Blog

What is a legal opinion in banking onboarding?

Key requirements for a Legal Opinion for a bank

Legal Opinion on KYC Due Diligence

Why a bank refuses onboarding due to a weak Legal Opinion

Onboarding refusal due to a weak Legal Opinion

Bank refusal due to a Legal Opinion: examples from the EU and Asia

Consequences of a poor Legal Opinion for business

Risks of a weak legal opinion for AML in crypto

How a Weak Legal Opinion Kills KYC

Weak Legal Opinion in Bank Due Diligence

Legal Opinion on compliance by region: EU, Asia, Africa

How to avoid being refused onboarding because of a legal opinion

How to assess a Legal Opinion for KYC

• Author expertise: banking/financial law, practical experience with onboarding (not “general practice”).
• Clear structure and scope: exactly what was checked, on which sources, and what assumptions and limitations apply.
• UBO and control: disclosure of the ownership chain, beneficial owners, controllers, governance logic.
• Source of funds / business logic: linkage of funds to contracts and the business model, without gaps or contradictions.
• Taxes and obligations: basic analysis of tax risks, PE/substance, and residency.
• Case law/regulatory practice: relevant references/approaches (at least at the level of applicable standards and cases).
• Language of conclusions: concrete findings, not vague “to our knowledge” statements where facts are required.
• Red flags: unsupported conclusions, lack of verifiable sources, ignoring cross-border/sanctions issues, contradictions with KYC documents and the business plan.

Optimizing the legal opinion for bank onboarding

• Pre-audit: reconcile structure, UBO, products, geographies and payment scenarios with the bank’s expectations.
• Registry queries: up-to-date extracts/requests to company registries, confirmations of authority, status, directors/charges.
• UBO-disclosure: ownership chain, documents for each UBO, rationale on control, where necessary — apostille/notarization.
• Risk memo for the bank: a short annex with key conclusions, risks and mitigations (what has been done and why it is sufficient).
• Integration with AML: references to the AML policy, EDD procedures, monitoring, roles (AML Officer), audit trail.
• Consistency check: elimination of contradictions between the Legal Opinion and other documents (a common reason for “pause/decline”).

Cases: legal opinion and bank refusals on compliance

How to invest in a legal opinion for your business

1. Conduct an audit of the current Legal Opinion using a quality checklist: identify weak points in the rigor of wording.
2. Commission regional specialists (EU/Asia/Africa) with a focus on AML compliance and Legal Opinion for Asia compliance.
3. Integrate into corporate governance for long-term business resilience, including historical screening.
4. Monitor metrics: bank onboarding time <30 days, ROI +25% from quality Legal Opinion compliance.

Conclusion

According to the European Commission’s estimates, just through InvestEU and related instruments more than €372 billion of private and public investments in the EU are planned to be mobilized by 2027 – a substantial portion of this volume goes through licensed investment firms and funds. For an entrepreneur from Europe, Asia or the CIS this is no longer just a figure from a report, but a question: which investment company to build in the EU and in which country so as not to drown in AML, sanctions and ESG requirements, and to obtain a sustainable ROI and access to EU financing.

At COREDO I regularly see the same request: “We want to enter Europe, but we don’t want to experiment with our own license and bank account. Where is the model actually viable in 2025 and what have the new AML and ESG rules changed?”

Regulators are strengthening requirements for beneficiaries in the EU in 2025, a supranational AMLA is being launched, CSRD and CS3D are coming into force, and sanctions filters are being tightened. At the same time the EU is simultaneously promoting the Green Industrial Plan, the Innovation Fund, the Digital Europe programme and STEP – all this creates a unique window of opportunity for those ready to build a structure properly, not “on the bare minimum”.

In this article I will analyze in which countries the EU investment company model is most viable in 2025, how the new AML requirements for companies in the EU and the ESG regime affect registration and scaling, and what steps it makes sense to take now. If you read to the end, you will not get an abstract “idea of Europe”, but an actionable plan: where to register a company, how to go through Licensing and how to plug into EU funding flows for businesses without unnecessary risks.

Top EU Jurisdictions for Investments

When I evaluate viable EU jurisdictions for investment, I look at more than just the tax rate. What matters is a combination: the regulatory regime for investment firms, banks’ attitude toward non-residents, licensing infrastructure (MiFID II, crypto/payment/forex licenses), access to grants and the stability of the law.

For the purposes of the article I focus on jurisdictions that the COREDO team regularly works with on investment company structures and financial licenses: Ireland, Cyprus, Malta, Portugal (including Madeira), Hungary, Spain, Sweden.

2025 Country Ranking by Profitability

In 2025 four criteria came to the forefront that I always discuss with clients before starting company registration in the EU:

• Minimum EU share capital and the real requirements of regulators/banks (not just the letter of the law).
• Tax burden and the possibility of transparent structuring (substance, participation in holding structures).
• Reliability and “predictability” of the EU banking system for business.
• Access to financing and EU programs: InvestEU, the STEP investment platform, the EU Innovation Fund, the Digital Europe Programme.

Summary table for key jurisdictions (figures averaged from European Commission data, national regulators and corporate registry statistics for 2024–2025):

In COREDO’s practice, Ireland, Cyprus and Malta consistently rank among the top for investment firms, while Sweden and Spain are increasingly chosen for ESG investments in Europe and the green agenda.

Why Ireland often ranks No.1 for “investment suitability 2025” for tech and structurally complex projects:

• Favorable regime for funds and investment companies under MiFID II.
• Effectively “default” access to the US and UK through structures that banks and investors have long understood.
• Active participation in digitization programs and initiatives — the Digital Europe Programme and STEP: for COREDO clients this has already brought grants and favorable lending within AI and fintech projects.

The COREDO team typically prepares a comparative matrix for the client (taxes, licensing, substance, ESG requirements) and, tailored to your model (funds, broker, family office, fintech platform), shows how ROI will change across countries taking into account the new transformational rules of investment suitability 2025.

AML requirements for investment firms in the EU

From 2024–2025 the EU is moving to a new level of harmonized requirements: a Single AML/CFT Regulation, an updated AMLD Directive, and the launch of the supranational regulator AMLA. For an investment company this is not background noise but a direct influence on access to licensing, banks and investors.

Beneficial owners in the EU 2025: control criteria and AMLA

• Controlling influence via trusts and agreements: where a person does not own shares directly but, through a trust or shareholder agreements, effectively determines the company’s course.
• Rights to appoint/remove directors, veto rights over strategic decisions, options and convertible instruments.
• Structures where profit distribution and control diverge.

The launch of the supranational regulator AMLA in the EU means that supervision for large and cross-border investment groups will be coordinated not only at the national level. This increases the importance of early pre-incorporation analysis of beneficial owners, especially if you plan branches/subsidiaries in multiple EU countries.

At COREDO we usually start a project not with the company form, but with a map of beneficial ownership and control:

1. We analyze the ownership structure, trust agreements, and options.
2. We check which persons may be considered UBOs under the substantive control criteria in the EU in 2025.
3. We model how the structure will be perceived by AMLA, national FIUs and banks.
4. We develop internal procedures: internal control of beneficiary reporting, processes for updating data and detecting changes.

For the client this reduces risk: a registrar, bank or regulator will spot “uncoordinated” levels of control in the structure and suspend company registration in the EU or the issuance of a license.

AML compliance for financial licenses and refusal risks

When it comes to financial licenses — crypto, payments, EU forex — AML compliance ceases to be “a field for compromises”. Banking and regulatory cases from 2023–2025 show: the main risk is not even fines, but bank rejection over sources of funds and termination of relationships.

Our experience at COREDO has shown several key lessons:

• When licensing in Cyprus, Malta or Ireland, pre-incorporation analysis of beneficial owners and an embedded KYC/transaction monitoring model significantly increase the chances not only to obtain a license, but also to open an account with a major EU bank.
• Banks expect that an investment company will have not only an AML/KYC policy, but also real tools for digital tagging of transactions and client data: built-in EU sanctions screening, monitoring of the geography of sources of funds, PEP filters.
• Internal reports on beneficiaries and transactions must be ready not only for the regulator but also for the auditor and partner bank.

In one of COREDO’s recent projects for an investment platform with a license for investment services and crypto assets in the EU we built:

• a risk-based client assessment model,
• a country risk matrix (taking into account EU sanctions for investors and export of technologies under Regulation 428/2009),
• escalation processes for compliance officers.

The result — successful licensing and opening of several accounts in the EU, with the bank explicitly noting the maturity of the AML model as a factor offsetting the complex client profile from countries in Asia and the CIS.

EU financing for businesses and ESG in Europe

In 2025 the EU openly says: capital should go where there is a green zero‑carbon agenda, digitalisation and real transformation of supply chains. For an investment company this is a chance: to become an operator or beneficiary of these flows, rather than remain only a “private” player.

EU green agenda: investments and the STEP platform

The EU green agenda, investments and the EU Green Industrial Plan are supported by a range of instruments:

• EU Innovation Fund – grants and financing for projects on decarbonisation, hydrogen, and industrial innovations.
• STEP investment platform – an overlay designed to mobilise financing for strategic technologies (including STEP digital biotechnologies, semiconductors, AI).
• Digital Europe programme – support for digital infrastructure and AI solutions.
• Focus on net‑zero investments, supply chains free from dependencies, and raw material extraction (including projects in Sweden, Finland, Greece, Spain to develop extraction and processing of critical raw materials).

For an investment company this means:

The COREDO team has already supported projects where an investment company in Ireland and a fund in Sweden jointly submitted applications to the Innovation Fund and national “green” programmes. Key insight: the ROI from such investments in the EU looks different – not only due to market returns, but also because of subsidies, grants and concessional loans.

CSRD for investment firms and greenwashing risks

With the introduction of CSRD reporting for investment firms and the development of IFRS S1 and S2 ESG standards, the EU is effectively changing the rules of the game. New contours are emerging for medium and large investment companies, as well as for those working with EU-listed issuers:

• Mandatory ESG reporting covering environmental, social and governance aspects.
• CS3D due diligence directive requirements – checking supply chain risks, working conditions, human rights, environmental footprint across the entire chain.
• Emphasis on digital tagging of ESG data so investors and regulators can compare whether the portfolio actually meets the stated objectives.

At COREDO we recommend to clients:

• Embed ESG analysis into supply chain risk management already at the Due Diligence stage of investment targets.
• Document asset selection and exclusion criteria (screening, negative/exclusion lists) in the investment policy.
• Prepare a CSRD roadmap: which data you will be able to collect now and how you will scale reporting as the company grows.

Risks and benefits of an EU residence permit through investments

Risks and benefits for investors in the EU today are largely determined by the regulatory agenda: from new sanctions, export controls and transparency of capital origin to tightening requirements for beneficiaries. Against this background, competent use of investment programs to obtain a residence permit and thoughtful scaling of an investment model in the EU require not only an understanding of returns, but also a detailed consideration of legal restrictions and compliance.

EU sanctions for investors and export controls

Key points:

• The EU regulation on the control of dual‑use exports (Regulation 428/2009 on exports and its subsequent updates) affects transactions involving technologies, equipment and software related to high technology, defense, and cryptography.
• Violations can lead to criminal liability and sanctions for both the investment company itself and its beneficiaries and management.
• Long‑term consequences of EU sanctions for cross‑border investments — complication of KYC, additional checks on the origin of funds and income sources, denial of access to certain sectors or instruments.

Residence permit through a company and EU citizenship by investment

Many entrepreneurs view an investment company in the EU not only as a business tool, but also as a bridge to a residence permit through the company or later EU citizenship by investment.

The approach here should always be two‑level:

1. Business level – real economic activity, substance, office, employees, taxes.
2. Immigration level – compliance with residence permit/permanent residence programs and their requirements (minimum capital, job creation, participation in share capital).

Examples that the COREDO team regularly works with:

• Countries where participation in the capital of a local company above a certain threshold (for example, 10% of share capital for a residence permit in some regimes) combined with job creation grants the owner and their family the right to a residence permit.
• Jurisdictions where residency through investments in business is combined with a subsequent transition to permanent residence and citizenship; Cyprus, in particular, is known for models where permanent residence can be obtained after 5 years of residence if conditions are met.
• Central European countries where the minimum share capital in the EU for a company is low, but for immigration purposes it is still necessary to demonstrate real economic activity.

In each COREDO case we build the structure based on the objectives: if your priority is a residence permit and family protection, the model will differ from a case where the key goal is exclusively ROI from investments.

How to register an investment company in the EU

1. Define the model and choose a jurisdiction
   • Decide which type of structure you need: a MiFID II investment firm, a fund management company, a holding for direct investments, a fintech platform.
   • Compare viable EU countries for investments by taxes, licensing, ESG requirements, and migration opportunities.
   • Set the target combination: ROI, access to EU programs, residence permit / permanent residence (if relevant).
2. Conduct an AML audit of beneficiaries and investors
   • Document the ownership structure, trusts, options, and other control elements.
   • Check beneficiaries for compliance with material control criteria in the EU, sanctions, and PEP status.
   • Prepare a UBO dossier for the future registrar, bank, regulator – this will reduce the risk of delays and refusals.
3. Start company registration and license preparation
   • Assemble the document package considering the chosen country’s requirements: articles of association, details of directors and shareholders, proof of address and substance.
   • Register the company in the EU in the chosen jurisdiction and simultaneously prepare documentation for the license (business plan, risk policies, AML/KYC, IT controls).
   • Set realistic timelines: from several weeks to months depending on the type of license (investment, payments, crypto, forex).
4. Open accounts and build banking relationships
   • Choose banks and payment institutions that are willing to work with your client profile and country risk.
   • Present a fully developed AML framework and transaction monitoring model – this reduces the bank’s “fear” of a new player.
   • Build a robust banking setup not controlled only on paper – actual dialogue with the bank and transparency are more important than any schemes.
5. Prepare an ESG and CSRD / CS3D compliance strategy
   • Determine which ESG elements are truly relevant for you: climate, labor practices, governance.
   • Implement supply chain due diligence procedures taking into account supply chain risks and future CS3D requirements.
   • Set up a system for collecting and digitally tagging ESG data, even if you do not formally fall under CSRD yet.
6. Apply for EU funding and build a product strategy
   • Identify which programs are relevant: InvestEU, the STEP investment platform, the EU Innovation Fund, national funds under the EU Green Deal and the Digital Europe programme.
   • Prepare project dossiers and partnerships (including with universities and technology companies) – this increases the chances of approval.
   • Integrate ESG metrics and transparent risk management: this directly affects project evaluation and potential ROI.

Key findings and recommendations

• Among the jurisdictions COREDO actively works with, the top‑3 for investment firms in 2025 are as follows:
  • Ireland – optimal for innovative, scalable models with access to global markets and EU programs.
  • Cyprus – a convenient platform for forex, brokerage and multi-asset models with a moderate tax burden and clear regulation.
  • Malta – a strong choice for combining investment licensing, crypto and fintech‑areas with sound AML‑design.
• To minimize risks, I recommend that entrepreneurs:
  • Begin with a detailed AML‑ and sanctions audit of the structure of beneficial owners and investors.
  • Design the business model from the outset taking into account AMLA, the Single AML/CFT Rulebook, CSRD and CS3D.
  • Seek ROI not only in portfolio returns but also in access to EU business financing programs, including InvestEU and STEP.

Banks in Lithuania reject 40–60% of applications to open accounts for non-residents: this is not accidental, but the result of strict requirements from the Bank of Lithuania and strengthened AML in Lithuania under pressure from the EU and the FATF. Imagine: your business from Asia or the CIS is ready to enter the European market, but the account is blocked due to “insufficient substance”. In this article I will analyze why Lithuanian banks have become stricter than they seem and give a step-by-step plan to pass banking due diligence without wasting time or damaging your reputation. Read to the end: get checklists, case studies from COREDO and strategies that have worked for dozens of clients.

Context and drivers of tightening

How Lithuanian banks implement compliance

Onboarding: verification when opening an account in Lithuania

Transaction monitoring and triggers for SAR/STR

Sanctions and correspondent risks

Reasons for bank refusals in Lithuania

• Opaque UBO: disclose the ownership chain with an apostille.
• Lack of economic substance: add EU contracts, bank statements.
• PEP risks: provide a declaration and EDD documents.
• Suspicious patterns: explain transactions in advance.
• No AML Officer: appoint one with certification (CAMs).
• Weak business plan: include 3-year forecasts.
• High-risk geo: evidence of local operations.
• No ISMS: ISO27001 certificate.
• False KYC: update passports, utility bills.
• Reputational flags: RDD report.

Features for fintech/crypto and non-residents from Asia and the CIS

Banks’ requirements for companies and EMIs/VASPs

EMI and payment providers: what documents are needed?

MiCA and crypto: impact on banks and VASP

corporate governance: AML Officer, KRI, audit

How to prepare for and pass a bank due diligence

Documents for account opening

How to validate source-of-funds for large transfers

Checklist for fintech / EMI / VASP

• API integrations with payment gateways
• ISMS / ISO 27001 (or an implementation plan)
• TMS for transaction monitoring

RegTech solutions to reduce compliance costs

Top solutions and their impact

How to present a RegTech solution to a bank?

Preventive measures for reputational risks

What to do if a bank refuses: how to appeal

1. Request reasons for the refusal
2. Prepare a remediation plan
3. Resubmit with additional documents

How to minimize reputational risks

Cases and Examples

Case 1: Asian EMI — refusal due to UBO

Case 2: Crypto VASP under MiCA — passing EDD

Case 3: Company from the CIS — reducing a high-risk profile

Conclusion

In 2025, EU regulators fined banks €2.3 billion for AML failures, and 40% of cases are linked to underestimating risks from shelf companies: ready-made firms that seem like the perfect quick solution for entering new markets. You launch a business in the EU, Asia or the CIS, buy a ready-made company in the Czech Republic or Singapore to save time,, and suddenly face account freezes, UBO investigations or license refusals because of hidden laundering chains. Why does this happen to you? Because compliance breaks not at the finish line, but at the start, during onboarding. Read this article to the end: I will analyze exactly where AML vulnerabilities arise for ready-made companies, show real failure points and give a roadmap so your business can scale without fines and downtime.

Why this topic matters for business

Compliance for ready-made companies is not a formality but a strategic barrier to international expansion.

Our experience at COREDO has shown how timely EDD can save from €500k in remediation costs. This guide will help your board make informed decisions.

What is a shelf-company and why do criminals use it

Shelf / ready-made company at first glance appears to be a quick and convenient way to «enter the market» without unnecessary bureaucracy, but it is precisely this readiness for immediate use that makes such structures especially attractive to malicious actors. To understand where the line lies between a legitimate tool and a risky scheme, it is important to clarify what shelf, shell and hybrid constructions like shelf/shell are, how they differ and how they are used in practice.

Shelf vs. Shell vs. Shelf/Shell: Differences

The difference is critical: a shelf company with a “clean” past may seem safe, but conceals UBO chains.

Typical abuses: layering, structuring

Where compliance breaks down on the client journey

At every step of the client journey there are points where compliance “breaks down”: seemingly minor details become major vulnerabilities along the client journey and hit both risk and conversion. This is especially acute at the initial risk decision during the onboarding process, where the cost of any error is highest.

Onboarding process errors

Banks in the EU ignore anomalies like dormant status, as in ACRA for “sleeping” Pte Ltd.

Insufficient EDD for old or complex ready-made companies

The need for EDD for older shelf companies is obvious: firms older than 5 years require enhanced Due Diligence, but clients skip forensic analysis of documents. COREDO’s practice confirms: without EDD UBO chains slip away.

Issues with third-party providers and supply chain anonymity

Problems with legacy systems and alert fatigue

How to assess the risk of shelf companies in KYC/KYB

How to properly assess the risk of shelf companies in KYC/KYB: methodology and control points — this is not about a formal checkbox on a form, but about a structured three-level model that allows you to record the baseline risk, work through scenarios, and not miss changes in dynamics. Below we will examine how to integrate such a methodology step by step into KYC/KYB processes and which control points to make mandatory at each level.

Three-level risk assessment model

When to apply EDD: checklist (contracts, accounts)

How to conduct EDD for an acquired shelf company in the EU?

UBO check: integration of registries and enrichment

Technologies for Closing Compliance Gaps

Technologies and processes that genuinely close gaps in compliance enable the automation of routine checks and minimize human error, increasing the overall effectiveness of the compliance system. The implementation of solutions such as an integrated AML stack has already shown cost reductions of up to 90% in real-world fintech and banking cases.

Integrated AML stack: KYC, sanctions, TM

The key advantage — the absence of gaps between onboarding a shelf company and its subsequent behavior. With this approach KYC data is automatically passed into sanctions and transaction monitoring, and list updates (EU, OFAC, UN, local) are applied without delays. At COREDO such an architecture is used as a standard: a single risk profile, continuous updates and automatic triggers when the status of a beneficiary or controllers changes.

RegTech: vendor or in-house?

The choice between a RegTech provider (AML SaaS) and an in-house solution should be based not on the license cost but on the full TCO: implementation, support, regulatory updates and scaling. For external KYC/KYB vendors clear SLAs are critical: MTTR no more than 24 hours, false positive rate below 15%, transparent scoring logic and the possibility of an audit trail. In-house makes sense for high volumes and non-standard typologies, but requires an internal team, regular rule updates and legal responsibility for regulatory compliance.

AI/ML, graph analytics, and typology simulation for detecting hidden ownership

Typology simulation is used to test the robustness of rules against new circumvention schemes, and regular stress testing prevents model degradation when behavioral patterns change.

Rules for monitoring mass requests

Key triggers include frequency (>10 legal entities per month per provider or contact), recurring directors/addresses and similar jurisdictions. Behavioral monitoring algorithms aggregate these signals into a dynamic risk profile, allowing legitimate corporate services to be distinguished from shell factories. When thresholds are exceeded, enhanced due diligence (EDD) is automatically activated with an in-depth check of the ownership chain and sources of funds.

ROI and TCO of compliance

Operational metrics: this is the language that makes it easiest to demonstrate the economic justification of compliance and move from abstract risks to clear ROI and TCO figures for compliance. Through indicators such as MTTR alerts, percentage of false positives, cost per case and remediation cost, the compliance function becomes transparent to the board and comparable with other business initiatives in terms of investment efficiency.

KPIs for the board: MTTR, false positives, cost

With such metrics, a typical ROI on compliance investments reaches 3:1 due to reduced penalty risks, faster onboarding and reduced manual work.

TCO of automated EDD vs manual review

Comparing the TCO of automated EDD and manual review reveals differences not only in direct costs but also in scalability. Manual EDD costs on average €8–10k per company, taking into account analysts’ hours, legal reviews and repeat data requests. RegTech solutions reduce TCO by 40% or more: an average cost of €2–3k per company includes automated data collection, sanctions and adverse media screening, and profile reuse. An additional effect is reduced MTTR and lower operational risk as volumes grow.

When to scale in-house and when to outsource?

At a load above ~50 shelf companies per year, it is economically justified to scale in-house with API integration of KYC/KYB and proprietary scoring rules. This provides control over data and flexibility of typologies. At lower volumes, outsourcing remains optimal since it does not require fixed costs for a team and infrastructure. In typical scenarios, scaling the compliance function pays back within up to 6 months due to reduced TCO and accelerated time-to-decision.

Regulatory requirements for inspections

regulatory requirements and the evidentiary basis for inspections form the framework within which TCSP companies must build KYC processes, risk assessment and documentation of decisions made. In this section we’ll examine how FATF standards, local guidance for TCSPs and specific UBO disclosure requirements become a practical evidentiary base for passing inspections and engaging with the regulator.

