss how the compliance architecture for a deal touching Cyprus or a comparable jurisdiction applies to your cross-border position, contact info@lockhartyip.com.

The transferable lesson: banking access as the real compliance question

Deals involving Cyprus-domiciled entities present a compliance profile that is specific and manageable, but only if the beneficial ownership question is addressed before the payment leg is opened. The sequence matters. Starting the banking process without a clean ownership file is the single most common error we see in this type of transaction.

Why does that error recur? Because the buyer and its advisers focus on the legal completion steps – the share transfer, the notarised documents, the corporate registry filings – and treat the payment as a mechanics question. It is not. For a transaction with a Cyprus entity whose ownership chain runs to a high-scrutiny region, the payment channel is a compliance question that must be sequenced before the legal completion steps are finalised.

Three features of the Cyprus position make this particularly acute. First, Cyprus operates within the EU autonomous sanctions perimeter. A transaction that is clean under UN sanctions may still encounter difficulties in a correspondent banking network that applies EU sanctions, depending on the ownership chain. Second, Cyprus has a historical corporate register that includes entities whose beneficial ownership records were not updated when the EU sanctions perimeter changed. The entity may be clean; the documentation may not be. Third, the Anti-Money Laundering and Counter-Terrorist Financing Ordinance in Hong Kong imposes customer due diligence obligations on Hong Kong-regulated parties to the transaction. Those obligations run in parallel with the bank's own requirements, not as a substitute for them.

For a deal where the buyer is in Asia and the banking infrastructure runs through EU correspondent networks, the compliance architecture must be designed to satisfy both. In our cross-border practice, we regularly advise on the sequencing and documentation for transactions of this kind. The standard output is a compliance file that addresses both the Hong Kong regulatory position and the practical requirements of the payment infrastructure the transaction will use.

A second feature of this matter that transfers broadly: the role of allied counsel. The legal opinions that unlocked the payment were a Hong Kong opinion and a Cyprus opinion, prepared in coordination. Neither opinion alone would have addressed the bank's questions. The bank needed to understand the position in both jurisdictions, because its own compliance analysis had to cover both. Coordination between the Hong Kong desk and Cyprus-admitted counsel was not optional; it was the mechanism by which the file was completed.

If an earlier filing, structure or enforcement attempt produced an adverse or stalled result in a transaction of this kind, a second read can identify the strategic error and the routes still open. For a preliminary read on your matter and the compliance route, email info@lockhartyip.com.

For a broader read on the AML and source-of-funds considerations that arise when a counterparty or payment channel is domiciled in a high-scrutiny jurisdiction, see our analysis of AML source-of-funds files for UAE counterparties. Comparable issues arise in CIS-connected transactions; our matter note on compliance review before contracting with a CIS entity covers the pre-contract sequencing in detail. For the full scope of our sanctions and AML practice, see Sanctions & AML at Lockhart & Yip.

Related practices

Sanctions & AML – compliance review, sanctions screening, AML documentation for cross-border transactions
Holding Structures – beneficial ownership analysis and structure review for offshore and EU-domiciled entities

Frequently asked questions

How long does sanctions due diligence for a deal touching Cyprus usually take?

The duration depends on the depth of the beneficial ownership chain and the availability of corporate records. A transaction where the Cyprus entity has current, well-documented beneficial ownership records and a straightforward source-of-funds position can be reviewed within two to three weeks. Where the chain is multi-layered or records require retrieval from multiple jurisdictions, the process typically runs longer. The banking compliance review adds further time that is outside the parties' direct control. Sequencing the compliance workstream before the legal completion steps are finalised avoids deal delay at the payment stage, which is where stalls most commonly occur.

What are the main risks in sanctions due diligence for a deal touching Cyprus?

The principal risks are three. First, an intermediate or ultimate beneficial owner who appears on a UN list or an EU autonomous sanctions list, even where that person holds a minority or passive interest. Second, a beneficial ownership record that has not been updated to reflect changes in the EU sanctions perimeter, making an otherwise clean entity appear undocumented. Third, a source-of-funds trail that cannot be documented to the standard a correspondent bank requires, even where no sanctions issue exists. All three risks are manageable through a properly sequenced compliance review. None is manageable if the payment leg is opened before the review is complete.

What does the route look like for sanctions due diligence for a deal touching Cyprus?

The standard route is a four-stage process: beneficial ownership trace; source-of-funds review; sanctions screening against applicable lists; and legal opinion on the position in each relevant jurisdiction. For a Hong Kong buyer using a EU correspondent banking network, the opinions must address both the Hong Kong position under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the position in the payment jurisdiction. The output is a compliance file structured to answer the specific questions a correspondent bank's compliance team will ask, not a general legal memorandum. Parties should verify the current UN and EU list positions immediately before the payment leg is opened, as both lists are updated on a continuing basis.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

Matter note: sanctions due diligence for a deal touching Cyprus