Financial Action Task Force guidance for trust and company service providers and ultimate beneficial owners

The regulator expects not a formal naming of the beneficiary, but demonstrable disclosure of the full UBO with a verifiable ownership chain to the natural person. The use of official registers (e.g., ACRA and their analogues) should be complemented by independent sources and a risk-based analysis. Special attention is paid to bulk monitoring: mass registrations, recurring structures and nominee directors are considered higher risk and require enhanced procedures (EDD) and documented decision logic.

What regulators look for in remediation

A key element is the evidentiary base: audit trail, review logs, alert history and case decision records. Failures are almost always tied to the onboarding stage, so it is critical to retain case management with a timeline of actions, data sources and justification of the risk rating. The absence of a link between the identified incident and corrective measures is treated as a systemic defect rather than an isolated error.

GDPR and UBO restrictions across jurisdictions

Regulators expect compliance with the principles of data minimisation, purpose limitation and the existence of a legal basis — consent, legitimate interest or contractual obligations. In practice this means storing only relevant UBO attributes and a clear access policy. In Asian jurisdictions their own regimes (PDPA and equivalents) often impose stricter data localization requirements, which requires adapting KYC architecture and segregated storage of information.

Implementation plan for improvements over 90/180/365 days

A practical roadmap for implementing improvements (Actionable plan for 90/180/365 days) helps not only to define strategic goals but also to break them down into clear, actionable steps with definite deadlines and responsibilities. Below is the focus on the first 90 days, where we collect “quick wins” and launch key changes that immediately affect process quality and reduce risks.

90 days: quick wins in bulk formation

The first 90 days — the “quick wins” phase — aims to sharply reduce obvious risks without complex transformations.

Responsibility is assigned to the CCO, the success metric — no unidentified mass cases and at least a 20% reduction in risk exposure. At the same time, standardized SLAs and EDD checklists for high-risk cases are introduced, which reduces manual work and delivers direct operational savings of around €50k per quarter by reducing repeat checks and accelerating decisions.

Integration of UBO, RegTech, and risk-scoring in 180 days

The 180-day horizon is the transition from point improvements to a system architecture. The main focus is data enrichment for UBO and API integration of RegTech solutions into existing KYC/KYB processes. All data sources are consolidated into a single risk profile, and scoring becomes reproducible and auditable.

365 days: typologies, machine learning, governance and KPIs for the board

After 12 months the compliance function moves to a mature phase focused on proactive risk management. Typology simulation and ML elements are implemented to test the robustness of rules against new schemes, and the governance model is elevated to the board level.

Error cases with lessons

Case 1: Onboarding failure. The client bought a shelf in the Czech Republic: director swaps were missed. Fine €1M. Lesson: EDD would have detected the anomalies.

Case 2: Mass registrations. A provider in Singapore: 200 firms/month. COREDO blocked them, saving €300k.

Case 3: Graph analytics saves the day. In Asia a UBO chain was uncovered via linkage analysis – the license was obtained in time.

Questions for the provider and compliance officer

Practical conclusions and recommendations

1. Implement EDD for all shelf >3 years (effort low, impact high).
2. Audit providers for bulk formation.
3. Integrate graph analytics for UBO.
4. Set KPI: false positives <10%.
5. Test typology simulation quarterly.
6. RFP for RegTech with SLA <24h.
7. Board review risk appetite.

Templates and metrics for RFP tenders

These steps from COREDO’s practice will ensure compliance. For deep due diligence of your shelf, get in touch — the team is ready to conduct an audit.

In recent years, the amounts of fines for AML compliance breaches in the EU have consistently exceeded €6–7 billion annually, with a significant portion of regulators’ claims related not to “criminal” transactions but to banal gaps in documentation and poor preparation for an AML audit. At COREDO we regularly see companies with strong businesses lose accounts, licenses and spend months “unfreezing” operations simply because, at the time of the AML review, they do not have a systematic checklist of documents.

If you are scaling in the EU, entering Asia or developing business in the CIS countries, the key question is not “will the company pass an AML audit”, but: “what will the damage be if you enter the audit unprepared?” Lost months, blocks, frozen payments to partners, deal failures and banks’ risk reassessments — this is the reality my team faces in client cases every quarter.

In this guide I will go through which documents are needed before an AML audit in 2025, how to build a practical AML audit checklist under FATF AML standards, 6AMLD, AMLR and the future supranational regulator AMLA, and I will show, using live COREDO cases, how preparing for an audit turns from a formality into a tool for strategic risk management.

AML audit checklist

The minimum set of documents I expect to see at a company before an internal or external AML audit in Europe, Asia or the CIS usually includes:

– AML / CFT policy and CDD/EDD procedures
– KYC documents for clients (individuals and corporates)
– documents on ultimate beneficial owners (UBO) and ownership structure
– beneficial ownership registry / register of controlling persons (where mandatory)
– transaction monitoring logs and rules for transaction anomaly detection
– log of suspicious activity reports (SAR) and correspondence with regulators/banks
– PEP identification and sanctions watchlist / adverse media reports
– results of risk assessment with a description of the risk-based AML approach
– training logs for staff training on AML procedures
– audit trail documentation on key compliance decisions.

At COREDO we structure this into a table for convenience (simplified version):

| Document/artifact | Purpose in AML audit | Risk if absent |
|————————————–|—————————————————–|———————————————-|
| AML / CFT Policy | To demonstrate the existence of a robust compliance framework | Fines, claims against management |
| CDD/EDD procedures | To show how you apply FATF AML standards | Being classified as a high-risk institution |
| KYC files on clients | To confirm a correct onboarding workflow | Account blocks/licenses |
| UBO register / beneficial owners AML | Disclosure of ownership structure | suspicion of circumventing sanctions/taxes |
| Transaction monitoring logs | Confirmation of post-monitoring | accusations of failing to detect suspicious transactions |
| SAR reports | Demonstration of interaction with the FIU | questions about non-reporting in clear risk cases |
| PEP / sanctions screening reports | Screening of high-risk persons and jurisdictions | sanctions and reputational risks |
| Risk assessment / risk model | Justification of the risk-based AML approach | tick-box accusations from auditors |
| Training & internal audit reports | Confirmation of AML program maturity | findings of merely formal compliance |

Next, we’ll examine each block in more detail.

AML audit: what it is and why you should prepare documentation

By AML audit I always mean not only a formal inspection, but also a stress test of your entire anti-money laundering and counter-terrorist financing risk management system:

– internal AML audit (internal AML audit): your own review or an audit commissioned from an independent consultant before the regulator or bank arrives;
– external AML audit: an inspection by the licensing authority, AMLA / national supervisor, central bank or an auditor accredited by the regulator.

Essentially, an AML audit is a check of how well your compliance framework aligns with FATF recommendations, 6AMLD requirements, future AMLR regulations and national AML laws.

According to European banking associations, up to 40% of business account blocks in the EU are related to incomplete KYC and unstructured client data, rather than actual AML violations. This is an area that proper preparation for an AML audit fully controls.

Documents for AML audit and KYC

Any AML audit checklist starts with KYC documents. This is the foundation on which the entire AML review relies.

Basic set of KYC verification documents:

– for individuals:
– passport / ID;
– proof of address (utility bill, bank statement, eID);
– source of income / source-of-funds verification (salary, dividends, asset sales);
– for companies:
– incorporation documents, registration certificate;
– charter / articles of association;
– list of directors and shareholders;
– licenses (banking, payment, investment, crypto, etc.);
– UBO information.

To simplify the structure for clients, at COREDO we use a table:

| Client type |Required files | Storage format |
|————————–|————————————————–|—————————————–|
| Individual | Passport, proof of address, SOF/SOW | PDF/scan + structured fields in CRM |
| Corporate client | Reg. documents, charter, licenses, UBO data | DMS + linked record in AML system |
| Trust / fund | Trust deed, settlor/beneficiaries data | DMS + separate UBO/beneficial owners AML module |

Preparing for an AML audit using a risk-based approach

A modern AML audit relies on a risk-based AML approach. Regulators and the AMLA expect that you:

– segment clients by risk (using customer risk scoring);
– take into account geographic risk profiling (high-risk jurisdictions in Asia, offshore centres, countries with special sanctions regimes);
– document source-of-funds verification and enhanced Due Diligence (EDD) for elevated risks.

COREDO’s practice has shown: companies that document the risk assessment in a separate package for the AML audit (a separate file on the risk model, protocols of its review, committee minutes), pass external AML audits more easily. It’s easier for the auditor to see not an «ideal world», but your conscious risk management model.

Classic cycle:

1. Initial KYC / CDD at onboarding.
2. Enhanced checks (EDD) for high-risk clients (PEP, complex structures, high-risk jurisdictions).
3. Ongoing post-onboarding monitoring (transaction monitoring, adverse media, sanctions).
4. Periodic risk model review and KYC document updates.

Trend for 2025: shift to digital onboarding, eKYC for AML and biometric identification, especially in fintech, payment companies, crypto services, and online banking.

A separate area that the COREDO team is currently working on most often: how to prepare KYC documents for an AML inspection in 2025 taking into account eIDAS, 6AMLD and the expected AMLRs:

• ensure the legal validity of eKYC (electronic signatures, verifiable identifiers);
• set up KYC storage with proper data normalization (unified formats for names, addresses, identifiers for subsequent screening);
• integrate APIs for AML screening with main sanctions watchlists and adverse media.

eKYC documents for AML audits of non-bank companies

For non-bank companies (realtors, investment platforms, PSPs, venture funds) requirements for eKYC documents are often less formalized, but the practical responsibility is the same.

In one of COREDO’s projects for a large real estate holding in the EU, we built a list of documents for an internal AML audit of realtors taking eKYC into account:

– scans of IDs + selfie / video identification;
– address verification via utility APIs;
– confirmation of source of funds for large transactions (investment migration, purchase through an SPV);
– verification logs via API for AML screening (PEP, sanctions, adverse media).

Comparison of approaches:

| Method | Advantages | 6AMLD / 2025 requirements |
|—————–|———————————————–|———————————-|
| Traditional KYC | Understood by regulators, easy in an audit | Must be digitized and have a trail |
| eKYC | Speed, scalability, digital onboarding | Reliable identification, data protection, audit trail |

Beneficial Owners AML and UBO Registry

At COREDO we often conduct a corporate structure audit for clients prior to an AML audit: we build an ownership map, check sanctions risks at each level, and analyze the 50% rule in relation to sanctions. For businesses from the CIS, non-disclosure of UBOs in the EU and the UK already leads to:

• refusal to open accounts;
• refusals of licenses;
• blocking during attempts at M&A or investment migration.

Your AML audit checklist must include:

• up-to-date shareholder registers;
• group structure documents;
• protocols for updating UBO data;
• compliance with national registers (where they are mandatory).

AML compliance checklist for an audit

For a sustainable business I always separate two levels of review:

• internal AML audit, a regular self-check that allows you to see gaps before a regulator or bank;
• external AML audit / AML compliance audit – audits by regulators, the AMLA, central banks, licensing authorities, as well as independent external auditors.

A well-structured internal AML audit is a tool for regulatory fine mitigation and for increasing AML program maturity.

For realtors, fintech platforms, and payment companies we build the internal AML audit around documents and logs.

| Category | Examples of documents | Frequency of review |
|——————————|———————————————–|————————-|
| Policies and procedures | AML policy, KYC/CDD/EDD, SAR procedures | Annually / on changes |
| Client files (KYC) | KYC packs, risk scoring, UBO data | Selectively quarterly |
| transaction monitoring | Transaction monitoring logs, velocity checks | Monthly |
| Screening & PEP | PEP screening AML reports, sanctions lists | Continuously + sampling |
| Third parties | third-party risk assessment for providers | Annually |
| Training | Training logs, employee tests | Annually|
| Internal findings | Internal AML audit reports | Quarterly |

Separately, we include verification of transaction anomaly detection – how the rules are configured, what types of scenarios are used, how manual reassessment is documented.

Preparing SAR reports before an AML audit

For many companies the weak spot is the SAR block. Regulators and banks look not only at the fact of filing suspicious activity reports (SAR), but also at:

– the quality of case descriptions;
– the justification of suspicions;
– the linkage between transaction monitoring logs and the decision taken;
– the presence of audit trail documentation for each SAR case.

A task that COREDO is often approached with: preparing SAR reports before an external AML audit and establishing a standard that complies with FATF recommendations and the requirements of FIUs in different jurisdictions.

AML requirements 2025: 6AMLD, AMLR, AMLA

For companies this means: the document checklist before an AML audit in the EU ceases to be local – you need a single standard that will withstand scrutiny in multiple countries (multi-jurisdictional compliance).

When we at COREDO prepare for a hypothetical AMLA inspection, we focus on changes to the checklist:

| Regulatory block | New requirement | Documents in the checklist |
|————————|————————————-|———————————————|
| 6AMLD | Expanded list of offences | Updated risk assessment, policy |
| AMLR | Uniform minimum CDD standards | Unified procedures and KYC templates |
| AMLA | Centralized supervision | Cross-jurisdictional risk reports |

This favors companies that have already implemented:

• a unified compliance framework across all countries of operation;
• a standardized AML audit checklist;
• a central data repository with quality audit trail documentation.

PEP screening, AML and sanctions lists

The PEP screening, AML and sanctions checking block is one of the first areas any auditor examines.

A quality process includes:

• PEP identification taking into account local and international lists;
• end-to-end screening against sanctions watchlists (OFAC, EU, UK, UN, etc.);
• monitoring adverse media with multilingual data screening (especially important for Asia and the CIS);
• use of fuzzy logic screening to find variants of name spellings.

Optimization before an AML audit

When transaction volumes grow, manual management of AML risks becomes disproportionately expensive.

In practice the COREDO team combines:

• No-Code AML integration – visual builders for quick rule changes without developer intervention;
• APIs for AML screening – connections to sanctions, PEP, and adverse media databases;
• continual learning in AML and GNN models, adapting rules as new data arrives;
• homomorphic encryption (FHE): where joint analytics with partners is required without revealing raw data.

The goal is to simultaneously:

• reduce the burden on the team;
• reduce false positive alerts;
• prepare the system for peak audit loads (regulator requests, bank inspections).

In one Asian fintech group that the COREDO team worked with, moving to a combination of No-Code AML and explainable AI in screening allowed:

• to reduce false positives by more than 35%;
• and at the same time cut the time to prepare materials for an AML audit by about half.

KPI metrics and AML testing

Any automation without metrics quickly loses manageability. Before a major regulatory AML audit we establish:

• KPI metrics to assess AML procedures before the audit:
• False positive rate and trends;
• average alert handling time;
• the share of alerts that became SARs;
• SLA for updating sanctions lists;
• testing AML procedures before the regulatory audit: essentially a rehearsal of the external AML audit.

How to prepare for an AML audit in 2025

To turn theory into a clear action plan, I use the structure with which we at COREDO approach projects in the EU, Asia and the CIS.

| Step | Timeline (estimate) | Responsible |
|————————————–|————————–|——————————|
| Assessment of the current AML framework| 2–4 weeks | Compliance / external consultants |
| Updating policies for 6AMLD/AMLR | 2–3 weeks | Compliance + lawyers |
| Inventory of KYC / UBO files | 3–6 weeks | AML / operations unit |
| Setting up eKYC and screening | 4–8 weeks | IT + AML |
| Optimization of transaction monitoring| 4–6 weeks | AML / risk management |
| Pilot internal AML audit | 3–4 weeks | Internal audit / COREDO |
| Corrective actions | 4–8 weeks | Management + functions |
| Preparation for external audit | 2–4 weeks | Compliance + external consultants |

In practice at COREDO we adapt this plan to the company’s scale, types of licenses (crypto, payment, investment, forex, banking) and jurisdictions (EU, United Kingdom, Singapore, Dubai, Czech Republic, Slovakia, Estonia, etc.).

Key findings and recommendations

If you summarize the dozens of projects the COREDO team has implemented in Europe, Asia and the CIS, the picture looks like this:

• A complete, living AML audit checklist: your best tool against fines and account freezes. It speeds up registrations and Licensing, and reduces the risk of tough questions from regulators and banks.
• Regular internal AML audits with a clear set of documents and KPIs raise your AML program maturity and make an external audit a manageable event, not a crisis.
• Investing in eKYC, No-Code AML and explainable AI in AML today means securing flexibility and ROI over a 3–5 year horizon, especially with rising transactions in Asia and multi-jurisdictional business.

If you need a practical AML audit checklist for a specific jurisdiction or you plan licensing and scaling in the EU, Singapore, Dubai or other regions, the COREDO team can run a rapid assessment for you, build a customized AML checklist and perform a trial audit before the regulator.

Imagine: in 2024 EU regulators fined investment firms €2.5bn for AML breaches, and 40% of EU investment license applications were rejected due to weak KYC for EU investors and incomplete source of funds (SOF) verification. Entrepreneurs from Asia and the CIS aiming for the EU single market often face this: self-registering an EU investment company stretches to a year, accounts get blocked, and reputational investment risks stifle growth. Is it worth risking EU regulatory fines or choosing a ready-made investment company in the EU where the audit has already been completed and EU passporting rights open doors to 27 countries?

I, Nikita Veremeev, founder of COREDO, state: in 2025 an investment company with minimal risks is a ready-made structure in Estonia, Lithuania or Malta, reducing an EU investment company’s risks by 70% through institutional-grade compliance and pre-arranged capital for an EU license. COREDO’s practice confirms: clients from Singapore and Dubai scale their businesses through such structures, gaining access to the EIB and the EBRD. Read on: we’ll go through the steps, jurisdictions and strategies so you minimize EU regulatory risks and launch operations within 2-6 months.

Benefits of a ready-made EU investment company

The COREDO team has repeatedly observed how buying a ready EU investment company saves clients 6-12 months and avoids typical pitfalls. Unlike zero registration, where regulatory requirements for EU investments require a full restart of compliance, a ready structure already meets MiFID II compliance and AIFMD regulation, offering immediate access to brokers’ omnibus accounts for capital aggregation.

Risks of registering an EU investment company and mitigation

Self-registration of an EU investment company carries a high risk of rejection: 40% of cases are due to non-compliance with AML standards, including enhanced Due Diligence (EDD) for beneficial owners from the CIS. Regulators such as the CSSF in Luxembourg or BaFin in Germany block accounts when sanctions screening is weak. The solution developed by COREDO focuses on reducing the risks of registering an investment company: acquire a shelf company with a completed audit where the due diligence of beneficial owners is already documented.

How to register a ready EU investment company with minimal risks? Our experience shows: start with an AML audit for the beneficial owners to avoid the risks of CBI/RBI programmes and ensure KYC checks of the beneficial owners for the investment company registration.

Passporting of an EU license: ROI for Asia and the CIS

Registration of an investment company in the EU

COREDO’s practice with clients from the Czech Republic and Singapore confirms: these jurisdictions minimize investment reputational risks through policy stability for investors.

AML and KYC for EU investors: where is it easier?

Ready-made EU investment holding company

A ready-made holding in the EU for access to qualified investors unlocks EBRD financing and LIFE programs. Where to buy a ready-made investment company in the EU to reduce AML risks? In Estonia, in 2 months. An EU investment holding with omnibus accounts aggregates capital from the register of qualified investors.

EU investment license: business plan and requirements

Preparation for an EU investment license requires an investment company’s business plan with a three-year forecast, including EU audit standards.

Investment company’s business plan incorporating AML and ESG

Preparing a business plan for an EU investment license with an AML audit starts with MiFID II compliance: describe ESG risk management, the investment company’s ESG rating and metrics such as sustainability KPI reporting. Does a high ESG rating affect approval of an EU investment company’s license? Yes — regulators like the MFSA in Malta speed up the process by 20% for verifiable environmental benefits. The EU license business plan from COREDO’s practice integrates Licensing for MiCA crypto.

IES/DA reporting and investment transparency under IFRS

Which metrics should be tracked for portfolio resilience in a ready investment company? KPIs for long-term ESG profitability and exit from non-compliant assets.

Risk reduction in an EU investment structure

risk management in a ready-made EU investment structure focuses on strategic risk management and protection against financial crime.

KYC for investors and post-investment compliance monitoring

KYC procedures for investors include annual post-investment compliance monitoring. How to minimize regulatory risks when purchasing a ready-made investment company in the EU? UBO audits and sanctions restrictions for investors. How to manage post-investment compliance to reduce reputational risks? Implement institutional-grade compliance in Lithuania, where EDD for qualified investors from the CIS is simpler.

Green financing and ESG: impact on profitability

Key conclusions and practical steps

• Step 1: Conduct an AML audit for beneficiaries and UBOs (1-2 weeks).
• Step 2: Choose a jurisdiction: Estonia to reduce EU regulatory risks.
• Step 3: Purchase a ready-made investment company in the EU, apply for passporting the investment license (ROI 20-40%).
• Step 4: Integrate ESG and KYC for EU investors at scale, monitoring EU IES/DA reporting.

Contact COREDO for comprehensive support: from registration of an EU investment company to bank accounts and transparent IES/DA reporting. We will ensure access to the EU single market without compromises.

In 2025, 70% of banking onboarding rejections for companies from the EU and Asia are due to AML non-compliance: account freezes caused by incomplete KYC checks or a weak source of funds. Imagine: your business is ready for cross-border payments, but the bank suddenly freezes operations due to suspicions of money laundering or terrorist financing. Is an AML audit mandatory before opening an account, especially with a PEP among the ultimate beneficiaries? In this article I will analyze the triggers for mandatory audits, the risks of ignoring them, and a step-by-step plan to get through onboarding without delays. Read to the end – receive a checklist and an ROI calculation, validated by COREDO’s practice in Europe, Singapore and Dubai: COREDO.

What is an AML audit in bank onboarding?

AML audit before onboarding: stages and differences

COREDO’s practice shows: for a Pte Ltd in Singapore via ACRA they first collect the articles of association, data on resident directors and the register of beneficiaries, then conduct a compliance audit, which reduces returns for compliance reasons by 50%.

Risk-based AML approach in banks, 2025

When an AML audit is needed before onboarding

Mandatory AML audit in the EU (AMLA 2025)

For companies in the EU, an AML audit is required by EU banks under the EU AMLA 2025 in cases of PEP, source of funds from high‑risk areas or the new AMLA rules for onboarding 2025 — with strengthened data protection (GDPR) and 6AMLD for card issuance. FATF AML updates require an AML audit for companies in the EU before account opening, especially when ultimate beneficiaries are from the grey list.

An AML audit before card issuance in the EU in 2025–2026 is now standard for high‑risk cases, as in COREDO’s practice with payment providers in Cyprus.

AML audit before account opening in Asia and Africa

In Asia, AML before account opening is critical under the MAS Digital Onboarding Framework; the impact of FATF assessments on banking onboarding in Singapore is increasing MAS supervision, with checks of the ACRA database and MyInfo Business. How to pass KYC checks in Asian banks in 2025? A mandatory audit is required for non‑obvious discrepancies in ACRA/MyInfo that cause delays of +2 months, as with a COREDO client from Hong Kong.

In Africa and in ‘clean’ jurisdictions like Dubai, an AML audit ensures FATF compliance, minimizing sanctions compliance issues for foreign economic activity (FEA).

AML requirements and KYC checks: risks without an audit

Risks of account blocking without an AML audit for foreign trade businesses

The risks of account blocking without an AML audit include suspension of AML-related transactions, financial fines for non-compliance (up to millions of euros) and additional penalty assessments. For AML audits and source of funds for foreign trade businesses, COREDO’s practice found: without an audit 25% of accounts are blocked due to suspicious transactions, losing licenses and contracts.

Impact of PEPs and beneficiaries on onboarding timelines

AML compliance in 2025: digital onboarding

Digital onboarding 2025: GNN in AML and FHE

AML/CFT monitoring and automation

How to conduct an AML audit and pass bank onboarding

Conduct an AML audit using a checklist to pass bank onboarding:

1. Risk self-assessment (AML risk map, risk-based approach).
2. Document collection (source of funds, PEP declaration, CDD questionnaire).
3. External compliance audit with AML legal support.
4. Digital onboarding (eIDAS in the EU, MAS Digital Onboarding Framework in Asia).

Return on investment from AML audits for international companies

ROI from implementing AML services prior to onboarding reaches 25–40%: a compliance audit for sustainable banking relationships reduces client onboarding time and the share of returns for compliance reasons.

Key findings and recommendations

Take action:

1. Conduct the mandatory AML audit (1 week; AML audit prior to bank onboarding).
2. Prepare source of funds/PEP documents (KYC compliance).
3. Select an AML services partner for licensing in the EU/Asia/CIS.
4. Implement GNN/FHE for continuous monitoring.
5. Monitor FATF lists and external reviews.

85–90% of M&A deals in the financial sector in the EU face legal disputes, regulatory claims, or price renegotiations within the first two years after closing: this is consistently reported by studies of major law firms and consulting groups in Europe and Asia. For an owner from Europe, Asia or the CIS this means one simple thing: purchasing an EU investment company instead of quick access to a license and a client base turns into a protracted fight to preserve ROI and reputation.

I regularly see deals with an “ideal” target break down over fines for breaches of anti‑money laundering rules (AML/CFT), non‑compliance with MiFID II/AIFMD, undisclosed liabilities and errors in SPA structuring. The buyer expects a quick market entry, EU passporting of services and tax optimization, but instead gets frozen accounts, regulatory claims and investor outflows.

Why does this happen if you have lawyers, auditors and consultants? What legal mistakes are most common when buying an investment company in the EU, and how can they be systematically eliminated? And how does AML screening actually affect the timing and cost of closing a deal to acquire an investment company?

In this article I will break down the top‑8 typical mistakes when buying an investment company in the EU, show their real consequences and provide practical checklists for Due Diligence when purchasing an EU company, SPA structuring and post‑merger integration. If you are planning to buy an asset manager, broker, management company or fund in any EU jurisdiction, I recommend reading to the end: it will save months and millions.

Buying an investment company in the EU: risks for businesses from the CIS and Asia

Purchasing an EU investment company for entrepreneurs from Asia and the CIS may seem logical: an existing license, active funds (UCITS, AIF), established AUM and access to passporting/freedom to provide services across the Union. But the regulatory landscape in Europe is complex: MiFID II / MiFID III, AIFMD, PRIIPs, national rules FCA, BaFin, AMF, CSSF, CNMV — all of this creates a dense layer of requirements on capital, governance, product governance, suitability and reporting.

For a cross‑border buyer it is critical how corporate due diligence is structured:

• verification of owners and beneficiaries in the transaction;
• UBO verification across all levels of holding/SPV/feeder funds;
• analysis of the Beneficial Ownership Register in the relevant EU country;
• assessment of the anti‑money‑laundering program’s compliance with AML/CFT standards and sanctions lists.

Against this background, a superficial legal due diligence of an EU investment company becomes a direct threat: you are buying not only the license but the entire historical baggage: legacy liabilities, unresolved AML cases, opaque master‑feeder structures and potential breaches of MiFID/AIFMD.

8 mistakes to avoid when buying an investment company

Top‑8 mistakes when buying an investment company can lead to serious financial losses, legal risks and failed business integration. The consequences of these missteps, such as overpayment or hidden liabilities, often become apparent only after the deal, as real M&A cases show. We’ll examine each in detail, starting with insufficient AML due diligence.

Insufficient AML due diligence at the start

A typical mistake is to limit yourself to passport copies of key clients and superficial KYC/KYB, without digging into payment flows, PEP statuses and sanction-related links. This is especially critical for funds with investors from Asia, the Middle East and offshore jurisdictions.

In COREDO’s practical projects a full AML check included:

• analysis of the target’s anti‑money laundering program (internal policies, transaction monitoring, suspicious activity reporting);
• use of AML screening tools (World‑Check, RDC, LexisNexis) and PEP screening;
• sampling test of client KYC files for compliance with MiFID, AIFMD and national AML directives;
• assessment of sanctions compliance & screening workflows, including response to list updates.

Mistake: ignoring UBO verification

The second area that is often underestimated is the verification of owners and beneficiaries in a transaction. The buyer focuses on the current legal owner but does not trace to the ultimate economic owner — the final economic beneficiary, especially if the structure includes several SPVs, holdings and feeder funds across different jurisdictions.

EU regulators conduct their own regulatory fit & proper tests for new owners, analyzing not only financial solvency but also reputation, sanctions history and connections to high‑risk jurisdictions. If you have not conducted reputational due diligence and vendor/seller screening in advance, approval may be delayed or not granted at all.

It is important not only to verify the UBO’s identity but also to understand what you are actually buying: how to verify real access to the target’s investment strategies and IP, and whether there is a hidden “competing” UBO who controls key managers or distributors?

Tax traps without optimization

Buyers often assume that tax optimization when buying a company in the EU is a later concern: first we close the deal, then we will deal with transfer pricing, tax residency and permanent establishment. In practice, tax traps on acquisition (deferred tax, hidden VAT, non‑deductible expenses) appear in the first year and directly hit ROI.

Key questions we work through with clients’ tax teams:

• what are the tax consequences of an ownership change for an investment fund in the EU, including changes in tax residency and the impact on investors;
• how cross‑border tax treaties and double tax issues work for your cross‑border holding structure;
• whether there are hidden tax liabilities such as deferred tax, unrecognized VAT, thin capitalization and aggressive transfer pricing from past years.

Superficial legal compliance audit

Legal due diligence of an investment company in the EU often boils down to checking corporate documents, key contracts and litigation. At the same time, a superficial check of MiFID/AIFMD compliance is much more dangerous.

Before buying a management company or broker you need to systematically answer at least three questions:

• what to check in MiFID/AIFMD documents before buying a management company: suitability/appropriateness policies, product governance, inducements, best execution, reporting;
• how to ensure that the target’s investment products comply with MiFID/AIFMD and PRIIPs disclosure requirements, correctly disclose risks and fees (performance fees, high‑water marks);
• whether regulatory capital is sufficient and whether capital adequacy and regulatory capital requirements are met under national rules.

Hidden liabilities and legacy risks

Hidden liabilities when buying an investment firm are not only “forgotten” claims and guarantees. In the financial sector, contingent liabilities and legacy liabilities play a major role: historical mistakesin NAV calculation methodology, controversial performance fees, undocumented guarantees to distributors and side‑letter agreements with major investors.

• how to identify hidden liabilities and clearing risks in M&A in the financial sector;
• which insurance checks (D&O, professional indemnity) are necessary when acquiring an investment company;
• how to assess and document contingent liabilities in the SPA for an investment company in order to invoke indemnities and escrow later.

Incorrect deal structure: share deal vs asset deal

The question «how to structure the deal – advantages of a share deal vs an asset deal for an investment company?» seems theoretical until you encounter regulatory and tax consequences.

A share deal allows you to more quickly preserve licenses, contracts and business continuity, but you assume all legacy liabilities, including historical AML and tax risks. An asset deal is cleaner, but:

• in some EU countries, new licensing of investment services is required when buying a business as a set of assets;
• there may be difficulties with transferring clients, termination & change-of-control clauses in distributor agreements;
• there are additional tax consequences and VAT effects.

Deal structuring is usually set out in an SPA (Share Purchase Agreement) or an APA (Asset Purchase Agreement) with a considered consideration structure: cash, shares, earn‑out. At COREDO we always pay particular attention to:

• escrow account / purchase price holdback;
• warranties & reps and indemnity mechanisms;
• earn‑out and payment structure, including anti‑avoidance clauses and earn‑out calculation disputes;
• completion mechanics and closing conditions, including regulatory approvals (FCA, BaFin, CSSF, etc.).

Problems integrating compliance processes after the deal

In a number of COREDO projects, preliminary operational due diligence (ODD) and IT & cybersecurity due diligence included:

• assessment of the investment process ODD: who actually makes decisions, how risk management works, whether there are insider risks and market abuse compliance breaches;
• analysis of KYC/KYB processes for key distributors and clients, assessment of business model risk dependency on third‑party distributors;
• audit of IT infrastructure, data protection, the existence of a data breach response plan and cyber insurance;
• assessment of GDPR risks when migrating fund data to another jurisdiction, including fund migration and re‑domiciliation risks.

Underestimating key person risk and operational risks

• provide for retention plans, option programs and bonus pools tied to post‑deal KPIs;
• secure non‑compete and non‑solicitation within permissible limits;
• assess corporate governance and board composition: whether there are independent directors, how powers are distributed.

Operational due diligence should identify business continuity risks, transaction carve‑outs, dependence on specific distributors (revenue concentration risk), and the company’s readiness for an operational resilience framework that European regulators are actively promoting.

Due diligence checklist for buying an EU company

In COREDO projects I always recommend viewing due diligence of an EU investment company as a set of parallel streams, each addressing a class of risks: legal, financial, tax, AML/compliance, operational (ODD), IT/cyber, reputational.

Post-deal integration and ROI

A deal is considered successful not on the day of closing, but after 2–5 years. Clients often ask which KPI to use to calculate the economic effect of the deal and ROI after 2–5 years, and which metrics to use to assess the long‑term value and scalability of the acquired investment company.

In COREDO’s experience, the following metrics work well:

How to choose a partner for purchasing an investment company in the EU

1. Form a team with EU‑M&A experience in the financial sector. It should include M&A and regulatory lawyers, tax advisors, AML/compliance experts and ODD/IT‑risk specialists. COREDO’s practice confirms: transactions with such a team proceed faster and with fewer surprises.
2. Run preliminary AML and sanctions screening before the LOI. This allows you to weed out toxic targets early and avoid spending months structuring a fundamentally problematic deal.
3. Model the deal structure and ROI before starting full due diligence. Scenario analysis of the tax structure, passporting restrictions, key person risk and dependence on distributors will help understand the upper price limit and which warranties & indemnities are essential.

Buying an investment company in the EU is a powerful tool for scaling a business from Europe, Asia and the CIS, but only if you manage regulatory, tax and operational risks systematically. If you are preparing for a deal or considering a specific target, the COREDO team can become the long-term partner that takes on the complexity of due diligence, structuring and post‑deal support, leaving you with the main thing – strategic decisions and business growth.

In recent years, average global spending on AML compliance for financial institutions has grown at double-digit rates and already amounts to billions of dollars annually. At the same time, requirements for Customer Due Diligence (CDD), Enhanced due diligence (EDD), transaction monitoring, sanctions screening, and for cross-border transactions: Travel rule compliance, have tightened. Regulators in the EU, including supervisory authorities operating under KNF requirements and GIIF guidelines, in Asia and the Middle East regularly raise the bar of expectations for financial companies and fintech providers.

In this article I will analyze when outsourced AML solutions are objectively more advantageous and safer than building your own in-house AML team, and when, conversely, it makes sense to invest in an internal function. I rely on COREDO’s experience in supporting clients in the EU, the United Kingdom, Singapore and Dubai, as well as on up-to-date research on fintech AML compliance models, regtech solutions and global regulatory trends.

If you plan to launch or scale a financial service in the EU, Asia or the Middle East within the next year, I recommend reading to the end: you will get a practical selection algorithm, an ROI calculation formula, and real scenarios in which AML outsourcing yields not only cost savings but also a strategic advantage.

AML outsourcing vs. in-house: key differences

To avoid getting lost in details, I usually suggest clients start with a simple comparison framework of in-house AML and AML outsourcing across five parameters.

| Factor | In-house AML | AML outsourcing | Advantage |
|——–|——————|———————|————-|
| Cost | High upfront investment costs (proprietary platform, licenses, team) + ongoing maintenance burden | Lower entry: subscription/fee, shared global compliance costs and infrastructure sharing | Outsourcing (savings of 30–50% on TCO) |
| Implementation time | Long implementation timeline: development, hiring, configuration (often 6–12 months) | Fast deployment of standard AML solutions in 1–3 months thanks to ready-made modules and standardized workflows | Outsourcing |
| Scalability | Growth limited by employee turnover risks, difficulties in hiring and training | Built-in AML scalability and flexibility: the provider scales capacity to volumes | Outsourcing |
| Expertise | Risk of internal expertise gaps, recruitment challenges for AML specialists | Vendor AML expertise, including MLRO outsourcing and sector-specific training for the client’s team | Outsourcing |
| Technology | Often technology stack limitations, complex customization | Access to AI-driven AML, machine learning in AML, advanced regtech solutions without capital investments | Outsourcing |

AML compliance costs: outsourcing reduces expenses by 30–50%

When a fintech company comes to me at the licensing stage in the EU or Singapore, the first conversation rarely starts with technology. Almost always the first question is: «How much will AML compliance cost us over a 2–3 year horizon?». Here the contrast between in-house AML and AML outsourcing is especially noticeable.

In the in-house model the cost structure includes:

• Upfront investment costs: purchase or development of a transaction monitoring platform, sanctions screening modules, CDD/EDD, integrations with core systems.
• Maintenance burden: support of IT infrastructure, updates for new regulatory requirements, adaptation to changes in sanctions lists and Travel Rule compliance.
• Payroll: in-house AML team, including MLRO, analysts, IT support, regular sector-specific training.
• Indirect costs: management time, legal support, participation in inspections and audits.

Implementation timeline and scalability for fintech

In the in-house AML model:

• the implementation timeline includes RFP, selection and implementation of the platform, scenario configuration, testing, team training;
• at the same time each spike in volumes requires scaling infrastructure and hiring more people, which increases the risk of bottlenecks and operational failures.

In AML outsourcing the typical path is different:

• the provider uses already tested Fintech AML compliance models, offers a set of ready-made scenarios tailored to the client’s segments (for example, cryptocurrency services, payment organizations, forex brokers);
• adds specific settings (jurisdiction, products, client risk profiles), which allows reducing the launch to 1–3 months;
• takes on operational scalability spikes, from seasonal peaks to expansion into new markets – without reconfiguring your internal team.

AML outsourcing for fintech and financial companies

When I discuss moving to AML outsourcing with clients, I suggest looking at it not simply as a cost-saving tool, but as a strategic decision.

Outsourcing MLRO services for small and medium-sized fintechs

I’ll single out the topic of MLRO outsourcing separately. For small and medium fintech businesses, finding and retaining a qualified MLRO with experience working in multiple jurisdictions at once is a non-trivial task. The market shows pronounced recruitment challenges for AML specialists and high employee turnover risks even in large banks, not to mention startups.

The MLRO as a Service model solves this problem:

• you get an appointed officer who is responsible for interaction with the regulator, oversight of compliance with GIIF guidelines, KNF requirements and other standards;
• audit readiness is ensured: register, reports, documentation, justification of the risk model — everything is maintained in a state ready for inspection;
• penalty minimization approaches are implemented: from regular internal reviews to adjustments of procedures after legislative updates.

AI-driven AML in outsourced solutions

The technological side of AML technology outsourcing is another important advantage. Modern regtech AML providers offer:

• AI-driven AML with machine learning in AML to improve the quality of alerts and reduce the share of false positives;
• modular regtech solutions: sanctions screening, transaction monitoring, Customer due diligence (CDD) and Enhanced due diligence (EDD), integrable into your existing architecture;
• ready integrations with payment gateways, core banking and other systems, which reduces system integration challenges.

Risks of in-house AML programs and regulatory fines

To be frank, most headline-making cases with serious regulatory penalties in recent years were precisely linked to failures of internal control systems: insufficient depth of CDD/EDD, errors in sanctions screening, ineffective transaction monitoring and outdated compliance frameworks.

In an in-house AML team the typical vulnerabilities look like:

• internal expertise gaps: especially with rapid business growth or expansion into new jurisdictions;
• the difficulty of timely reflecting continuous regulatory updates in processes and documentation;
• limited budget for sector-specific training, which leads to uneven quality of case analysis;
• insufficient independence of the AML function from business units.

Data security and loss of control in AML outsourcing

Key tools:

• strictly defined communication protocols: who, when and in what format gets access to data and the results of checks;
• segregation of roles and access rights;
• provider obligations on information security, compliance with international standards, encryption, access logging;
• contractual mechanisms: liability for incidents, notification procedures, response plan.

When in-house AML is not viable for fintech

There are several typical situations when betting on a fully in-house AML for a growing fintech project almost certainly leads to excessive costs and increased risks:

• Rapid growth in volumes (especially in high-frequency models): transaction monitoring begins to “choke”, and hiring and training staff can’t keep up with the business.
• Entering new markets with different requirements for Travel rule compliance, reporting, local registration forms: each new jurisdiction requires separate analysis and process adaptation.
• Launching multiple products (for example, payments + crypto services + lending) in tight timeframes.

Calculation of AML Outsourcing ROI for Financial Companies

To move the discussion from the realm of impressions to the realm of numbers, I usually suggest that clients use a simple AML outsourcing ROI formula:

ROI = (Savings - Outsourcing costs) / Outsourcing costs * 100%

By “Savings” we mean the difference between projected in-house AML costs and the total AML compliance costs under outsourcing for the same period (usually 2–3 years).

A simplified comparison example (in arbitrary currency):

| Metric | In-house AML | Outsourcing | Savings |
|———|————–|————|———-|
| Annual direct costs (platform + team) | 500K+ | 200–300K | 40–60% |
| Average time to process one client (onboarding + checks) | 10 minutes | 1 minute (due to workflow automation) | ×10 in efficiency |
| Top management load with AML issues | High | Significantly lower (focus on oversight) | Indirect savings |
| ROI over 2 years | Low, capital investments do not pay off | 150–300% depending on volumes | High |

When to choose AML outsourcing instead of in-house

The choice between AML outsourcing and in-house AML rarely comes down to a “black” or “white” option in practice. Most often a hybrid model proves optimal. Nevertheless, there are a number of typical guidelines.

For whom outsourcing almost always makes sense:

• SMBs and growing fintech companies with limited budgets and ambitious plans to scale in the EU, Asia, or Dubai;
• companies entering several jurisdictions at once and facing divergent requirements for AML/CTF frameworks;
• businesses with volatile volumes where scalability flexibility is critical.

When it makes sense to consider in‑house or a hybrid:

• large players with stable turnover and unique product logic requiring a high degree of process customization;
• companies for which the AML function becomes part of a competitive advantage (for example, complex risk‑scoring models on proprietary data).

How to structure the selection process in practice:

1. Conduct an audit of current and planned needs: transaction volumes, jurisdictions, regulators, reporting requirements, plans for obtaining licenses.
2. Assess system integration challenges: which of your IT systems will need to be connected, which data will be transmitted to the provider.
3. Compare implementation timelines and total costs of the two models, using the AML outsourcing ROI approach described above.
4. Assess vendor expertise: the provider’s experience in your target jurisdictions, availability of modules for Travel Rule compliance, CDD/EDD, sanctions screening, and support for MLRO outsourcing.
5. Determine the target level of customization and the allocation of responsibilities between the in‑house team and the provider.

Scaling AML compliance through outsourcing for fintech

The solution developed at COREDO included:

• selecting a provider with strong regtech AML modules, support for AI-driven AML, and adaptive case management systems;
• using elements of MLRO as a Service to satisfy the requirements of multiple regulators;
• configuring high customization vs quick setup: a fast base plus targeted refinements of scenarios for the client’s specific risks.

Key takeaways and steps

Practical steps I recommend taking now:

1. Calculate your AML outsourcing ROI using your actual budgets and growth plans.
2. Conduct an audit of current CDD/EDD processes, sanctions screening, transaction monitoring, and readiness for audits.
3. Create a shortlist of providers with strong regtech AML expertise and the option for MLRO outsourcing; carefully assess vendor expertise for your target markets.
4. Plan integration architecture and communication protocols in advance to ensure control over risks and data.

If you need an applied analysis of your specific model and jurisdictions, the COREDO team is ready to conduct a targeted audit of your existing or planned AML solutions in the EU and Asia and help build a resilient, economically justified, and scalable AML compliance model for your business.

Did you know that in 2024 company registration in Latvia attracted over 15,000 foreign investors, but 28% of Latvia residence-permit investment applications were rejected due to non-compliance with Latvia AML?
Imagine: you invest €50,000 in a Latvia investment company, go through all the steps, and a Latvia UBO check or a small debt over €150 wrecks your plans for EU residency via Latvia.
What if regulatory requirements for Latvia in 2025, with their digitization and tougher KYC, make Latvia even harder for businesses from Asia and the CIS?

Registration of SIA in Latvia: steps for investments

The COREDO team has been handling registrations with the Latvian Register of Enterprises (RER) since 2016, helping clients from the Czech Republic, Singapore and Dubai launch an investment company in Latvia in 7–10 days. The process begins with choosing a form; a limited liability company (SIA) is ideal for business investments in Latvia, offering flexibility and protection.

SIA share capital in Latvia from €1

The SIA share capital in Latvia starts from 1 euro, making entry accessible, similar to a Pte Ltd in Singapore with 1 SGD according to ACRA 2025. However, COREDO’s practice shows: for an SIA with a €1 share capital in Latvia it is mandatory to reserve 25% of profits up to €2,800 — SIA capital reserves in Latvia block dividends until the capital grows. Up to 5 individual founders bear the shareholders’ personal liability for a deficit if assets do not cover debts. The solution developed at COREDO is to contribute €2,800 immediately, in order to distribute profits right away and avoid the €1 share capital restriction.

UBO check in Latvia for a foreign founder

The UBO check in Latvia is a key stage: the Ultimate Beneficial Owner (UBO) is disclosed to the RER with KYC verification (Know Your Customer), including proof of source of funds, passport and confirmation of tax residency. Since 2025, beneficiary verification for a foreign founder has been strengthened by digitization, similarly to BizFile+ in Singapore. Our experience at COREDO confirms: the founder’s business reputation and absence of debts are verified by the FID in advance — this reduces the risks of foreign-founder checks in 2025 to zero. Prepare certificates on PEP status (Politically Exposed Persons) and EU/Interpol sanctions.

Regulatory requirements for investment companies in Latvia

Regulatory nuances in Latvia are evolving under EU directives, as ACRA in Singapore strengthened UBO in 2025. COREDO’s practice focuses on regulatory requirements in Latvia for firms with turnover under EUR 10 million.

Investing in Latvian businesses — minimum investments

For investing in Latvian business, EUR 50,000 in an SIA with up to 50 employees is sufficient; corporate tax obligations for companies in Latvia are fixed at 20%, with annual tax payments of EUR 40,000 for a residence permit through business investment in Latvia. Taxes for companies with up to 50 employees in Latvia are reduced by incentives on reinvested profits, as in “small companies” in Singapore (assets <10 million SGD). COREDO estimates that tax payments of EUR 40,000 are recouped by the company in 2 years with turnover of EUR 5 million.

Regulatory changes 2025 in Latvia: VAT digitization

Regulatory changes in 2025 in Latvia introduce full digitization of document flow in the RER, requiring VAT registration for real activity with evidence: contracts, clients, office, website. For foreigners: an audit of real activity to avoid compliance risks for startups. The COREDO team integrates this into the launch, ensuring compliance with the Latvian Immigration Law.

AML in Latvia for an investment company

AML requirements for investments in Latvia comply with the EU AMLD6 directive, strengthening FID oversight.

AML compliance, KYC and PEP for an investment company

AML compliance for an investment company involves an annual audit by the Latvian Financial Police (FID), security service checks, sanctions checks and screening against EU and Interpol sanctions lists. PEP status blocks 12% of applications, COREDO uses automated tools for AML risk management.

AML risk management for foreign founders

Compliance specialist is mandatory: it minimizes AML compliance for foreign investors in Latvian business through quarterly reports. COREDO’s practice reduces the risk of refusal — how to minimize AML risks for foreign founders when registering an SIA — to 1%.

Residence permits for investments in Latvia: options and risks

Latvia Golden Visa opens a path to long-term residency and citizenship from €50,000.

Buying bonds for a Latvian residence permit

Buying bonds for a Latvia residence permit: zero-interest government bonds of €250,000 (contribution €38,000, 5 years). Alternative: subordinated bonds of a Latvian bank for €280,000 with a 3% yield, as subordinated obligations of a bank in credit institutions. COREDO optimizes risk management practices when purchasing subordinated bonds in Latvia.

Real estate in Riga: €250,000 residence permit risks

Real estate in Riga €250,000 for a residence permit requires a cadastral value from €80,000 in Riga/30 km, a contribution of 5% – cadastral property value €80,000. Migration risk of residence permit refusal increases with debts > €150, without financial means of €370/month or medical insurance coverage of €30,000. Avoid the risk of residence permit refusal due to debts over €150 in Latvia.

State fee for investments in Latvia and ROI

The state fee for investments in Latvia – a government charge of €10,000 for business investments. ROI of residence permit investments in Latvia for €50,000 in an SIA with turnover up to €10 million: 15–20% per annum, higher than bonds: ROI from investments of €50,000 in a Latvian company with turnover up to €10 million. ROI metrics of the Latvia residence permit program take into account long-term consequences for tax residency from annual payments of €40,000.

Scaling a business: Latvia, EU, Asia, CIS

Scaling business — the Baltics uses Latvia as a hub for strategic planning of entry into the EU market, minimizing management of currency risks for euro investments. COREDO manages compliance risks for Latvian startups when entering Asia/CIS: how to ensure compliance for entry into the Asia/CIS markets through a Latvian investment company. What regulatory barriers will arise when scaling an investment company in Latvia after 2025?

Practical steps and recommendations

1. Conduct UBO/KYC with a compliance specialist – risk of refusal < 1%, how to confirm the source of funds when registering a UBO in Latvia.
2. Choose an SIA with 50 000 €, meet annual tax requirements for a residence permit through investment in the company 40 000 €/year.
3. Confirm funds/reputation before registration in RER, how to prove genuine activity for VAT registration of an investment firm in Latvia.
4. Calculate ROI: business > bonds for scaling, how to calculate the overall ROI of a residence permit through bonds or real estate in Riga, does UBO verification affect the ROI of investments in a Latvian business with 50000 euros.
5. Avoid risks: debts < 150 €, what risk management strategies for sanctions and PEPs when launching in the Baltics, whether it is worth investing in an SIA with €1 capital for a residence permit, considering personal liability, restrictions on dividends of an SIA with capital under 2800 euros.

Latvia opens EU access from 50 000 euros, but 2025 tightens AML/UBO; a focus on compliance maximizes ROI for businesses from Asia/CIS.

Over the past three years at COREDO I have observed the same picture: investors look for a European structure, and after 6–9 months are forced to “rewrite” the fund because they started with an excessively complex or, conversely, too simplistic model. A mistake at the stage of choosing between ZISIF §15 and a classic EU investment fund can easily “cost” 1–2% of the investment fund’s annual ROI solely due to extra administration and compliance expenses, and that is without taking into account the loss of deal speed.

ZISIF § 15 – Alternative Investment Fund of the Czech Republic

In Czech practice ZISIF §15: this is a special regime of a “lightly regulated” alternative investment fund provided for by Act 240/2013 Sb. on investment companies and funds. It is essentially a specialized investment fund for qualified investors that:

• falls within the regulatory perimeter of the Czech National Bank (CNB) through registration,
• but is not subject to ongoing prudential supervision, like classic EU funds under AIFMD.

This structure creates an interesting balance: formally you are an alternative investment fund Czech Republic attracting capital from a limited circle of qualified investors, but your administrative and reporting burden is closer to an advanced SPV than to a licensed fund.

• status of an alternative fund without an asset management company license under AIFMD,
• registration in the CNB register (ZISIF regulation by the CNB via a notification regime),
• simplified reporting: not all AIFMD requirements apply, but basic ZISIF compliance standards remain,
• flexible corporate structure of the fund: most often this is a limited liability company or a joint-stock company with an adapted charter.

Minimum ZISIF threshold 125000 EUR

ZISIF §15 is strictly targeted at qualified investors. The minimum ZISIF threshold of 125000 EUR per participant is not just a formal limitation, but a filter that:

• reduces the burden of investor‑protection disclosure (instead of mass retail marketing: targeted work with professional capital),
• allows using more flexible strategies (venture, private equity, real estate, pre‑IPO),
• reduces the risk of regulator claims for unfair selling of complex products to non‑qualified clients.

Important: qualified investors in the European logic are not only “wealthy private individuals”, but also companies, funds, holding structures that meet quantitative and/or qualitative criteria. At the launch stage we at COREDO necessarily form a matrix of investor statuses to avoid a “miscalculation” by one of the participants, otherwise the entire structure may be reclassified.

ZISIF self‑managed vs asset management company in the EU

• makes investment decisions,
• is responsible for risk management,
• builds relationships with project management (SPVs, developers, startups),
• provides fiduciary management in the interests of investors without engaging a separate licensed asset management company.

In classic EU investment funds (AIF/UCITS) a licensed AIFM is almost always required: this entails additional fixed costs, capital requirements for the management company, and separate compliance and reporting procedures.

ZISIF limit 100 mln EUR and diversification

ZISIF §15 has an asset limit of ZISIF 100 mln EUR (in certain cases: 500 mln EUR without leverage and with a long lock‑up, but for the decision‑framework it’s more convenient to orient on 100 mln). This is both a limit and a built‑in risk‑management tool:

• up to 100 mln EUR you remain in a “lighter” regime without a full AIFMD license;
• when approaching the limit you have time to plan scaling investments via a separate EU investment fund (AIF/UCITS) or an “overlay” in the form of a management platform.

• to combine real estate in funds (income‑generating, development, reconstruction),
• to finance venture projects (seed/Series A) via an SPV structure,
• to use securitization of assets (for example, a pool of receivables) for project risk isolation,
• to maintain a reasonable level of unit liquidity through customizable entry/exit rules for qualified investors.

EU Investment and Alternative Fund: Features

When we say “EU investment fund”, in most cases we mean two classes of structures:

• UCITS – retail funds with a strictly standardized model,
• AIF – alternative investment fund under AIFMD (including FKI/SICAV as a fund for qualified investors in certain jurisdictions).

• an asset management company is required (or an internal AIFM under certain conditions),
• a set of supervisory requirements applies: reporting, risk‑management, Key Information Documents (KID), liquidity management procedures,
• marketing and passporting across the EU are available (depending on the fund type and investors).

ZISIF vs EU funds: regulatory burden

• ZISIF §15, registration with the CNB, simplified reporting, basic compliance requirements of ZISIF, no licensed management company, but fiduciary duties of the director and an internal risk‑management system are present.
• EU investment fund (AIF/UCITS): full oversight under AIFMD/UCITS: detailed reporting to the regulator, preparation and updating of KID, formalized policies on asset valuation, liquidity, conflicts of interest, a separate AML‑framework at the management company and the depositary.

AIFMD requirements and the role of the CNB

AIFMD establishes a framework for all EU alternative funds: rules on risk management, reporting, disclosure, and fund marketing. ZISIF §15 is a “small regime” embedded in Act 240/2013 Sb., allowing one to remain below the threshold of a full AIFMD license.

• for ZISIF §15 – registration and supervision of basic compliance (ZISIF compliance, AML‑policies, governance structure),
• for licensed EU investment funds: full regulatory oversight with regular reporting and onsite/offsite inspections.

FKI/SICAV EU fund for venture projects

• you initially plan a portfolio of 100+ mln EUR,
• you want to actively attract institutional investors,
• you target marketing in several EU countries relying on AIFMD passporting,
• you are considering a listing, listing-like mechanisms, or complex asset securitization transactions.

• more formalized investor protection,
• robust risk‑management standards,
• the ability to build complex corporate fund structures (umbrella‑fund, sub‑funds) for different strategies.

ZISIF Section 15 vs EU investment fund

Advantages of ZISIF §15: workload and launch

• speed of launch (from registration to first closing with ready investors, a matter of weeks),
• administrative burden (fewer ongoing fixed costs for licenses and AIFM),
• flexibility in deal structures (especially when combining real estate, venture and debt instruments).

Scaling an EU fund above 100 mln EUR

• scaling investments beyond the ZISIF limit of 100 mln EUR without changing the “regime”,
• higher predictability in the eyes of large institutional LPs,
• developed marketing and passporting mechanisms across the EU,
• the ability to build a multi-strategy platform within a single umbrella fund.

Integration of ZISIF into holdings for EU investors

For investors from Asia and the CIS, ZISIF Czechia often becomes part of a broader holding architecture. Here international tax planning, CFC rules and beneficial ownership issues come to the fore.

Integration of ZISIF into holdings and CFC rules

• the jurisdiction of the parent holding (EU/United Kingdom/Singapore/UAE etc.),
• the application of controlled foreign company (CFC) rules in the country of tax residence of the beneficiaries,
• the possibility of using tax benefits of the EU (participation exemption, reliefs on dividends and capital gains under certain conditions).

• to carefully allocate income across the levels of the structure,
• to use an SPV structure to isolate project risk in individual countries,
• to minimize “cascading” taxation.

Beneficial ownership and substance in ZISIF Czechia

The issue of beneficial ownership today is key not only for tax matters but also for banking checks. For ZISIF §15 it is important to:

• to correctly disclose ultimate beneficial owners (UBO) in Czech registers,
• to ensure actual presence (substance): a director, office address, local compliance framework,
• to build the fund’s corporate structure so that it does not create the appearance of a “transit” company without real management.

AML consulting and Due Diligence for Asian investors

• sources of funds,
• background of key beneficiaries,
• the alignment of the investor’s profile with the fund’s declared investment strategy.

• AML consulting: preliminary risk assessment, preparation of the document package, establishing the logic of the origin of capital,
• Due Diligence legal: review of the target corporate structure, assessment of CFC risks, substance, possible regulatory claims.

Risks and compliance: ZISIF vs EU funds

AML compliance in ZISIF in the Czech Republic and launch speed

• KYC of all qualified investors,
• verification of sources of funds (especially for high‑risk countries),
• monitoring of the fund’s operations and the underlying SPV.

risk management ZISIF §15 with a 100 million EUR limit

• asset diversification: sensible allocation by classes (real estate, venture, debt instruments), geographies and project stages,
• securitization of assets through SPVs for project risk isolation (each major asset or portfolio as a separate SPV company),
• digital investment solutions: use of platforms for portfolio monitoring, ESG integration, regular risk reassessment.

Legal Opinion and Due Diligence for ZISIF §15

• the fund’s history (whether there were real operations, disputes, claims from regulators or banks),
• proper registration and compliance of the ZISIF with the CNB,
• the fund’s corporate structure and its alignment with the buyer’s objectives,
• the contractual framework with the director, investors, and service providers.

ZISIF §15 or an EU investment fund: how to choose?

When an investor comes to COREDO asking “what to choose — ZISIF or an EU investment fund”, we go through five consecutive steps.

1. Assess the volume and dynamics of assets. If you see that over a 3–5 year horizon the volume will not exceed 100 mln EUR, ZISIF §15 is almost always optimal for a start. If you plan to scale investments significantly higher: consider an EU investment fund as the target model, and ZISIF as a transitional stage or a separate “pocket” for a specific strategy.
2. Conduct legal due diligence and AML consulting. At this stage it’s important to understand how the chosen structure aligns with your personal and corporate tax regimes (CFC rules, beneficial ownership), and how quickly you’ll pass banks’ and regulators’ AML checks.
3. Calculate ROI taking the expense structure into account. For venture projects and real estate in funds, ZISIF §15 often provides a better net-ROI due to lower fixed costs for the management company and Licensing. An EU investment fund wins if you work with large institutional investors and their governance requirements outweigh the additional expenses.
4. Integrate the fund into the holding structure taking CFC rules and substance into account. It’s important here to consider the tax residency country of the beneficiaries, substance requirements in the Czech Republic and at the holding level, as well as the application of EU tax benefits.
5. Prepare the KID (if necessary), register with the ČNB and open accounts. For ZISIF §15 – registration with the ČNB and launching the fund’s corporate structure; for a licensed EU investment fund, obtaining an EU financial license, setting up AIFM and depository operations, preparing Key Information Documents for the target audience.

Conclusions and recommendations for investors

• ZISIF §15 – the optimal instrument for qualified investors with capital up to 100 mln EUR who value speed, flexibility, self-management and easy integration into a holding architecture. It is a practical solution for venture projects, real estate, asset securitization and club deals, if you are prepared to ensure well-considered ZISIF compliance and transparent beneficial ownership.
• EU investment fund (AIF/UCITS, including FKI/SICAV) – a logical choice when scaling investments, access to institutional LPs, EU-wide marketing and a long-term strategy are the top priorities, and where the additional AIFMD requirements and higher administrative burden are justified by scale and status.

In 2023–2024, EU financial institutions paid fines for AML breaches totaling more than €5 billion, with a peak of €2.3 billion in 2024 alone – three times higher than in previous years. Imagine: your cross-border group risks similar losses because of unsynchronized AML compliance programs when national regulators diverge in their interpretations of the EU AML package. Are you ready for AMLA supervision, which from 2025 will directly inspect the AML of 40+ high-risk obliged entities? In this article I will explain how to implement AML compliance services in the EU for financial institutions, minimize AML fines for 2023-2024 and achieve AML ROI metrics above 300%. Read to the end: get a step-by-step plan and real cases from COREDO’s practice COREDO, to turn regulatory challenges into a competitive advantage.

What is AML compliance for banks in the EU?

The COREDO team has repeatedly helped clients from Asia adapt local systems to these rules, reducing harmonization time from 6 to 2 months.

Key changes in the AML Regulation

Previously CDD thresholds varied – from €15 000 in Germany to €10 000 in the Netherlands; now €10 000 is fixed for cash transactions with a risk-based AML approach. COREDO’s practice confirms: banks that implemented these changes in advance reduced their false-positive alerts ratio by 25%. AML obliged entities are now required to check Politically Exposed Persons (PEPs) through Beneficial Ownership Registers and the European Central Platform.

AMLA’s role in AML supervision in the financial sector

Anti-Money Laundering Authority (AMLA), based in Frankfurt, is rolling out phased AMLA powers from 2025 to 2028: from 2025, coordination of Financial Intelligence Units (FIUs); by 2028: direct supervision of high-risk obliged entities. This ensures supervisory convergence, focusing on cross-border AML cases. A solution developed by COREDO for a Cypriot bank integrated joint FIU cross-border analysis, speeding up STR processing by 40%.

EU AML Services — Main Obligations for 2025

AML services EU cover the full cycle from AML KYC to reporting, with a focus on AML/CFT obligations EU. Our experience at COREDO with Estonian fintechs has shown how timely implementation reduces operational risks by 35%.

AML KYC and Digital Onboarding under eIDAS

AML KYC is now integrated with eKYC eIDAS and eIDAS digital identification for AML digital onboarding. Steps:

1. verification through the European Central Platform;
2. automated CDD for PEPs;
3. EDD for high-risk cases.

EU banks are implementing this to accelerate customer onboarding to within 24 hours. COREDO’s practice confirms the effectiveness for Singaporean clients expanding into the EU.

AML Transaction Monitoring and Risk-Based Approach

A risk-based AML approach requires calibration for PEPs and high-risk jurisdictions. The COREDO team configured such systems for a Slovak payment platform, reducing delays by 50%.

AMLA EU: Preparation for Direct Supervision 2025–2028

AMLA EU is changing the landscape of AML supervision in the financial sector, requiring proactive preparation. We at COREDO have already conducted AML stress-tests EU for 15+ clients.

EU AML stress tests and AMLA checks

Phased AMLA powers 2025-2028 start with high-impact financial institutions oversight. Recommendation: annual internal tests with a focus on Regulatory Technical Standards (RTS).

Role of the AML Compliance Officer in EU Groups

The AML compliance officer is evolving under AMLA compliance: now is responsible for the Compliance Manager role, AML group-level oversight and AML governance restructuring. In international banks, the role expands to group-wide AML risk management. Our experience has shown: clear separation reduces risks by 28%.

How can the AML false-positive rate be reduced?

Optimization of the AML false positives ratio directly affects AML ROI metrics. COREDO integrated tech solutions for Dubai groups, increasing efficiency by 45%.

Optimizing AML Transaction Monitoring with ML and GNNs

Cost-benefit analysis of ML-based AML tools shows payback in 12–18 months. For fintechs, reducing false positives in AML alerts is the key to scaling.

Measuring the effectiveness of AML programs

AML effectiveness metrics include response time to suspicious transactions (<24 h) and customer onboarding speed improvement. For AMLA supervision the priority is: false-positive alerts ratio and zero material findings. The answer: ROI is measured as (reduction in fines + personnel savings) / costs; typical – 3–5x.

Impact of the EU AML Package on cross-border groups

EU AML package impact on financial institutions increases the requirements for scaling AML programs for cross-border financial groups. COREDO’s practice with UK holdings demonstrates successful harmonization.

Scaling AML under the Single Rulebook

For cross-border AML cases – centralized AML group-level oversight. This addresses “how to scale AML compliance in cross-border financial groups under the EU Single Rulebook”.

Avoid AML fines (2024–2028)

AML fines avoidance strategies for EU institutions 2024-2028 focus on regulatory findings reduction strategies and Sanctions compliance program integration. AML fines 2023-2024 show: timely impact assessments for RTS implementation prevent 70% of fines.

FHE, Data Governance and Unified Reporting

Data Privacy in Anti-Money Laundering with Fully Homomorphic Encryption

Fully Homomorphic Encryption (FHE) provides data privacy in AML systems with FHE technology, allowing analysis of encrypted data for unified AML reporting. Impact on AML data governance: compliance with GDPR for pan-European AML reporting. Ideal for oversight of high-impact financial institutions.

Investing in GNNs and ML for 2025: Is it worth it?

It’s worth investing in GNNs for 2025: they outperform traditional systems in complex cross-border cases.

AML Compliance for banks in the EU 2025

Here is a checklist for AML compliance services for banks in the EU 2025, based on COREDO cases on company registration in the Czech Republic and obtaining licenses:

1. Assess current AML compliance against the AMLR EU Single Rulebook, identifying gaps in CDD/EDD.
2. Implement AML digital onboarding with eKYC eIDAS to accelerate KYC.
3. Set up AML transaction monitoring with ML to reduce false positives.
4. Prepare the AML compliance officer for AMLA supervision through training and AML stress-tests.
5. Integrate unified AML reporting for cross-border groups, synchronizing local teams with the EU AML agency. This answers “how to synchronize local AML teams” and “how to prepare the business for AML stress-tests”.

Key findings and recommendations

EU AML package radically changes EU AML framework for financial institutions, introducing AMLA compliance and EU Single Rulebook AML. Top-5 steps for ROI:

1. ML for false positives;
2. FHE for privacy;
3. stress-tests;
4. group oversight;
5. unified reporting.

COREDO offers comprehensive support: from registration in the EU/Singapore/Dubai to AML services EU. Risk/benefit table:

Over the past two years I have increasingly seen the same scenario: a stable, profitable investment company suddenly gets refused account opening in the Czech Republic, or a bank, without warning, initiates the closure of accounts in the Czech Republic and freezes operations. In one recent case a client received refusals from three Czech banks in a row within six weeks, despite a perfect audit in the EU and an impeccable track record in another jurisdiction.

Why do banks refuse service to investment companies even with a transparent background, real investments, and a clear business model?
How unique is the situation to the Czech Republic, and can you plan your structure in advance to avoid account freezes in the Czech Republic six months after launch?

In this article I will analyze why Czech banks close investment accounts and refuse to provide services, how Czech KYC requirements, AML regulations, EU sanctions and the 14th package affect this, and what strategies the COREDO team is already using today to:

– minimize the risk of AML refusal in the Czech Republic,
– pass KYC verification for investments on the first try,
– build a sustainable banking setup in the Czech Republic and beyond.

If you are planning or already running an investment business with Czech banks (FioBanka, Creditas, UniCredit, ČSOB), I recommend reading the material in full: there will be no generic advice here. I will break down the real banking risk into concrete blocks and show how we at COREDO work with each of them in practice.

Why banks refuse to work with investment companies in Czechia

In recent years the Czech banking sector has undergone a significant tightening of financial compliance and risk management. The Czech National Bank (CNB) has been steadily implementing European banking standards, and international partners are increasing requirements for correspondent accounts in dollars and euros. The result is the same: the refusal of banks to serve investment firms in Czechia has become more the rule than the exception.

What our clients encounter in practice:

• FioBanka and Creditas carefully check “economic substance”, the reality of operations, local presence and a sustained link to Czechia (sustained link to Czechia). The absence of an office, employees or a clear economic rationale for the location often leads Czech banks to close investment accounts already after initial opening.
• UniCredit and ČSOB are increasing their focus on non‑EU residents, especially with complex ownership structures and transactions with third countries: from investment funds to family offices.

Inside banks decisions are made not by front‑office managers but by compliance officers relying on internal risk models: sector, client jurisdictions, sanctions risks, UBO transparency, and transaction history. For investment companies this means one thing: formally correct documents are no longer sufficient; what matters is the transparency of the company’s structure and its logic for the specific bank.

AML refusals in Czechia and KYC non-compliance

The main reason banks refuse investment companies in Czechia is failure to meet KYC (Know Your Customer) and AML (Anti‑Money Laundering) expectations. EU Directive 2018/1673 requires banks not simply to collect a basic package of documents, but effectively to build an evidentiary base showing that:

• the beneficial owners (UBO) are known,
• the source of funds is clear (legality of the source of capital),
• the source of wealth is clear (how the capital was accumulated over the course of activity),
• there are no links to sectors and jurisdictions that increase the risk of money laundering.

At COREDO I constantly see a typical AML refusal scenario in Czechia for investment companies:

• owners with a business history across multiple countries;
• a structure through holdings in different jurisdictions;
• turnover in the tens of millions, but some transactions are through partners or platforms for which there is no detailed documentation.

For a bank this is enough to classify the profile as high‑risk. KYC non‑compliance by investment companies in Czechia often appears in small details:

• a gap between declared forecasts and historical turnover;
• incomplete evidence of the source of capital (no contracts, closing docs, auditors’ reports on M&A deals or exits);
• outdated corporate documents and inconsistencies between legal and financial data.

EU sanctions and Czech banks: investment accounts

A separate block of risks: EU sanctions and their projections into local bank policies. The 14th EU sanctions package increased pressure on both the energy and financial sectors and on transactions with a number of countries that fall within the scope of secondary sanctions and OFAC monitoring.

For Czech banks this means:

• stricter screening of counterparties and beneficiaries;
• expanded control over operations related to certain sectors (energy, finance, trade);
• additional questions for clients who have links to the sanctions perimeter, even if the operations do not directly breach the rules.

At COREDO we model in advance for the client how the 14th EU sanctions package will affect investment flows through Czechia: which jurisdictions should not be used, which sectors require special explanation, and where it is better to separate the operational and investment circuits across different banks and countries.

Blocking of suspicious transactions

Even after successful account opening the risk does not disappear. For many investment companies the real problem starts later: through suspicious transactions in Czech banks that trigger internal monitoring systems.

Typical suspicious patterns include:

• a sharp increase in turnover without an explainable business logic;
• complex chains of transfers through multiple countries or banks;
• regular large transactions with counterparties from high‑risk jurisdictions;
• transactions inconsistent with the declared investment strategy.

Banks pay special attention to high‑risk investment sectors:

• cryptocurrency funds and crypto investment platforms;
• gambling and the betting segment;
• models close to high‑risk trading with an unclear economic substance.

It is not surprising that refusal to service crypto investment companies in Czechia has become commonplace: internal risk models in banks often classify crypto as high‑risk by default. In several cases the COREDO team worked on, crypto led to refusals by Czech banks already at the stage of analyzing the company’s website and marketing materials.

Account opening refusals in the Czech Republic for investment firms

Over the years I have developed a fairly clear matrix of typical reasons why investment companies are refused by Czech banks. I will summarize it using examples of popular banks:

In one case the COREDO team supported a company that was refused three times due to “insufficient connection with the Czech Republic”. We rebuilt the structure: added a local director, signed a genuine office lease, and established operational links with Czech partners. Six months later, on re‑application to another bank the account was opened, and the questions during the bank interview were mainly about the business plan and internal KYC/AML policies, not the owners’ jurisdiction.

Account freezes in the Czech Republic for businesses

Когда речь идёт не о первичном отказе в открытии счёта в Чехии, а о внезапной блокировке счетов в Чехии или решении банка о закрытии счетов в Чехии, последствия для инвесткомпании выходят далеко за пределы банка:

• останавливаются выплаты инвесторам и партнёрам;
• срываются сделки, что напрямую бьёт по ROI и доверительным отношениям с LP;
• повышается риск арбитражных споров с банками и претензий со стороны регуляторов других стран, если затронуты клиенты.

В COREDO при анализе риска блокировки счетов инвестиционных фирм мы используем собственный набор индикаторов: доля операций с high‑risk юрисдикциями, связь с санкционными секторами, сложность структуры UBO, история комплаенса в других банках. Это позволяет оценить ROI‑риски ещё до выбора банка и при необходимости выстроить мультибанковскую стратегию, распределяя потоки по разным юрисдикциям.

Crypto and sanction triggers in investments

Криптоинвестиции: отдельная тема. Для части чешских банков любые связи с крипторынком автоматически относят клиента к высокорисковым отраслям, даже если компания действует строго в рамках регуляций, а модели прозрачны.

Типичные сценарии:

• Банк видит в материалах клиента слова crypto, token, DeFi, и отказывает криптоинвестиционной компании в Чехии, не вдаваясь в подробности.
• Уже работающему фонду банк меняет внутреннюю риск‑политику и через какое‑то время уведомляет о закрытии счетов в Чехии по причине несоответствия обновлённым критериям.
• При появлении новых санкций в отношении отдельных проектов или стран банк усиливает скрининг и расширяет перечень «запрещённых» для себя моделей.

Задача, которую часто решает команда COREDO, адаптация структуры компании: разделить криптоактивность и классические инвестиции по разным юрлицам, банкам и юрисдикциям, чтобы снизить общую нагрузку на комплаенс и не подвергать весь бизнес риску отказа.

How to avoid being declined by banks in the Czech Republic

In practice, the probability of banks refusing investment companies in the Czech Republic can be significantly reduced if account opening is treated as a separate compliance project rather than a technical task.

Key steps I recommend:

Maximum UBO transparency

• Simplify the structure where possible.
• Ensure consistency of beneficiary data across all documents, including foreign registers.
• Prepare a clear explanation of why the structure looks the way it does.

Detailed package for source of funds and source of wealth

• Gather contracts, reports, documents on exit deals, dividends, and asset sales.
• Structure them into a logical chain: from the origin of capital to investments through the Czech company.
• At COREDO we often prepare this as a short “compliance memo” for the bank.

KYC‑ready package for the business model

• A clear business plan with realistic turnover figures.
• Description of target counterparties, countries, and typical transactions.
• Public materials (website, presentations) that do not contradict the stated profile and do not increase the perception of high‑risk.

Preliminary compliance analysis for a specific bank

• Match the bank’s policy on non-residents with your company’s profile.
• Assess how the bank views your countries, industries, and transaction volumes.
• In COREDO’s practice, it’s often more advantageous to choose another bank in the Czech Republic or the EU from the start than to try to “get through” where the risk of refusal is high.

Preparation for the interview with the bank

• Beneficiaries and the director must be able to clearly and consistently explain the model, the origin of funds, and the reasons for choosing the Czech Republic.
• In some cases, the COREDO team conducts interview rehearsals, working through awkward questions before the meeting with the bank.

Strategies for unblocking accounts

If a refusal or blocking has already occurred, there is still room to manoeuvre, but action must be structured.

Practical strategies we apply:

• Request a reasoned refusal and a detailed analysis of the wording from a regulatory perspective: sometimes the bank indicates remediable reasons (incomplete package, unclear source of funds).
• Preparation of an expanded compliance file: additional documents, explanatory letters, updated AML policies/KYC, and internal monitoring procedures.
• An appeal to the bank with a legally sound justification of why the client meets internal and regulatory criteria, including references to local and European standards.
• In the event of a prolonged freeze of assets: assess the feasibility of arbitration proceedings against the bank, taking into account the amount, reputational risks, and prospects.

Alternatives to Czech banks for EU companies

Sometimes the most rational solution is not to force the entire business into the confines of a single Czech bank, but to build a diversified banking strategy relying on other jurisdictions.

In practice, the COREDO team often considers the following options:

Often re‑registering an investment company or creating a holding level in a friendly EU jurisdiction allows you to:

• reduce the likelihood of refusals by Czech banks;
• separate sanction‑sensitive and conservative flows;
• ensure better scalability of the investment portfolio without tying the entire business to a single banking center.

COREDO regularly designs such structures for clients, combining companies in the Czech Republic, Cyprus, Singapore, the UAE and other jurisdictions to strike a balance between market access, tax efficiency and compliance resilience.

Recommendations for investors

I’ll compile everything above into a practical list of actions that I use as the basis for strategic sessions with clients:

1. Conduct a KYC/AML audit before engaging with the bank
Assess the transparency of the UBO, source of funds, and flow structure. If necessary: revise the documents, policies, and model. The cost of such an audit is far lower than the price of account blocking or refusal.

2. Design a banking infrastructure, not just “open an account”
Choose banks taking into account beneficiary jurisdictions, industry, sanctions risks, and expected turnover. In some cases it’s sensible to plan for 2–3 banks in different countries from the start.

3. Minimize sanction and secondary risks
Continuously monitor EU sanctions packages, including the 14th, and the impact of restrictions on partners and industries. Reassess deal structures when rules change so as not to force the bank to stop operations.

4. Prepare a clear narrative for the bank
Including a company presentation, a description of the business model, an explanation of connections with the Czech Republic, counterparty selection criteria, and internal compliance procedures. This is critical, especially for Creditas and ČSOB.

5. Use the experience of specialized consultants
company registration in the EU, obtaining financial licenses, building an AML framework, and supporting banking relationships: this is a separate layer of work. At COREDO we regularly get involved already at the structure design stage so that we don’t have to “remedy” the consequences of refusals, but instead build from the outset a system that is resilient to KYC/AML checks.

Conclusion: checklist before applying to a Czech bank

Before submitting an application to a Czech bank, I would recommend asking yourself five questions:

1. Is the UBO structure and the sources of capital transparent and logical for compliance?
2. Is the business model clear to someone reading about it for the first time, and does it not appear high‑risk without explanations?
3. Do you have a sustainable and documentable connection to the Czech Republic (sustained link to Czechia)?
4. Have sanctions and jurisdictional risks been taken into account, and do your flows avoid intersecting with sensitive areas unless strictly necessary?
5. Do you have a complete, consistent KYC package prepared that will withstand not only the initial review but also subsequent regulatory inspections by the EU and the CNB?

According to European regulators, the fine for unlicensed crypto services in several EU countries already reaches 5% of annual turnover or a fixed threshold of several million euros, and in certain cases an additional double profit penalty is applied — recovery in the double amount of the profit extracted. In COREDO we have seen how such sanctions turned a promising crypto business into a crisis case after just one round of inspection.

When a crypto license is needed

MiCA: Crypto project legally operating without a CASP in the EU

EU Regulation 2023/1114 (MiCA regulation) introduces common rules for CASP services (Crypto‑Asset Service Providers) across the Union: from custodial storage to managing trading platforms and crypto‑to‑crypto or crypto‑to‑fiat exchange. For an entrepreneur the key question is simple: do I fall within the definition of a CASP or not.

• you provide non-custodial crypto services: wallets with full user control of keys, non‑custodial DeFi interfaces, protocols where you do not manage clients’ funds;
• your service is not an organized trading venue where you, as the operator, consolidate orders and are responsible for execution;
• you do not provide personalized investment advice on specific tokens under the MiCA definition;
• all turnover is crypto‑to‑crypto, and fiat off‑ramp avoidance is implemented through third‑party licensed payment gateways.

In practice an unlicensed DeFi protocol or interface can remain in the «regulatory grey zone crypto» if three criteria are met:

• non‑custodial architecture and no access to users’ funds;
• no centralized operator making investment decisions;
• a transparent white paper of the crypto project clearly stating the token status (utility, non‑security) and the risks for users.

At COREDO we regularly conduct compliance audits of such crypto models for clients who want to maximize the flexibility of a non‑licensed crypto project without crossing into CASP.

Fines for crypto without a license: Czech Republic, Lithuania, Malta

Even within the EU regulators treat unlicensed VASPs differently. The most frequent requests to COREDO in 2024–2025 are related to three jurisdictions: Czech Republic, Lithuania, Malta.

One practical alternative is participation in a regulatory crypto sandbox where available: the regulator sees the experimental format in advance, and you get a chance to test the business model before full licensing. For a number of European Web3 teams we have built exactly such a trajectory: a fast launch as non‑custodial, then entry into the sandbox and only after validation – an application for Licensing.

EU crypto license vs no license

When a founder comes to me asking “where is it better to obtain an EU crypto license and where is crypto business without a license acceptable”, I always separate these scenarios along two axes: purpose (EU single market access or global presence) and readiness for regulatory burden.

Classic route: Lithuania, Malta, sometimes Cyprus: with a full crypto license, minimal capital, audit of the crypto company and access to European banks. Alternative route: an offshore crypto entity or onshore‑structures with the territorial taxation principle, where crypto registration without a license is permissible if the business does not serve local residents and does not touch fiat.

Asia: crypto license vs no license

Asian hubs remain one of the main requests from COREDO clients. In practice for Web3 projects we most often consider Singapore, Hong Kong, the UAE and a number of other Asian jurisdictions.

• if you touch fiat, accept client funds or manage them – counting on “crypto without a license is legal” will not work;
• for purely technological models (infrastructure DeFi protocols, analytics, blockchain infrastructure) Web3 project registration may be possible without a crypto license, provided the activity is correctly described and AML frameworks are observed.

If this is not done, the client loses:

• access to payment providers;
• the trust of institutional investors;
• the ability to achieve proper cross-border crypto compliance when entering Europe or the CIS markets.

Advantages of a license-free crypto project in Costa Rica

Costa Rica has become one of the most discussed jurisdictions in COREDO’s requests on license-free crypto projects. The reason is simple: the combination of crypto territorial taxation and a relatively relaxed approach to non-licensed crypto businesses oriented toward foreign clients.

Key features we take into account when structuring:

• territorial taxation principle: taxes are levied only on income from sources in the country; global crypto operations, if properly configured, may not be subject to local tax;
• Costa Rica closed registries: corporate registers are less public, which is more convenient for IP asset shielding and protecting ownership structure;
• no audit requirements for small private companies and the possibility of a single shareholder setup without significant minimum capital.

African crypto jurisdictions with territorial taxation

African emerging crypto zones are still less known to the wider audience, but COREDO already sees steady interest in certain countries with territorial taxation and a flexible approach to unlicensed VASPs. These jurisdictions are of interest when you:

• are targeting global DeFi or Web3 services without directly working with local residents;
• are building scaling non-licensed DeFi and want to test the model before obtaining an EU license;
• are looking for a more tolerant attitude toward regulatory grey-zone crypto, provided there is transparency for banks and investors.

How to launch a crypto project without a license in 2025

When an entrepreneur asks me: «how to launch a crypto project without a crypto license in 2025», I always emphasize: the goal is not to “evade regulation”, but to choose the correct regime with clear rules.

Choosing a jurisdiction

• whether you plan EU clients now or in the foreseeable future;
• how important access to traditional banking is;
• whether you are ready for public disclosure of beneficiaries and reporting.

If you need maximum flexibility and a crypto business without a license, Costa Rica and certain Asian and African jurisdictions come into focus. If the priority is the European market and the brand of a legal player, it makes more sense to plan for an EU crypto license from the start.

Company registration and IP protection

• selects the optimal format of an offshore crypto entity or onshore structure;
• prepares the crypto project’s white paper with a clear description of the revenue model, token status (token utility non-security, where justifiable) and user restrictions;
• sets up IP asset shielding: registering IP in a jurisdiction with strong rights protection, separating IP from the operating company.

AML compliance for a crypto project without a license

• we implement a risk-based KYC model with a KYC threshold exemption for microtransactions;
• we document transaction monitoring procedures, especially for cross-border operations;
• we prepare internal policies and a compliance audit (crypto) as an argument for banks and investors.

Issuance of tokens without a license and without listing

• centralized exchanges carry out their own investor Due Diligence of an unlicensed project;
• without a basic compliance package, a transparent structure and a jurisdictional conclusion on the token’s status, exchange listing of an unlicensed project becomes practically unrealistic.

Scaling and cross-jurisdictional scaling

• assessing turnover thresholds at which the status of a CASP without a license is no longer acceptable and a transition to licensing is required;
• planning entry into the crypto-operators registry where possible as an intermediate step;
• stepwise migration of some functions into a licensed structure while keeping the DeFi core non-custodial.

Risks of a crypto project operating without a license or AML measures

• fines and crypto enforcement actions;
• freezing of bank and exchange accounts;
• attacks on IP and domain assets;
• inability to attract institutional investors.

Fines for crypto services without a license: Czechia, Lithuania

A typical pattern that the COREDO team has seen:

1. first, the bank requests additional information about the activity;
2. then a sudden freezing of assets occurs during the review;
3. in the end: a regulator’s order, a fine and a demand to cease operations.

• we determine in advance whether we need to register as a crypto operator and what the minimum set of procedures required for that is;
• we use legal regimes such as reporting exemption (crypto) and capital adequacy waiver, if the project is small in turnover and does not pose systemic risks;
• we create a structure in which the main financial turnover does not pass through the most aggressive jurisdictions, reducing the likelihood of a “targeted” inspection.

Protection of IP and assets in an unlicensed Web3 project

• protocol code and smart contracts;
• domains and branding;
• user databases.

• registration of trademarks and copyrights in jurisdictions with strong case law;
• separation of IP ownership and operational activity so that local claims against one link do not paralyze the entire ecosystem;
• clear investor protection mechanisms for unlicensed projects: contractual structures, vesting, risk disclosure, even if formally you remain «non‑CASP».

Crypto business without a license: ROI and taxes

The main argument in favor of a “no license” strategy: the ROI of an unlicensed crypto project. But calculations should include not only reduced initial costs, but also the risk-adjusted return of being unlicensed: the probability of fines, losses from blocks, and missed investments.

• initial CAPEX is lower than when obtaining an EU crypto license;
• operational compliance expenses are lower, but not zero;
• the tax burden can be minimized due to territorial taxation and tax risk mitigation;
• On the other hand, access to European and Asian banks and large funds is often limited while the structure remains non-licensed.

• «as is»: profitability without a license, accounting for discounted risks;
• «as will be»: a scenario of gradual transition to licensing (EU or Asia) and accessing a new class of investors.

Key steps to launching a crypto project without a license

• Conduct an initial crypto compliance audit: determine whether the model falls under CASP, VASP, or remains in the non‑custodial zone.
• Choose a jurisdiction with clear rules and territorial taxation (Costa Rica, certain Asian and African hubs) if the goal is a license‑free crypto business with a global focus.
• Implement AML/KYC even without a formal requirement: it’s the foundation of trust for banks, exchanges, and investors.
• Prepare a quality white paper and financial plan taking into account reporting exemption for crypto, if you plan to be listed in registries.
• Plan an exit strategy for the crypto project: at what turnover you will move to crypto licensing in 2025 (EU or Asia), so as not to run into sanctions from MiCA and local regulators.
• For businesses from the CIS: proactively plan CIS business crypto expansion through structures in the EU/Asia/Africa to avoid situations where a fine of up to 5% of turnover and asset freezes put an end to the project.

Choosing between a ready-made company and registering in 2026

Ready-made company vs. registration from scratch: differences

Ready-made company: practical overview

• shelf company with zero activity;
• off‑the‑shelf entity with limited legacy contracts;
• company ready for re-registration to a new UBO.

Registration de novo: process and timelines

• preparation of the articles of association;
• appointment of directors;
• setting up the share capital;
• KYC‑beneficial owner verification.

Differences: time, cost, compliance, DTT

Commercial and operational advantages and disadvantages

Advantages of a ready-made company: quick start

• quick access to tenders;
• presence of a corporate history;
• VAT number or license may be available immediately.

Disadvantages of a ready-made company: AML/KYC, risks

Advantages of registering from scratch

• ability to build a tax optimization structure;
• ESR compliance;
• modern DTTs and BEPS 2.0.

Disadvantages of registering a sole proprietorship from scratch

• significant time burden on the team;
• complex bank onboarding;
• tightening of AML compliance.

Legal risks: AML KYC UBO PE ESR BEPS

AML/KYC risks when buying a shelf company in Asia and Africa

• tightening KYC;
• requirement for UBO information;
• introduction of enhanced EDD.

Economic Substance: requirements in the EU

• having a physical office;
• management accounting in the jurisdiction of registration;
• local document storage.

PE risks and taxes when expanding into Asia and Africa

BEPS 2.0 Pillar Two: impact on ROI in Africa and Asia

Due diligence checklist: shelf company and registration

Due Diligence checklist for shelf company

• verification of registration history;
• request for financial statements and declarations;
• review of court registers.

Checklist for registration from scratch

• preparation of a KYC package for all UBOs;
• development of a business plan;
• company structure diagram.

Tools for due diligence

• AI platforms for screening;
• blockchain-based KYC tools;
• centralized digital counterparty dossiers.

Access to accounts and tax benefits

Tax residency upon registration

Banking support for shelf companies

Tax structures: holding, IP box, transfer pricing, CFC

• holding company structure;
• IP box regimes;
• transfer pricing documentation.

Geo-comparison: EU, Asia, Africa, 2026

Registration in the EU: pros, cons, requirements

• access to a developed DTT‑network;
• predictable case law;
• high substance requirements.

Registration in Asia: PE risks and banks

• fast registration procedures;
• requirements for a local director;
• transaction analysis in international settlements.

Registration in Africa and AML

• projects in commodity sectors;
• local fintech‑initiatives;
• level of AML control.

Economic assessment: ROI and TCO

How to calculate ROI: an existing business vs from scratch

• TCO: purchase/registration price.
• ROI: (projected profit for the period – TCO) / TCO.

Example scenarios

• startup focused on the EU;
• exporter from the CIS to Asia/Africa;
• financial and crypto projects.

Checklist for Safe Purchase and Registration

Steps 1–5 when buying a shelf company

1. Define objectives.
2. Create a due diligence checklist.
3. Conduct independent due diligence.
4. Structure the deal through escrow.
5. Post-deal integration.

Steps 1–6 when registering from scratch

1. choosing a jurisdiction.
2. Prepare a KYC package.
3. Prepare founding documents.
4. Submit registration through a local agent.
5. Prepare the package for the bank.
6. Establish substance.

How to choose a service provider

• expertise in AML/KYC;
• experience in the relevant regions;
• transparency of fees.

Recommended due diligence framework and documents

• disclosure of the company’s history;
• guarantees of no outstanding debts;
• commitments to assist with banks.

Common mistakes and case examples

Purchasing a shelf company without UBO verification

Registering from scratch without substance

How to remedy the mistake: restructuring and remediation

• restructuring;
• finalizing documentation;
• self-reporting and coordination with regulators.

Recommendations for businesses by type and goals

Startup in the EU market

Export from the CIS to Asia and Africa

• a holding company in the EU;
• company registration in Asia or Africa;
• in-depth due diligence of PE risks.

Financial and licensed structures

Over recent years in the EU, the share of inspections triggered not “as scheduled” but by risk signals has exceeded planned inspections in sensitive sectors – finance, logistics, IT services and B2B services. For business this means one simple thing: unplanned inspections have become the result not of chance, but of specific risk indicators that EU regulators record via digital monitoring systems, banks and third‑party complaints.

In this article I propose to look at the topic pragmatically:

• which red flags in the EU actually trigger inspections;
• how to set up a system to minimize the risk of unplanned business inspections;
• how to apply the same approach to your own counterparties and negotiations.

Red flags for EU regulators — what they are

Red flags in the risk-based approach of regulators

The modern risk‑based approach is built on a combination of:

• data from tax and corporate registries;
• information from banks (KYC/AML signals);
• signals from other authorities;
• complaints and whistleblower reports.

Classification of red flags

Based on years of practice at COREDO, we conventionally divide red flags into five groups:

1. Sanctions red flags
   • atypical jurisdictions in the supply chain;
   • indicators of sanctions evasion through intermediaries and “sanctions grey zones”;
   • indirect links to sanctioned individuals or companies listed on sanctions lists.
2. Financial red flags
   • persistent discrepancies in reporting between tax and corporate data;
   • transactional anomalies: sudden spikes in turnover, repeated payment reversals, signals from banks;
   • investigations, freezes of accounts and other assets in multiple jurisdictions.
3. Corporate red flags
   • shared addresses, shared directors;
   • complex and opaque ownership structures without an obvious business purpose;
   • use of shell companies and one‑day counterparties in key links of the group’s scheme.
4. Operational red flags
   • systemic complaints from employees and clients;
   • conflicts with inspectors: refusal of access to inspectors, evasion of routine visits;
   • serious security incidents and data breaches.
5. Reputational red flags
   • protracted disputes with regulators;
   • negative media coverage and court rulings;
   • persistently negative reputation based on business reputation analysis and media monitoring.

Main red flags of business inspections in the EU

What triggers unplanned business inspections in the EU: the main red flags are often not related to large-scale violations, but to seemingly isolated external signals. Complaints from customers, partners, employees and other third parties often become the trigger that launches an unplanned inspection and a detailed review of the company.

Complaints and signals from third parties

In the EU, complaints as a trigger for inspections work much more effectively than many assume. Regulators consider:

• individual appeals from employees, customers, partners;
• complaints from competitors supported by documents;
• reports from whistleblowers through protected channels.

Anomalies in registers and registries

The second common trigger: anomalies in registries. Algorithms check:

• matches by UBO and ultimate beneficiaries;
• repeated shared addresses and recurring directors;
• a sharp change in ownership structure without plausible business reasons.

Discrepancies in financial reporting

Any persistent discrepancies in reporting are a powerful signal. In focus:

• mismatch between revenue, the tax base and corporate reporting data;
• cash gaps and atypical transactional anomalies;
• recurrent bank inquiries and freezes of accounts/assets.

Connections with sanctioned persons and sanctions evasion

• use of traders from jurisdictions known as sanctions grey zones;
• complex supply chains with affiliated counterparties;
• changing the description of a good or service to evade sanctions.

Shell companies and corporate groups

• the scheme involves one-day counterparties with no staff or infrastructure;
• the group structure is opaque and not explained by business logic;
• several ownership layers through low-tax jurisdictions are used for operations in the EU.

Denial of access and preventive visits

Security incidents and data breaches

• cyber incidents involving leakage of client data;
• use of illegal migrants in the workforce;
• systematic delay or non-payment of salaries.

Process of unplanned inspections in the EU

How EU regulators set priorities: the decision-making process for an unplanned inspection is increasingly rarely based solely on complaints or formal grounds and is more often grounded in risk-based supervision. To decide where an unplanned inspection is needed, regulators combine a variety of data sources and use risk assessment algorithms that allow them to quickly identify entities with the highest likelihood of violations.

Data sources and risk-based supervision algorithms

• company registers and beneficial ownership registers;
• tax data and foreign trade statistics;
• bank signals (AML/KYC), including KYC mismatches;
• results of past inspections and court decisions.

Role of the prosecutor’s office in sanctions compliance

Case studies

1. Registry anomaly → on-site inspection
   In one European jurisdiction a client faced an inquiry regarding repeated changes of director and address. The algorithm detected matches with several companies from a “mass” address pool, the regulator conducted an on-site inspection without interaction, and then initiated an unplanned inspection. After restructuring and documenting the business purpose, the issues were closed, but the bank had to provide additional guarantees.
2. Employee complaints → labor and migration inspection
   In another situation a series of anonymous reports about excessive overtime and unregistered employees was used by migration services as grounds for an inspection. As a result, the business had to urgently legalize part of its workforce and revise its staffing model to avoid fines and further tightening of contract terms with a major client who was monitoring the situation.
3. Front counterparties → sanctions monitoring and deal rejection
   An international investor asked COREDO to carry out a rapid assessment of a partner in Europe. Red flag due diligence revealed that a key supplier was an affiliated company with indirect access to a jurisdiction subject to sanctions. The investor chose to withdraw from the transaction, avoiding a serious compliance conflict and potential operational blockage.

Red Flag Due Diligence: how to conduct step-by-step

Assessing business risk through the Red Flag Due Diligence format helps quickly identify critical risk areas and determine whether to proceed further in negotiations or deepen the review. Below we explain how to build such a review step by step and where to start — with a high-level company review to spot key “red flags” at an early stage.

High-level company review

The first stage is a quick high-level company review (sometimes called Red Flag Due Diligence). At COREDO we use the following basic checklist:

• identification of ultimate beneficial owners and comparison with registers;
• analysis of addresses and directors for signs of mass registrations;
• screening for PEPs and sanction links;
• search for anomalies in public registers and court databases.

Counterparty and transaction review

If questions arise at the first stage, a deeper review of the counterparty and transactional activity is initiated:

• payment and logistics chains;
• structure of intercompany settlements within the group;
• screening against international sanctions lists;
• assessment of internal and bank KYC files.

Internal compliance review

• completeness and accuracy of tax reporting and its compliance with tax regulations;
• validity and verification of SRO licenses and sector-specific permits;
• analysis of HR documents with a focus on the risks of illegal immigrants on the payroll and non-compliance with labor legislation.

Preventive measures and monitoring

• use of automated risk monitoring systems for UBOs, sanctions and registers;
• regular checklists for key processes;
• implementation and maintenance of a whistleblowing policy;
• training employees to recognize due diligence red flags.

Action plan upon notification of an unplanned inspection

When a notice or act of an unplanned inspection arrives, the response in the first days determines the subsequent negotiation position. Basic plan:

1. Appoint a responsible coordinator and a lawyer/team.
2. Promptly collect the requested documents and interaction logs.
3. Analyze the legality of the requests and, if necessary, adjust the scope of data provided.
4. Plan reputation management: who and how communicates with partners and the media.

How to minimize the risk of an unplanned inspection

Practical recommendations for minimizing the risk of an unplanned inspection start with basic but critically important elements – policies and processes. Clearly written rules, transparent regulations and procedures understandable to employees help not only to build a controlled environment but also to significantly reduce the likelihood of triggers for an unplanned inspection by supervisory authorities.

Policies and processes: where to start

• KYC‑procedures for counterparties;
• sanctions compliance;
• AML‑policies and management of due diligence red flags;
• a formalized risk-oriented approach to internal control.

Corporate Document Toolkit

• documents on ultimate beneficiaries and group structure;
• agreements with key partners and contract documentation for disputed transactions;
• payment confirmations and correspondence;
• protocols for correcting discrepancies in reporting.

Working with banks and counterparties

• transparent payment purposes and pre-agreed descriptions of transactions;
• minimizing schemes that banks perceive as risky;
• prompt provision of supplements if the bank sees a reason to tighten the terms of the agreement.

Interaction with regulators

• a pre-designated contact person;
• templates of responses to standard requests;
• understanding when coordination with the prosecutor’s office is required and how to read the act of an unplanned inspection.

ROI from Red Flag Due Diligence

• probability of a fine × expected fine amount;
• + estimated losses from blocked operations and reputational risks;
• – costs of implementing and maintaining procedures.

Risks for CIS/Asia Companies in the EU

The specific risks for companies from the CIS/Asia when operating in the EU are largely related to the fact that approaches to ownership structure, governance and reporting that are customary in these regions fall into European “gray areas”. Here any opaque transfer structures, complex ownership chains and cross‑jurisdictional schemes quickly become sources of regulatory, tax and sanctions risk.

Gray areas and transfer structures

Structures that are regarded as ordinary tax planning in one jurisdiction often fall under heightened scrutiny in the EU. This concerns:

• complex ownership structures with multiple holding levels;
• non‑standard supply routes that create supply‑chain sanctions risks;
• the use of jurisdictions that European authorities consider sanctions gray areas.

How not to end up on sanctions lists and what to do in case of an error

• automatic monitoring of UBOs, directors and key counterparties;
• recording and analysis of any signals of possible links to sanctioned persons;
• a documented response to the risk of sanctions evasion.

Bank trust and licenses

When onboarding clients from the CIS/Asia, European banks primarily look at:

• the transparency of the origin of funds;
• the business history in other jurisdictions;
• the presence of structured EU business due diligence and internal AML controls.

Checklists and templates

Checklists and templates help quickly move from theory to practice and structure work without unnecessary guesswork. In this section you will find ready-made templates and visual checklists for quick diagnostics, starting with “Table 1. Quick diagnosis of red flags”.

Quick diagnosis of red flags

Table 2: Documents for review

Steps when notified of an unscheduled inspection

Frequently Asked Questions (FAQ)

What should you do if a competitor files a complaint?

How can you show the company is not a fly-by-night operation when the staff is small?

How quickly can you fix an anomaly in the registry?

Do you need to notify the bank about a restructuring?

Examples of before-and-after scenarios

One of COREDO’s illustrative cases: before the project, the client had a complex structure with several holdings in different jurisdictions and received repeated requests from the bank.

In another project, after implementing compliance procedures at the logistics operator, the regulator completed the inspection without sanctions, and the counterparty abandoned the idea of renegotiating prices due to “regulatory risk”.

Resources and tools

When designing control systems at COREDO, we rely on:

• recommendations of the FATF on AML and sanctions compliance;
• EU directives (including 5AMLD) on beneficial ownership registers and supervision;
• international and local sanctions lists;
• specialized automated risk-monitoring systems that integrate with internal registries and accounting systems.

Key takeaways and a 30/90/180-day plan

To avoid getting bogged down in details, I propose a simple action plan.
For 30 days

• Conduct a rapid audit: a high-level review of the company and key counterparties.
• Assemble a ‘review box’ with the key documents.

For 90 days

• Implement basic KYC/AML policies and sanctions screening.
• Start regular monitoring of registers and key due diligence red flags.

For 180 days

• Conduct in-depth strategic due diligence across the group of companies.
• Test the interaction scenario with regulators and banks.

Short appendix templates

Appendix A. Basic template of a letter responding to an inspection notice

Dear Sir or Madam,

We acknowledge receipt of the inspection notice dated [date, number].

Our company is ready to provide the requested documents and information within the specified timeframe. Contact person for coordination: [Full name, position, contact details].

If clarification of the scope of the requested information is required, please send additional explanations.

Sincerely,

[Name, position]

Appendix B. Short questionnaire for internal diagnosis of red flags

1. Does the company have a shared address or address overlaps with dozens of other legal entities in sensitive sectors?
2. Has sanctions screening of UBOs, directors and key counterparties been conducted in the last year?
3. Have persistent inconsistencies been observed in reporting between tax and corporate data?
4. Is there a formal whistleblowing policy and a clear channel for employee and client complaints?
5. Has Red Flag Due Diligence of key counterparties and of the company’s own group of companies been conducted in the last 12 months?

I often ask clients the question: are you ready to build capitalization and a brand on a jurisdiction that investors and banks have only heard about in news reports of investigations? If the answer is “probably not”, then the approach of “quickly and cheaply registering a company where they issue any crypto license” no longer works.

In this guide I examine how a founder and CFO can step-by-step approach choosing a jurisdiction for a crypto business in order to take into account:

• requirements for regulation of cryptocurrencies and digital assets;
• sanction risks of the crypto project and founders’ background;
• access to banking and payment providers;
• tax model and operating costs;
• future token listing and investor expectations.

I suggest you read the material to the end, because this is not a review of “countries on the map”, but a practical route: from strategic criteria to a launch checklist taking into account the experience of COREDO in the EU, Asia and friendly offshore jurisdictions.

Choosing a jurisdiction for a crypto business

Step 1: Choosing the jurisdiction for a crypto business determines the project’s legal status, its tax burden and access to banking infrastructure, so it is important to approach this stage systematically and rely on key assessment criteria. First of all, it is worth understanding which countries can really be considered crypto-friendly jurisdictions, how mature their regulatory framework is and how exactly the regulation of cryptocurrencies is built.

Crypto-friendly jurisdictions

The first filter when choosing is the maturity of the legal environment. Crypto-friendly jurisdictions today are not only low taxes, but also predictable regulation of cryptocurrencies and digital assets, clear licenses for VASP (Virtual Asset Service Provider) and a practiced regulator approach.

In the EU this framework is MiCA: unified rules for token issuers, wallet providers, exchanges and other VASPs, with an emphasis on crypto investor protection and transparency. In Singapore a similar role is played by the Payment Services Act and MAS’s approach to FinTech and crypto licenses, and in Dubai — the VARA regime with a focus on Web3 and tokenized assets. These regimes give business the main thing: a clear legal framework for tokens and blockchain products.

In practice at COREDO we start by assessing three aspects of the regulatory environment:

• whether there is a separate regime for VASP and tokens;
• how stable digital asset regulation has been over the last 3–5 years (without sharp bans and moratoria);
• whether the real practice of the financial regulator is clear: timelines, documentation requirements, degree of “business orientation”.

Jurisdictions with an immature framework often look attractive in terms of cost, but create problems when scaling and trying to enter the EU or major Asian exchanges.

Taxes for crypto business and ROI in low-tax zones

The second layer is taxes for the crypto business and the expected ROI from the structure. A formal zero tax rarely means maximum benefit: investors and banks carefully look at how much the model matches the real geography of teams, users and flows.

In practice, structuring part of R&D in the EU with access to intellectual property benefits sometimes gives a higher ROI from choosing a low-tax crypto jurisdiction than a “pure” offshore that later slows down listings and banking relationships.

VASP license and AML in crypto

The third basic criterion: the VASP regime and requirements for AML compliance in crypto. Today, for exchanges, custodians, brokers and even some DeFi projects, the road to major banks and exchanges is effectively closed without a built AML/KYC model.

Ignoring these aspects at the start results in blocks, refusals to open accounts and the need for urgent redomiciliation. That is why at COREDO we build the AML architecture into the project from the start, not “at licensing”.

Summary table of criteria

Best jurisdictions for a crypto company

Step 2: best jurisdictions for crypto to register a crypto company: it is a choice not only of country but also of regulatory model, level of investor protection, tax burden and licensing requirements. Below we will review the best jurisdictions for registering a crypto business in the EU, compare types of crypto licenses and the approximate entry cost so you can choose the optimal option for your project format and budget.

Best jurisdictions for a crypto license in the EU

A pool of countries is currently forming in the EU that combine a clear crypto license, a VASP regime and an acceptable cost of crypto registration in the EU. In practice COREDO most often works with the following options:

• Estonia – fast and digital process, clear capital and office requirements, regulator experience with VASP. For many projects this is the basic entry point to the EU with an emphasis on transparent AML for crypto companies.
• Lithuania, one of the most affordable VASP jurisdictions in the EU in terms of cost, while the regulator is gradually tightening requirements and improving its reputation.
• Cyprus and Slovakia are interesting for structures with a more complex group of companies, combining a financial and technological profile.

For entrepreneurs the key question is not only “where is it cheaper”, but also which countries investors recognize as the best jurisdictions for registering a crypto business in the EU from the perspective of future listing and access to institutional investors.

Crypto license in Asia: costs and timelines

Asia remains one of the most attractive directions for crypto and Web3 due to the combination of markets, infrastructure and regulatory flexibility. The most frequent request to the COREDO team is a comparison of Singapore and Dubai in terms of crypto licensing EU/Asia, timelines and the subsequent business life.

• Singapore: strong brand, MAS as a strict but predictable regulator, developed startup blockchain infrastructure, access to funds and qualified personnel. Licensing costs and capital requirements are higher than in most EU countries, and timelines can stretch to several months. Still, it is a jurisdiction favored by institutional investors.
• UAE (including Dubai): truly low or zero taxation of crypto income, a rapidly developing VARA regime, focus on Web3 projects and tokenization. In several free zones a flexible FinTech crypto license is combined with acceptable substance requirements.

Tax incentives and crypto accounts in Africa and offshore jurisdictions

A separate block — offshore jurisdictions and some African jurisdictions that offer pronounced tax incentives for crypto projects in offshore jurisdictions and flexibility of corporate law. A typical example is the Cayman Islands or certain Caribbean jurisdictions.

Their strengths:

• flexible corporate and fund structures;
• possibility to issue tokens and funds;
• comfortable legal protection of property and assets.

Top 5 jurisdictions

Figures are given as guidelines. For real projects COREDO always prepares a separate budget taking into account the structure, license and operating model.

Plan for registering a crypto company and obtaining a license

Step 3: The step-by-step plan for registering a crypto company and obtaining a crypto license begins with a key decision — choosing the country where the business will legally operate and grow. At this stage it is important not just to pick a “convenient” spot on the map, but to build a strategy: from analyzing requirements and tax burden to the final submission of documents in the chosen jurisdiction.

Choosing a jurisdiction: step by step

To prevent the step-by-step selection of a crypto jurisdiction from becoming guesswork, I suggest using a sequential algorithm that the COREDO team has honed in dozens of projects:

1. Strategic goal: where you expect to have customers, the team, investors and exchanges in 3–5 years.
2. risk assessment: sanctions, founders’ citizenship and residency, industry, sources of funds.
3. Functional division: where it makes sense to keep IP, where the operational center should be, and where the fund-holding structure should be.
4. Comparison with available crypto-friendly jurisdictions and their VASP regimes.
5. Financial calculation: taxes, compliance, a showcase for investors and banks.
6. Choosing and securing the target jurisdiction, legal form, and licenses.

This approach helps avoid a situation where, a year later, you have to “save” the project by re-domiciling and a painful migration of infrastructure.

VASP registration in Europe, AML and KYC

For Europe, a typical step-by-step plan for VASP registration looks like this:

• Assessment of founders’ background and sanctions.
  COREDO initially conducts a sanctions and reputational screening: we check citizenship, residency, ties to sensitive jurisdictions, sources of capital. This allows us to choose in advance a country where the risk of refusal is minimal and to properly build communication with the regulator.
• Choice of structure: DAO, Web3 structure, traditional legal entity.
  If the project is built around a DAO, it is important to correctly formalize the DAO’s legal structure for the crypto project: often this is a combination of a foundation, an operating company, and agreements between participants. For traditional exchanges and brokers a VASP company with transparent participants is sufficient.
• Preparation of whitepaper legal design.
  Legal analysis of tokenomics, token functions, and investors’ rights. Here COREDO builds the token’s legal framework: we determine whether the token is a utility token, where elements of a security emerge, and how this affects token listing on exchanges and reporting.
• Company registration.
  The stage at which directors, shareholders, the charter, corporate governance and decisions on confidentiality of beneficiary data are chosen, taking into account the requirements of the specific country.
• Obtaining a VASP license.
  Preparation of the document package, policies and procedures, business plan, and financial model. In the EU the emphasis is placed on detailing services, IT architecture and AML/KYC processes.
• Integration of crypto AML compliance.
  Setting up KYC processes, transaction monitoring, sanctions filters, and investigation procedures. For banks and exchanges the presence of such a system becomes a trust factor, and for investors a maturity criterion.
• Testing access to payment providers and banks.
  In COREDO projects this step runs in parallel with licensing: we pre-test payment providers, access to fiat-crypto conversion, account opening and integration with selected exchanges.

How to open a bank account for a crypto company

One common client question: how to open a bank account for a crypto company if the profile is VASP. Here the key role is played not so much by the country as by the combination of:

• the reputation of the jurisdiction;
• the quality of AML/KYC;
• the transparency of the corporate structure.

The choice of jurisdiction also affects token listing: many major exchanges prefer projects from countries with predictable regulation and clear legal qualification of the token. For several COREDO clients the optimal route looked like this: IP and token issuer in one European country, the operational VASP in another, and the token-holding fund in a trusted offshore. This approach reduced risks and simplified communication with exchanges.

Risks in choosing a jurisdiction for a crypto project

Step 4: Risks and how to avoid them when choosing a jurisdiction for a crypto project — this is not about formalities, but about the project’s survival under sanctions, regulatory uncertainty and cross-border requirements for founders. Choosing the right country of incorporation and taking into account the citizenship of key persons makes it possible to minimize sanction risks in advance and avoid account freezes, bank rejections and restrictions for users.

Sanctions risks to a crypto project due to founders’ citizenship

Sanctions risks for a crypto project are a separate area that entrepreneurs often underestimate. Regulators, banks and exchanges look not only at the country of registration, but also at:

• the citizenship and residency of the founders;
• the country of origin of the capital;
• key markets and partners.

Risks of a jurisdiction without AML compliance

Choosing a country where AML requirements can be formally ignored provides short-term savings but creates long-term limitations:

• major exchanges do not accept such projects without extensive legal work;
• banks either refuse entirely or require complex structural solutions;
• there may be fines and bans on operations in the EU and in several Asian countries.

Long-term consequences for investors

Institutional investors, funds and large private participants view jurisdiction as an indicator of risk management maturity. The reputation of a crypto jurisdiction directly affects:

• investor entry terms;
• project valuation;
• the prospects for subsequent rounds and token IPO/listing.

Answers to the target audience’s questions: case studies

In this section you will find answers to the key questions of the target audience about how choosing a low-tax jurisdiction for crypto assets works in practice: from ROI calculations to legal and operational nuances. Based on practical case studies and recommendations, we will analyze when changing jurisdiction truly pays off and which pitfalls are often ignored at the planning stage.

ROI of a low-tax jurisdiction for crypto

• the cost of obtaining and maintaining a license;
• substance-related expenses (office, director, staff);
• the discount investors may apply because of the jurisdiction;
• the effect on valuation multiples.

Does a jurisdiction’s reputation affect token listing?

Yes, directly. Exchanges and investors assess:

• the stability and transparency of regulation;
• the presence of a clear regime for tokens and VASPs;
• the regulator’s willingness to cooperate with international authorities.

How to integrate AML/KYC into a crypto business?

AML/KYC integration should not be done just to tick a box, but as part of business logic. In practice, COREDO builds:

• a risk-based approach to customers;
• combining on-chain analytics with traditional KYC procedures;
• role separation between the product and compliance teams;
• processes for rapid response to incidents and regulator requests.

Crypto project launch checklist

Ниже: сжатый чек‑лист, который команда COREDO использует как основу для планирования проекта с учетом сроков и ответственных:

На практике COREDO подключает к этому плану дополнительные блоки по защите IP, конфиденциальности инвесторов и структурированию фондов, но даже этот базовый список помогает избежать большинства критических ошибок.

Key takeaways and steps

• The jurisdiction of a crypto project is not a mere registration formality but a platform for growth, attracting investment, and asset protection.
• Today’s priority: jurisdictions with mature regulation (EU, Singapore, UAE) that provide a balance between taxes, compliance, and access to infrastructure.
• registering a crypto company without a well-designed AML/KYC and VASP framework creates short-term savings and long-term constraints.
• A structure that accounts for DAOs, funds, and IP structures allows tax optimization and increases resilience to regulatory changes.
• Banks, exchanges, and investors look not only at the country of registration but also at the quality of risk management processes.

If you are at the stage of discussing with partners “where to register the company and obtain a crypto license”, it makes sense to involve experts at this point. The COREDO team helps to go through all stages: from the strategic choice of jurisdiction and structure design to licensing, AML setup, and account opening. This significantly reduces time-to-market and lowers the cost of potential mistakes.

In 2023–2024 global regulators recorded a historic high in fines for AML violations/CFT: aggregate amounts for banks and fintechs were measured in billions of dollars per year. At the same time, the EU is launching a single AMLR (EU AML Regulation, Single Rulebook) and creating the supranational AML agency AMLA, while in Asia and the CIS regulators are aligning requirements with FATF recommendations.

In such an environment any financial institution, whether a bank, payment system, crypto platform or international holding, no longer asks “do we need AML services”, but a question of survival: how to design AML for financial institutions so that it does not destroy the business model, but strengthens it.

I keep seeing the same picture: locally “closed” requirements in a single country, but fragmented processes, conflicts between jurisdictions and manual AML KYC procedures that do not withstand growth and regulatory scrutiny.

In this article I will break down how the key international AML requirements look in 2025, how AML standards in Europe, Asia and the CIS differ, and how to practically build an operational AML compliance that withstands inspections, scaling and digital business models. If you read the material to the end, you will have a framework for a strategy and a checklist by which the team can plan the implementation or rebuilding of its AML system.

International AML Standards and Regulations 2025

Global framework: FATF, 6AMLD, AMLR and AMLA

In Europe in 2025 the key roles are played by:

• 6AMLD (Sixth Anti‑Money Laundering Directive) – expands the list of predicate offences, strengthens personal liability and the coordination of investigations into money laundering and terrorist financing.
• AMLR (EU AML Regulation): a single directly applicable regulation, effectively a Single Rulebook, equalizing AML standards across all member states: uniform rules for KYC, AML transaction monitoring, identification of beneficiaries, AML reporting and sanctions.
• AMLA (European Anti‑Money Laundering Authority) – a new supranational supervisory body that takes direct control over the largest cross‑border banks, payment groups and crypto providers.

For businesses this means: less regulatory arbitrage within the EU and far stricter, but more predictable, supervision.

Key changes to AML requirements in the EU from 2025

In conversations with clients from the EU I always start with one thing: “your AML model in 2023 and your AML model in Europe 2025: these are already two different systems”.

Key shifts:

1. 6AMLD and AMLR: focus on outcomes, not formalities
   6AMLD expands the list of predicate offences (corruption, tax crimes, cybercrimes, environmental crimes, etc.) and strengthens cross‑border prosecution. For financial institutions this means the need to analyse the origin of funds and the logic of transactions more deeply, rather than limiting themselves to formal KYC.
   AMLR, in turn, consolidates requirements into a single set of rules: EU AML regulations cease to be a patchwork of directives, and the regulators’ risk appetite becomes more understandable, but also less flexible.
2. AMLA and a new level of supervision
   The creation of the EU AML agency AMLA changes the approach to control: the largest groups will be directly supervised by the agency, with unified AML stress‑tests, regular inspections and a pan‑European view on AML reporting and fines.
   For top players this means that the AML compliance officer function should operate at the group level, not at the level of individual countries.
3. New KYC/KYT and Continuous KYC
   Regulators are promoting the idea of continuous AML client verification (Continuous KYC): one‑time identification is no longer considered sufficient.
   In COREDO practice this is expressed in clients moving to:

   • combining digital onboarding, AML digital onboarding and eKYC,
   • regular reviews of the risk profile,
   • implementing a KYT approach through transaction monitoring systems that track customer behaviour, not just one‑off transactions.
   Attention to PEPs, complex trust structures and the quality of AML reporting (Suspicious Activity Reports: SAR) is increasing: regulators assess not only the presence of SARs but also their content and timeliness.

AML regulations and practice in Asia and the CIS

In several Asian financial centres requirements for AML for financial institutions are being strengthened, including:

• mandatory implementation of a risk‑based approach when assessing clients and products;
• emphasis on continuous AML KYC for high‑risk segments;
• requirements for AML automation and data storage for subsequent analysis and inspections.

Implementation of AML services in financial institutions

The effectiveness of service implementation and the real reduction of risks for a financial institution depend on how the compliance function architecture is organized, how tasks are allocated between the lines of defense and how AML processes are integrated into the operational framework.

The role of the AML compliance officer and architecture functions

In my experience, a strong AML officer:

– is responsible for the methodology of the risk‑based approach and the risk matrix for clients, products and geographies;
– establishes engagement with regulators, including AMLA, central banks and financial supervisory authorities;
– manages SARs and internal investigations;
– defines requirements for AML automation and process optimization and technology selection.

KYC, KYT, digital onboarding and eIDAS

The operating model usually includes:

– remote identification using video‑KYC, biometrics and document verification through external providers;
– use of eIDAS standards (EU electronic identification) for clients from the EU;
– integration with government registries (company registers, beneficial owner registers, sometimes tax registers), i.e. AML integration with government registries.

Automation and technology: from AI to FHE

Key areas:

• implementation of transaction monitoring systems using AI and machine learning in AML;
• application of AML systems with machine learning and graph neural networks (GNN) to detect complex transaction networks and non‑trivial money‑laundering schemes;
• use of AML monitoring for unusual patterns to find anomalies in customer behavior, not only by static rules;
• pilots using homomorphic encryption (FHE) and advanced methods of AML data governance and privacy, allowing analysis of data in encrypted form and reducing leakage risks.

Best practices in AML monitoring and reporting

1. Continuous monitoring and Continuous KYC
   The system must track not only one‑off events but also changes in the client’s profile: sources of funds, geography of operations, changes in behavioral patterns; this is the foundation of AML continuous KYC.
2. High-quality reporting and sanctions handling
   • AML reporting (SAR) should be generated by clear triggers, have a clear structure and be accompanied by internal investigation documentation.
   • AML filters for sanctions lists and PEP lists should be updated daily, taking into account local and international lists.
   • Using AML white/black lists (Allow/Deny Lists) helps reduce repeated alerts for verified customers and, conversely, block known offenders.
3. Risk‑based approach and risk management
   AML risks and assessment should be quantitatively measurable: each client, product and region has its own scoring profile, which affects the depth of checks, monitoring frequency and trigger thresholds.

AML compliance specifics for cryptocurrencies

Key elements of AML requirements for the crypto business in 2025:

• strict AML KYC procedures for all clients, including retail;
• use of KYT tools for blockchain transaction analysis;
• AML policies under the MiCA Regulation (Markets in Crypto‑Assets), including oversight of wallet providers and stablecoins;
• focus on AML in fintech and crypto business as a high‑risk area for terrorism financing and sanctions evasion.

Scaling and Optimization of AML in Finance

Typical risks clients bring to COREDO:

• duplication of processes and data across different jurisdictions;
• incompatible transaction monitoring systems in subsidiaries;
• lack of a unified approach to AML, sanctions and fines, and internal investigations.

AI automation and reducing false positives

The technology component delivers a noticeable impact here:

• AML automation relieves the first line (front office, operations);
• AML technologies and AI increase detection accuracy and adapt to new schemes;
• how AML systems adapt to new laundering schemes with AI — through self‑learning models, analysis of atypical transaction routes and GNN.

Assessing AML effectiveness and ROI

• share of cases processed automatically;
• ratio of false-positive alerts to confirmed incidents;
• response time to suspicious transactions;
• reduction in regulatory findings and absence of material fines;
• impact on customer experience (onboarding speed, number of rejections without objective grounds).

The role of the AML compliance officer in international organizations

Key tasks:

• synchronize local teams with the requirements of HQ and international regulators (including the EU AML agency AMLA);
• establish a unified approach to AML and risk management in financial institutions;
• prepare the business for inspections and stress scenarios related to AML, sanctions and fines.

Key findings and recommendations for entrepreneurs

1. Formulate a target AML compliance model
   • Determine which international AML requirements apply to you (FATF, 6AMLD, AMLR, MiCA, local laws).
   • Approve a unified risk appetite and an AML risk and governance matrix.
2. Rebuild KYC/KYT and Continuous KYC processes
   • Implement AML digital identification, digital onboarding and eKYC using eIDAS and registry integrations.
   • Update AML KYC procedures taking into account new EU and Asian requirements, including working with PEPs and complex structures.
3. Invest in technology and data architecture
   • Choose a platform for transaction monitoring systems that supports AML solutions with machine learning, GNNs and flexible rule configuration.
   • Ensure AML data governance and privacy, and consider potential use of FHE and other protective technologies.
4. Ensure mature reporting and engagement with regulators
   • Set up processes for SARs, sanctions screening and internal investigations.
   • Prepare a dialogue strategy with AMLA and national regulators, especially if you are a cross-border group.
5. Choose a reliable AML services partner

If you feel that your current AML framework does not meet the challenges posed by the new regulatory cycle, this is a good time to conduct a diagnosis and build an updated strategy – drawing on international standards and the practical experience of those who have already gone this way.

I regularly see the same scenario: the parties agree on the price, specify the delivery, sign the contract, but when settling accounts a “minefield” begins — prepayment, postpayment, guarantee letters, bank guarantees, letters of credit. Result: the deal is delayed or goes to arbitration.

Ready to look at escrow not as an abstract legal term but as a practical tool for risk management and liquidity control? In this article I will examine how escrow works in international transactions, which legal and AML aspects need to be considered, how it aligns with company registration in the EU and Asia, and what practical steps your business should take to use this instrument strategically rather than formally.

What is escrow and how does an escrow account work in settlements?

If simplified, escrow is a mechanism in which money or assets are temporarily transferred to a neutral third party until the parties fulfill the pre-agreed conditions. It is a conditional deposit recorded in a tripartite agreement between the seller, the buyer and the escrow agent.

Basic escrow structure

The classic model includes three elements:

• Escrow account (escrow account for companies) at a bank or with a licensed provider – the transaction amount is deposited into it.
• Escrow agreement: details the conditions under which funds are “released” and transferred to the seller or returned to the buyer.
• Escrow agent (third party) oversees the fulfilment of the contract terms, holds the funds (funds are blocked), keeps records and initiates payments.

How an escrow account works in international trade

In practice, the mechanism of an escrow account in international trade looks like this:

1. Negotiations and deal structure.
   • The parties agree on the subject, price, delivery schedule, deadlines and the form of performance confirmation (bills of lading, acceptance certificates, independent inspector reports, registration of ownership, etc.).
2. Conclusion of the tripartite agreement.
   • An escrow agreement is signed, which specifies:
   • conditions for depositing and blocking funds;
   • the set of documents confirming the fulfilment of obligations;
   • the procedure and timing of payments;
   • the escrow agent’s fee;
   • the dispute resolution procedure and the applicable international law and escrow (which jurisdiction governs the relationship).
3. Transfer of funds to the escrow account.
   • The buyer transfers the money to the bank escrow account or to a specialized account of a financial provider. The funds are debited from his operating account but are not yet available to the seller.
4. Performance of contractual obligations.
   • The seller delivers the goods, performs the work or transfers an asset (for example, company shares, real estate, intellectual property rights).
5. Confirmation of fulfilment of conditions.
   • Documents predetermined by the agreement are sent to escrow: shipping documents, quality certificates, an extract from the real estate register, an extract from the commercial register (in the sale of a company), reports of independent inspectors.
6. Release of funds and payment automation.
   • The escrow agent checks the documents, performs additional KYC/AML analysis if necessary, and initiates the transfer of funds to the seller in full or in stages (important for multi-stage international contracts). Payment automation is often used here, especially in FinTech projects and investment schemes with tranches.
7. Closure of the escrow account and reporting.
   • After all conditions are met, the agreement is considered complete, the escrow account is closed, and the parties receive final reports – important for financial reporting and audit.

Legal support for transactions via escrow

In COREDO’s practice, it is precisely the legal support for companies and escrow transactions that determines whether escrow will be a protection or a source of new risks.

A well-drafted escrow agreement: how it is structured

A properly structured escrow agreement always answers four key questions:

1. What exactly is being deposited.
   • Funds, securities, tokens, claims, company shares. In transactions with digital assets we often build a hybrid scheme: funds in a bank escrow account, and digital assets in a controlled wallet with a pre-determined unlocking algorithm.
2. When and under what conditions performance occurs.
   • Execution criteria are clearly specified: «confirmation of registration of title in registry X has been received», «an acceptance certificate for the works has been signed without reservations», «a report from an independent inspector confirming the fulfilment of KPIs has been received».
3. How legal risks are allocated.
   • The legal liability of the parties and of the escrow agent itself is described, standards of care and checks (due diligence), and the procedure to follow in case of conflicting documents.
4. How disputes are resolved.
   • Jurisdiction, an arbitration clause, and the applicable law are specified: this is especially important for litigation in international disputes.

Registration of legal entities in the EU and Asia with escrow

In many cases, having a local company in the EU or Asia is optimal for working with escrow. This provides:

• access to local banks and a bank escrow account;
• predictable taxation of international transactions;
• convenience in terms of corporate law and arbitration.

Escrow, international law and AML compliance

Today any serious escrow provider works in close coordination with:

• AML (anti-money laundering) requirements;
• sanctions control regimes;
• KYC/sanctions screening standards.

The solution developed by COREDO for clients with multiple legal entities in the EU and Asia typically includes:

• alignment of compliance in international transactions (group AML policies and sanctions policies);
• choice of jurisdiction with predictable international financial regulation regarding escrow;
• setting up internal procedures so that escrow is organically integrated into your overall risk management and internal control system.

Use of escrow in international transactions

Use of escrow in international transactions: sectors and specifics is particularly in demand where parties are in different jurisdictions, handle large sums and require additional guarantees of contractual performance. This is most evident in real estate transactions in the EU and Asia, where escrow helps record agreements, protect the buyer’s funds and structure settlements taking into account local legal specifics.

Real estate in the EU and Asia

The specifics of using escrow in real estate transactions in the EU have long become standard: funds go into an escrow account until:

• the buyer’s ownership rights are registered in the state registry;
• all encumbrances are removed;
• the necessary authorizations from authorities are obtained.

In some Asian countries the structure is similar but is supplemented by checks for compliance with local restrictions for foreigners and urban planning regulations. The COREDO team has supported such transactions for clients acquiring properties both for their own business and for investment.

Investment projects and transactions in Asia and Africa

Escrow for investment projects in Asia and Africa is especially useful when:

• investments are made in tranches as KPIs are met;
• political or regulatory risks arise;
• the project involves multiple investors from different countries.

Equipment and intellectual property

In deliveries of complex equipment, escrow in international payments works well when:

• deliveries are made in multiple batches;
• factory acceptance tests and commissioning are required;
• an independent inspector is involved.

In IP transactions (licenses, patents, software), a model is more often used where escrow and intellectual property protection are combined: code or documents are delivered to a third party for safekeeping, and payments are tied to rights registration, source code transfer or achievement of certain metrics.

E-commerce and digital contracts in FinTech

COREDO is particularly interested in the following in e‑commerce and FinTech:

• escrow and digital contracts (smart contracts, electronic signatures, online KYC);
• integration of escrow into marketplaces’ payment gateways;
• escrow solutions for e‑commerce and transactions with digital assets.

Advantages and risks of escrow in international business

The advantages and risks of using escrow in international business are directly related to managing trust and security in deals between companies from different jurisdictions. Such a mechanism helps reduce legal and financial uncertainties, but at the same time introduces operational and reputational risks that are important to understand before launching an escrow scheme at the international level.

Key advantages

For an owner and CFO what matters are not abstract ‘benefits’ but manageable effects:

• Security of international transactions.
  Funds are not released to the counterparty until the conditions are met and confirmed. This is critical for foreign trade operations and M&A.
• Escrow advantages for reducing risks in foreign trade operations.
  Reduces the risk of non-delivery, delivery of substandard goods, and unilateral refusal to perform.
• Financial security of transactions and liquidity management.
  You plan in advance what amount of liquidity will be ‘blocked’ and for how long, and this can be correctly reflected in liquidity management and financial planning.
• Transparency and control over contract performance.
  A clear set of documents tied to payments disciplines both parties and reduces room for interpretation.

Risks and limitations

At the same time, escrow is not a ‘magic pill’. COREDO’s practice shows several typical risks:

• incorrectly drafted or vague escrow agreement terms;
• choosing a jurisdiction with unpredictable case law;
• ‘narrow’ scope of the escrow agent’s duties, not covering the real risks of a dispute;
• lack of synchronization with tax and currency regulation.

All of this is reflected in the financial statements, can distort the picture of the company’s liabilities and, in some cases, complicate audits.

Escrow, ROI and scaling international transactions

The use of escrow, especially when scaling international transactions, affects:

• the speed at which counterparties make decisions (escrow increases trust);
• the margin structure (agent’s fee vs reduced risk of losses);
• ROI when scaling business in Asia and the EU due to predictability of settlements and reducing the ‘counterparty factor’.

Working with escrow in international transactions

In international transactions, working with escrow helps reduce legal and financial risks, but in practice the instrument proves effective only with proper organization of the process. In these practical recommendations on working with escrow in international transactions we will examine what to pay attention to when choosing terms, checking documents and, first and foremost, how to correctly choose an escrow agent.

How to choose an escrow agent?

Practical criteria I always consider:

• license and status (bank, payment organization, specialized provider);
• experience in your industry and types of transactions;
• a clear model of liability and professional liability insurance;
• transparent fees and a logical mediation scheme in settlements;
• competence in compliance for international transactions and AML.

Documents required to open an escrow account for a legal entity

A standard package includes:

• company incorporation documents;
• information about beneficial owners;
• description of the transaction and the parties;
• draft of the main agreement and the escrow agreement;
• internal AML/compliance policies (for large entities).

How to draft an escrow agreement for a transaction

I advise clients to include at least the following sections:

• clearly described subject matter and deposit amount;
• conditions and format for confirmation of performance;
• timelines and notification procedures;
• the law applicable to the escrow agreement and arbitration/court;
• procedures in case of a dispute or incomplete performance;
• allocation of tax and commission expenses.

What to do if the terms of the escrow agreement are breached?

The “what to do if the escrow agreement is breached” scenario should be set out from the start:

• procedure for filing objections;
• the period for which the hold on funds is extended;
• the possibility of going to court/arbitration and consequences for the funds in the account;
• the competence and liability of the escrow agent in the event of conflicting instructions.

Escrow and integration with AML and compliance

Escrow accounts are becoming a key security tool in international transactions, but their effectiveness directly depends on proper integration with AML, compliance and international regulatory requirements. Without this integration even the most reliable escrow becomes a vulnerable link in the chain of financial operations.

AML and compliance in international transactions

In the modern paradigm one cannot consider escrow separately from:

• global AML standards (FATF, regional directives);
• sanctions and reporting requirements;
• the group’s internal policies.

International financial regulation and standards

Different jurisdictions regulate escrow accounts for companies differently, but several trends are common:

• increased requirements for disclosure of beneficial owners and sources of funds;
• strengthening of international standards on reporting and information exchange;
• integration of escrow into regulatory frameworks for FinTech and digital assets.

Escrow against fraud and money laundering

If the structure is set up correctly, escrow helps to:

• exclude schemes with deliberately fictitious deliveries;
• minimize the risk of involvement in money laundering;
• reduce the likelihood of legal disputes by ensuring transparent control over contract performance.

Key takeaways and practical steps for businesses

In summary, escrow in international financial transactions is:

• a practical tool for the financial security of transactions and for managing contractual risks;
• a way to strengthen trust with new partners, especially in settlements between companies from different countries;
• an element of your strategy for scaling international transactions and protecting ROI.

A practical checklist that I recommend to owners and CFOs:

1. Identify which types of transactions (real estate, equipment, investments, digital assets) escrow will have the most impact on.
2. Agree internally on the approach to selecting jurisdictions and escrow agents.
3. Synchronize escrow with the registration of legal entities in the EU and Asia, tax planning and financial reporting.
4. Update internal AML and compliance policies to reflect the use of escrow.
5. Set up standard escrow agreement templates for different scenarios and transaction amounts.

If you plan to expand the geographic scope of your business or enter jurisdictions new to you, it makes sense to integrate escrow into the payment architecture in advance – it will save you time, money and nerves at the stage when the stakes are already too high.

MSB License and Choosing a Jurisdiction: What Matters?

The right choice of jurisdiction directly affects the complexity of the licensing process, the range of available services and the speed of market entry.

Definition and Functions of an MSB License

• currency exchange and transfers;
• issuance and redemption of electronic money;
• international payment operations;
• payment processing services and safeguarding client funds;
• certain models of dealing with digital currencies and crypto‑fiat exchange.

The Impact of Jurisdiction on Legality and Operations

• access to legal protection of international payments;
• banks’ attitude toward your business;
• the possibility of cross‑border scaling;
• the cost of compliance and operational risks in different jurisdictions.

The Role of AML and KYC in MSB Licensing

• the development and implementation of internal control policies and transaction monitoring;
• procedures for identifying clients and beneficiaries;
• reporting systems for suspicious transactions and international transfers;
• the appointment of responsible persons (AML officer, compliance officer), in some cases: country residents.

Comparison of MSB licensing requirements in Canada, the USA and the UK

MSB license in Canada

Key features:

• Regulator and registration process. Registration is conducted online, the company is entered into FINTRAC’s registry, a detailed description of the business model, AML policies/KYC, information about beneficiaries and key persons are submitted. The COREDO team supports clients from the stage of registering a legal entity in the jurisdiction to responding to FINTRAC inquiries.
• Local MSB presence requirements. In some models it is allowed to operate without a full physical office; a virtual office for an MSB in Canada is possible. This reduces startup costs, especially for entrepreneurs from Europe and Asia.
• Minimum authorized capital. There are no formal capital requirements for basic MSB registration, which makes entry relatively accessible. Still, banks and partners assess real financial stability.
• AML/KYC and the role of an AML agent. The PCMLTFA and FINTRAC’s subordinate acts impose strict requirements for transaction monitoring, staff training, recording and data storage. We often help appoint and train a local AML agent to ensure compliance with requirements of FINTRAC and reduce the risk of fines.
• Timeframe for obtaining an MSB license in Canada. With proper document preparation, registration in the registry usually takes a few months. Complex structures involving cryptocurrency transactions require additional justification.
• Benefits for international business. The advantages of an MSB license in Canada for international business lie in the combination of flexibility, relatively moderate cost and good reputation. Companies with a Canadian license successfully enter European and Asian markets, building partnerships with payment systems and crowdfunding platforms.
• MSB vs FMSB. For non‑resident companies it is important to distinguish between MSB and FMSB (Foreign MSB). The FMSB license is intended for foreign providers that offer services to clients in Canada without physical presence. At COREDO we often compare for clients how to choose between an MSB and an FMSB license in Canada taking into account business structure and plans for local representation.
• Cryptocurrencies and the RPAA. A separate block: regulation of digital currencies and crypto transactions. RPAA (Retail Payment Activities Act) requirements are gradually strengthening oversight of payment systems. This affects fintech projects that combine classic transfers and crypto functionality, and requires a well‑thought‑out compliance model.

MSB license in the USA

• federal: through FinCEN and the Bank Secrecy Act (BSA);
• state level: each state may introduce its own licenses and requirements.

• Federal registration through FinCEN. Any company falling under the MSB definition must register with FinCEN and comply with the BSA requirements: develop a compliance program, appoint a responsible person, keep records and file SAR/CTR reports on suspicious and large transactions.
• Differences between federal and state MSB regulation in the USA. In some states separate money transmission licensing is required, and states establish their own capital and personnel requirements, reporting and local presence rules. This increases project cost and complexity.
• registration specifics for MSB in Montana. The state of Montana does not require a separate money transmission license, which makes MSB registration in Montana attractive from a cost perspective. At COREDO we have worked out structures for clients where Montana was used as a starting point with subsequent expansion, while paying special attention to compliance with federal requirements and proper positioning before banks.
• Local personnel and presence requirements. In most models local representation and employees in the USA are required. This affects the budget but increases trust from regulators and banks.
• Difficulties and how to overcome them. The main difficulties in obtaining an MSB license in the USA are related to:
  • the combination of federal and state requirements;
  • high expectations regarding the level of AML/KYC systems;
  • the conservative approach of banks to opening accounts for MSBs.

  Legal support for AML and licensing and well‑established internal control processes are critical here.

• Cryptocurrency operations. licensing specifics for MSB for digital currencies in the USA include requirements for crypto exchanges and exchangers. In some states separate crypto licenses are in force, and FinCEN treats them as MSBs with additional obligations.

MSB licence in the UK

• FCA (Financial Conduct Authority);
• PRA (Bank of England) – for certain models related to payment institutions and custody of funds.

• Regulators and the licensing process. The process is lengthy and detailed, often taking up to 12 months. The FCA analyzes the business model, funding sources, directors’ competencies, the risk management system and financial oversight and compliance.
• Personnel and office requirements. For a company with an MSB in the UK, having a real physical office and qualified local staff is critical. Regulations place high expectations on management experience and the internal control system.
• AML/KYC and reporting. UK regulators require advanced KYC procedures, transaction monitoring, regular reporting and, where necessary, independent audits. For a number of COREDO clients, the team built a comprehensive system based on modern AML platforms integrated into the company’s core system.
• Cost and timing of licensing. The cost of an MSB license in the UK and related expenses for compliance, staff and office are higher than in Canada and in most scenarios in the USA. At the same time, a UK license significantly increases confidence among international banks and investors.
• Tax and operational aspects. Tax aspects of an MSB in different jurisdictions often favor the UK if a company plans to accumulate profits in a stable and predictable legal environment. For some COREDO clients, this becomes a key argument in favor of London as a headquarters.
• Digital currencies and fintech. Features of MSB licensing for digital currencies in the UK include separate registration of crypto providers and stricter transaction control requirements. This complicates the launch but provides a high level of legitimacy.

Criteria for choosing a jurisdiction for an MSB license

Legislative requirements and regulations

• the depth and detail of AML requirements for MSBs;
• RPAA requirements in Canada and the BSA in the USA;
• reporting obligations for international transfers and suspicious transactions;
• requirements for internal control systems and transaction monitoring.

Operational and financial factors

• timelines and cost of MSB licensing in each country;
• requirements for a local office, local staff and representation;
• requirements for bank accounts for MSBs and the real practice of opening them;
• presence or absence of minimum statutory capital requirements.

Tax planning and legal support

• tax aspects of MSBs in different jurisdictions;
• possible tax incentives for international structuring;
• shareholder protection and legal safeguards for international payments;
• presence of bilateral agreements to avoid double taxation.

Scaling and international cooperation

• scaling of financial services;
• integration with international payment systems;
• international cooperation and investment;
• long-term sustainability and ROI when choosing a jurisdiction.

Practical recommendations for the MSB license

Preparation and submission of documents

• properly register the legal entity in the jurisdiction;
• collect a set of documents on beneficiaries, directors, and sources of funds;
• describe business processes and the money flow chain, and use clear terminology for the regulator.

Organization of local representation and personnel

• the actual level of presence in the country;
• the qualifications of directors, compliance officers, AML agents and staff.

Optimizing costs and licensing timelines

• take into account the processing times for an MSB license in Canada and the United Kingdom;
• plan expenses for lawyers, audits, and AML systems;
• take advantage of certain states, for example the specifics of MSB registration in Montana (USA), to minimize costs while remaining within federal regulation.

Post-licensing support and compliance

• stable internal control processes and transaction monitoring;
• regular reporting of suspicious transactions to FINTRAC, FinCEN and the FCA;
• updating policies to reflect changes in legislation;
• implementing modern transaction monitoring and risk management technologies.

MSB Licensing in Canada, the USA and the United Kingdom: comparison of parameters

Key findings and steps for entrepreneurs and executives

• Canada, the optimal balance of flexibility, cost and reputation for international fintech projects, especially at the launch stage and business model validation.
• USA, a logical step for companies targeting the largest consumer market and prepared to invest in complex multi-layered compliance.
• UK, a prestigious and strict jurisdiction that strengthens trust from banks and investors, suitable for mature projects and structures with a clear long-term strategy.

Practical steps I recommend to start with:

1. Honestly describe the business model, client geography and projected transaction volumes.
2. Assess key risks and AML/KYC requirements, including by client countries.
3. Compare not only the MSB license cost, but also the total operating expenses and staffing requirements.
4. Consider the long-term consequences of the MSB jurisdiction choice for the company’s financial resilience and scenarios for scaling into Europe and Asia.
5. Budget for post-license support: regular AML audits, policy updates, and team training.

Imagine: you have just closed a $100 million deal, but six months later half the proceeds go to taxes and fines because of an error in the fund’s structure. According to Preqin, nearly 40% of new Private Equity funds face serious legal and tax issues in the first 2–3 years, and in 70% of cases the reason is the wrong choice of jurisdiction.

This is a strategic decision that affects:

• the fund’s tax residency and the efficiency of the structure,
• access to institutional investors and family offices,
• the level of compliance and the risk of funds being frozen,
• the flexibility of the investment strategy and the ability to scale.

If you want your Private Equity fund to be not just registered, but built as a reliable, scalable, and attractive structure for investors: read to the end. This is a practical guide, not theory.

Criteria for choosing a jurisdiction for a Private Equity fund

When a client comes with the idea to create a fund, the first question we ask at COREDO is: “What is more important to you — minimal costs or maximum attractiveness to institutional investors?” The answer determines the whole approach to choosing a jurisdiction for the fund.

A mistake here can lead to:

• double taxation,
• investors refusing to participate due to weak legal predictability,
• problems with licensing the management company,
• freezing of accounts due to AML/KYC non-compliance.

Based on COREDO’s practice, the key selection criteria for the jurisdiction of a Private Equity fund can be grouped into four blocks:

1. Tax residency and tax planning of the fund
2. regulatory requirements and the legal framework
3. Corporate structure and legal predictability
4. Infrastructure: custodian, management company, banks

Let’s examine each of them in detail.

Fund tax residency and tax planning

A fund’s tax residency is not just “where we pay taxes,” but a key factor affecting the fund’s ROI and investment strategy. The impact of the tax regime on the choice of jurisdiction cannot be overstated.

In a Private Equity fund there are three main tax levels:

1. The fund as a legal entity
2. The management company (AIFM)
3. Investors (LP)

The goal is to minimize taxes at each level without breaching international AML/KYC standards and regulator requirements.

# How tax jurisdiction affects ROI

In 2024 PwC conducted a study on the efficiency of structures for Private Equity funds. It showed that the difference in net returns between an optimal and a suboptimal jurisdiction can reach 15–20% over the fund’s lifecycle. This is not “savings,” but a direct impact on ROI and the fund’s performance metrics.

COREDO’s practice shows: for funds with international investors it is optimal to combine an onshore jurisdiction for the fund (for example, Luxembourg, Ireland) and an offshore one for the management company. This allows:

• to preserve the fund’s tax residency in a jurisdiction with a strong reputation,
• to use tax benefits in offshore jurisdictions for the management company,
• to minimize the risk of funds being blocked due to “grey” jurisdictions.

# Practical tips for tax optimization

1. Assess investors’ taxes
If the majority of investors are from the US, EU or Asia, it is important to consider how the fund’s jurisdiction affects their taxation. For example, some jurisdictions may be classified as “passive” (PFIC) for US investors, which creates complications.

2. Use tax-transparent structures
For closed-ended funds in the EU, structures such as SICAV, FCP or LLP are often chosen, which are recognized as tax-transparent for tax purposes. This reduces the risk of double taxation.

3. Take into account local transaction taxes
In some jurisdictions there are taxes on the acquisition of shares, real estate or assets of portfolio companies. This directly affects deal costs and ROI.

4. Plan the exit strategy
The jurisdiction should be convenient for exiting investments: sale of shares, IPO, M&A. Taxes on capital gains, dividends and interest should be predictable and competitive.

Regulatory requirements and laws

The regulatory environment is the second most important criterion for choosing a jurisdiction for a Private Equity fund. It determines:

• requirements for compliance and KYC for funds,
• the need to license the management company,
• the level of transparency in the fund’s reporting,
• access to institutional investors.

Regulators in different regions approach Private Equity differently. Let’s review the key jurisdictions.

# ESMA, SEC, MAS, AFSA: how regulators affect the fund’s structure

• ESMA (EU)
  In the EU the AIFMD directive applies, which regulates alternative investment funds, including Private Equity. Key requirements:
  • registration or notification in the fund’s country of residence,
  • the presence of a qualified management company (AIFM),
  • requirements for the fund’s depositary,
  • strict rules on disclosure and reporting.

  For funds with institutional investors from the EU, registering the fund in the EU (Luxembourg, Ireland, Malta) is almost a requirement. This provides legal predictability and investor confidence.

• SEC (USA)
  The SEC regulates funds raising capital from the US. For Private Equity funds Regulation D, Regulation S and requirements for accredited investors apply. If you plan to attract institutional investors from the US, it is important to consider:
  • disclosure requirements,
  • restrictions on advertising and marketing,
  • reporting obligations.
• MAS (Singapore)
  MAS applies proportionate regulation: requirements depend on the size of the fund, the type of investors and the strategy. For qualified investors (QI)

requirements are less stringent than for retail investors. This makes Singapore an attractive jurisdiction for registering a fund in Asia.

# Proportional regulation and its impact on the fund

• Small funds with qualified investors may have simplified reporting and less stringent compliance requirements.
• Large funds with institutional investors fall under the full set of requirements, including audit, disclosure and transaction monitoring.

# Features of regulation in the EU, Asia and Africa

• EU
  The EU has a strong legal framework for closed- and open-ended funds, high legal predictability and strict transparency requirements. This makes the EU attractive for institutional investors but requires substantial compliance support.
• Asia
  In Asia (Singapore, Hong Kong, DIFC, AIFC) regulation is more flexible, especially for funds with qualified investors. This is convenient for funds targeting Asian markets but requires thorough Due Diligence on local requirements.
• Africa
  In Africa regulation is less unified, but there are promising jurisdictions (for example, Mauritius, South Africa). Registering a fund in Africa can be advantageous for investments in regional markets, but requires deep understanding of local legislation and case law.

Corporate structure and legal predictability

# Structure of a closed-ended fund vs an open-ended fund

• Closed-ended (closed fund)
  • Fixed life span (usually 5–10 years).
  • Investors contribute capital at the outset; exit: through asset sale or IPO.
  • Suitable for Private Equity, venture capital, buyout deals.
  • Requires a clear exit strategy and mechanisms to protect investor returns.
• Open-ended (open fund)
  • No fixed term, investors can enter and exit at any time.
  • Suitable for hedge funds and funds of liquid assets.
  • Requires high liquidity and strict cash flow management.

# Role of corporate agreements and shareholder agreements

Corporate agreements in a Private Equity fund are the foundation of the fund’s corporate governance and the protection of investors’ rights. Key documents:

• Fund charter / fund formation agreement
• Shareholders’ agreement (SHA)
• Investment memorandum
• Corporate agreements and shareholders’ agreements for portfolio companies

This is especially important for funds with family offices and club deals, where investors require a high degree of control and transparency.

# Licensing of the management company and choosing a custodian

The management company (AIFM): is the “brain” of the fund. Its Licensing is a critical stage:

• In the EU the management company must hold an AIFM license and comply with AIFMD requirements.
• In Asia (Singapore, Hong Kong, DIFC) the management company obtains a license to manage funds.
• In offshore jurisdictions the management company may be unlicensed, but this reduces attractiveness to institutional investors.

The custodian (or fund depositary) is the independent safekeeper of the fund’s assets. Its role:

• control over the assets,
• control over profit distribution,
• ensuring compliance and transaction monitoring.

Registration of a Private Equity Fund in the Regions

Теперь перейдем к практической части: как выглядит регистрация фонда в ЕС, Азии и Африке на примере конкретных юрисдикций.

Fund registration in the EU

Main jurisdictions

• Luxembourg
  • A strong legal framework for closed-end and open-end funds.
  • High legal predictability and case law.
  • Suitable for large funds with institutional investors.
• Ireland
  • Transparent tax system, tax-transparent status.
  • Good infrastructure: banks, custodians, Management companies.
  • Suitable for funds with investors from the US and the EU.
• Malta
  • More flexible requirements suitable for mid-sized funds.
  • Good infrastructure and regulator support.

# Procedures and requirements

• Registering a fund in the EU requires:
  • choosing a structure (SICAV, FCP, LLP, etc.),
  • appointing a management company (AIFM),
  • appointing a custodian,
  • preparing the investment memorandum and corporate documents.
• Reporting and compliance:
  • regular reporting to the regulator,
  • audit,
  • disclosure of information to investors.

Fund registration in Asia

Азия – ключевой регион для фондов, ориентированных на ростовые рынки, технологические компании и региональные сделки.

# Popular jurisdictions

• Singapore
  • Proportional regulation by the MAS, flexible requirements for qualified investors.
  • Good infrastructure: banks, management companies, custodians.
  • Suitable for fund registration, especially for IT companies and startups.
• Hong Kong
  • Strong financial infrastructure, access to Chinese markets.
  • High standards for compliance and KYC.
• ADGM (Abu Dhabi Global Market) and AIFC (Astana)
  • International financial centres with an English-language legal system.
  • Suitable for funds focused on the Middle East, Central Asia and international markets.

# Licensing and compliance specifics

• The management company must obtain a license to manage funds.
• AML requirements/KYC and compliance meet international standards.
• For funds with institutional investors, transparency of reporting and corporate governance is important.

Fund registration in Africa

Африка, перспективный, но сложный регион для регистрации фонда.

# Regulatory features and AFSA requirements

• There is no single regulator in Africa, but there are national regulators and international centres (for example, Mauritius, South Africa, ADGM).
• AFSA requirements for investment funds include:
  • the presence of a licensed management company,
  • custodian requirements,
  • strict AML/KYC and compliance rules.

# Advantages and risks

• Advantages:
  • access to growth markets,
  • tax incentives in some jurisdictions,
  • the ability to invest in regional projects.
• Risks:
  • weak legal predictability in some countries,
  • difficulties with banks and custodians,
  • high risks of funds being blocked due to AML/KYC.

Risk Management in a Private Equity Fund

risk management of a Private Equity fund is not just an ‘insurance’, but part of the investment strategy.

Investment Fund Due Diligence

Due Diligence is the basis for choosing the fund’s jurisdiction and structure. At COREDO we conduct comprehensive Due Diligence:

• Legal Due Diligence
  • Analysis of the jurisdiction’s legal framework,
  • assessment of case law,
  • verification of compliance and KYC requirements.
• Financial Due Diligence
  • Assessment of tax burden,
  • analysis of operating costs,
  • modeling ROI under different scenarios.
• Tax Due Diligence
  • Assessment of the tax residency of the fund and investors,
  • analysis of double taxation risks,
  • planning the exit strategy.

Mechanisms for Protecting Investors’ Interests

• Corporate agreements in a Private Equity fund
  • Shareholders’ agreements,
  • put and call options,
  • anti-dilution, tag-along/drag-along.
• Transparency of fund reporting
  • Regular reporting to investors,
  • audit,
  • disclosure of information about deals and risks.
• The role of the custodian and the management company
  • Independent control over assets,
  • ensuring compliance and transaction monitoring.

KYC/AML Automation in the Fund

KYC/AML automation is not just a ‘trend’, but a tool to reduce the risk of funds being blocked. At COREDO we implement automated KYC/AML procedures that:

• speed up investor onboarding,
• reduce the risk of errors,
• increase transparency and meeting compliance requirements compliance.

Choosing a Jurisdiction and Scaling a Private Equity Fund

Practical recommendations for choosing a jurisdiction and scaling a Private Equity fund start with a basic decision – which legal form and structure to put at the foundation. How competently this structure is chosen and designed affects not only investor protection and the regulatory burden, but also the opportunities for further scaling of the fund and entry into new markets.

How to choose a fund structure

• For institutional investors – an onshore jurisdiction (EU, Singapore, Hong Kong).
• For family offices and club deals: a multi-jurisdictional structure with an offshore entity for the management company.
• For regional markets, a local jurisdiction (Mauritius, AIFC) with international infrastructure.

Scaling the fund across multiple jurisdictions

• Use multi-jurisdictional structures to enter new markets.
• Adapt the fund’s corporate governance to the requirements of different regions.
• Consider the long-term consequences of jurisdiction choice for the fund’s investment strategy.

Attracting institutional investors and family offices

• Ensure high transparency in the fund’s reporting.
• Use reliable custodians and management companies.
• Prepare an investment memorandum that complies with the requirements of qualified investors.

Key findings and recommendations

1. The fund’s tax residency is a key factor affecting ROI and investment strategy.
2. Regulatory requirements determine the level of compliance, KYC and attractiveness to investors.
3. The corporate structure is the foundation for risk management and protecting investors’ interests.
4. Multi-jurisdictional structures allow the fund to scale and minimize risks.
5. Legal support for the fund and AML services for funds are essential elements of long-term success.

If you want your Private Equity fund to be not just registered but built as a reliable, scalable and attractive structure for investors, COREDO is ready to provide legal support at every stage of the fund’s formation.

AML for real estate agents in Europe in 2025

AML for real estate agents in Europe – the main requirements of 2025 are no longer limited to formal client checks: unified pan-European rules, new fines and enhanced supervision of real estate transactions come into play. To operate confidently in the market, it is important to understand how exactly 6AMLD, AMLR and the new agency AMLA shape the regulatory framework and what obligations they add for real estate agents as of 2025.

Regulatory framework: 6AMLD, AMLR and AMLA
Сейчас AML for business in Europe relies primarily on the Sixth Anti-Money Laundering Directive, 6AMLD (Sixth Anti-Money Laundering Directive). It:

• expanded the list of predicate offences (specified offences), including tax offences, cybercrimes and corruption;
• strengthened personal liability of managers, up to criminal liability;
• clarified reporting obligations for suspicious transactions.

With the launch of the AML Regulation (AMLR), AML rules become directly applicable in all EU member states without “dilution” during transposition. For real estate agents this means:

• unified AML standards for real estate agencies on KYC, monitoring and reporting;
• mandatory compliance with the cash payment limit (ban on cash transactions over €10,000);
• machine-readable AML reporting and an emphasis on automated transaction monitoring.

COREDO’s practice already shows: large agencies and developers in the EU are beginning to build internal policies that take into account not only national law but also drafts of AMLA’s technical standards.

Expansion of covered entities: real estate as high risk
6AMLD and AMLR have finally established real estate agencies and rental intermediaries as obliged entities under AML controls. This affects:

• brokers and agencies working with sale transactions and long-term rentals;
• developer structures selling properties directly to investors;
• consulting companies supporting real estate investment deals and investment migration.

Our experience at COREDO has shown that many international groups still do not realise that their SPV companies, created “for the asset” in the EU, also fall under AML and require formalised procedures, especially when attracting foreign capital.

New standards for KYC, eKYC and digital onboarding
From 2025 the focus shifts from minimalist KYC to risk-based and digital KYC/eKYC:

• identity verification through reliable electronic identification schemes (eIDAS), national eID, video identification;
• digital onboarding, a fully digital onboarding process in which data collection, document verification, sanctions and PEP screening are carried out online;
• enhanced procedures for high-risk clients: politically exposed persons, investment migration, complex offshore and trust structures.

The COREDO team implemented the transition to eKYC for a European real estate agency using national identification schemes and integrating with external sanctions and PEP databases. This reduced average onboarding time from several days to 30–40 minutes without losing the depth of screening.

AML and registration of legal entities in the EU for real estate agents
AML requirements directly affect the registration of legal entities in the EU for real estate:

• registrars and banks require a transparent ownership structure and proof of beneficial owners;
• open registers of beneficial owners (and their updated, partially restricted versions) are used for AML and KYC checks;
• schemes with nominee owners or opaque funds trigger additional Due Diligence and often — refusal.

Solutions developed by COREDO enable structuring ownership of assets and SPVs in a way that simultaneously takes into account tax efficiency and AML requirements for checking beneficial owners in the EU, including for investment migration projects.

Practical AML rules for realtors in Europe

Practical AML rules for realtors in Europe: these are not abstract standards but concrete steps that need to be implemented in the agency’s day-to-day work. To comply with these rules, realtors must establish a clear internal control system: approve regulations, build a risk model, and document standard procedures for working with clients and transactions.

Internal AML control: regulations and procedures
AML compliance in real estate begins with an AML internal control system. In practice this is not a “thick policy to tick a box”, but a set of living documents:

• policy for assessing AML risks and their management (risk-based approach);
• detailed KYC procedures and beneficiary checks;
• AML rules for monitoring real estate transactions, including escalation triggers;
• regulations on reporting obligations to the FIU and regulators.

At COREDO we usually start a project by mapping the agency’s business processes: from client acquisition to post-deal support. This allows building AML rules for realtors in Europe so that they fit into operational reality rather than breaking the sales funnel.

Realtors’ responsibilities: KYC and beneficiary monitoring
By 2025 the basic set of duties for a realtor in the EU includes:

• client identification (KYC): collection and verification of documents, determination of PEP status, assessment of purpose and source of funds;
• beneficiary checks: identification of ultimate owners, analysis of ownership structure, working with trusts and funds;
• ongoing monitoring: monitoring transactions and client behavior, review of KYC when risk changes;
• recording and storage of data: audit logs, screening results, client and transaction dossiers.

AML requirements for client checks in the EU are tightening: regulators expect agencies to be able to justify why a particular client was assigned a certain risk level and what measures were taken.

Liability and fines for ignoring AML
AML sanctions and fines for realtors in the EU are becoming proportionate to the banking sector. In accordance with 6AMLD and AMLR:

• fines can reach at least €1 million or up to 10% of the company’s annual turnover;
• for individuals (directors, compliance officers) criminal liability is provided, up to imprisonment;
• professional activity bans, license revocations, and inclusion in registers of dishonest entities are possible.

Real estate transactions and investor migration
Regulators pay special attention to AML in investment migration and the sale of «golden visas» through real estate. For such transactions:

• heightened requirements for the source of funds and documentary evidence;
• enhanced monitoring of transactions and beneficiary structure;
• mandatory escalation of suspicious operations and suspension of the transaction until clarified.

Table of key AML compliance areas for realtors

AML Automation in Real Estate

Technologies and AML automation in real estate are becoming a key tool for transaction control and for reducing money laundering risks in complex chains of property transactions. They bring automated transaction monitoring and solutions based on *explainable AI* to the fore, which allow not only detecting suspicious operations but also transparently explaining the logic of each flag to compliance teams and regulators.

Automated transaction monitoring with explainable AI
AML in the EU in 2025 is objectively impossible to handle “manually”. The solution: AML automation in real estate through:

• automated transaction monitoring using rules and behavioral models;
• explainable AI (interpretable artificial intelligence), which allows seeing the logic behind alerts and explaining it to the regulator;
• KYT (Know Your Transaction) scenarios that analyze payment structures, jurisdictions, and counterparty types.

The solution developed by COREDO for a group of agencies in Central Europe combined transactional data, the client profile and property characteristics into a single risk model, which reduced “false positives” by 40% and sped up alert review.

Integration of AML with CRM: efficiency and savings
Integrating AML processes with CRM systems is one of the key drivers of AML automation and cost reduction:

• client and transaction data are entered once and used simultaneously for sales, KYC and reporting;
• AML alerts appear directly on the client’s record in the CRM;
• the compliance officer sees the full history of interactions, documents, and transactions.

The integration of AML systems with CRM for agencies, implemented by the COREDO team in several EU jurisdictions, increased the ROI from AML system deployment by saving employee time and reducing manual data entry.

Graph neural networks for complex schemes
Money laundering schemes through real estate often use “network” structures: chains of SPVs, trusts, transit payments. Standard rules are blind to these. Therefore we increasingly apply:

• graph neural networks for AML that analyze connections between companies, beneficiaries and transactions;
• models combining transactional, behavioral and geographic features;
• a hybrid approach: AI to detect patterns, human for final qualification.

The use of AI for AML monitoring in real estate, provided explainable AI and a documented process, is well received by regulators, especially when it comes to large multi-jurisdictional groups.

eKYC and digital onboarding for sales growth
Implementing eKYC and digital onboarding in real estate not only improves the quality of client verification but also:

• shortens the deal cycle, especially in international transactions;
• reduces customer drop-off due to “paper bureaucracy”;
• increases conversion of online leads.

COREDO’s practice confirms: after implementing digital client identification for AML compliance, one of the agencies in the EU increased the share of foreign investors completing full KYC by more than 20% — simply because it became convenient for them to undergo verification remotely.

AML compliance in crypto transactions and international operations

The specifics of AML compliance in cryptocurrency transactions and international operations become critical as digital assets are increasingly used in cross-border payments and complex corporate structures. In such conditions, regulators tighten requirements for verifying the origin of funds, which is especially noticeable in niche cases: from real estate transactions paid with cryptocurrency to multi-level international schemes.

Cryptocurrency and real estate: risks and requirements
AML and cryptocurrencies in real estate transactions, a topic that no longer seems exotic. EU regulators expect:

• the application of the same AML requirements to real estate transactions paid with cryptocurrency as to those paid with fiat;
• the use of licensed virtual asset service providers (VASP) complying with AMLD and the Travel Rule;
• increased attention to the source of crypto funds and links to sanctioned jurisdictions.

COREDO has supported transactions where part of the property’s price was paid in cryptocurrency via a regulated platform. The key to a secure structure: a clear division of responsibilities: the VASP covers AML for crypto transactions, the agency: AML in real estate and client verification.

Travel Rule and KYT in real estate
The Travel Rule requires transmitting key payer and payee data for cross-border transfers, including crypto operations. For a realtor this means:

• the need to take into account data received from banks and VASPs in their AML picture;
• the use of KYT tools to analyze the route of funds and detect anomalies;
• documenting decisions to accept/reject suspicious transactions.

FATF, CFT and multi-jurisdictional standards
The FATF international standards on AML and combating the financing of terrorism (CFT) directly affect AML under international regulation:

• FATF recommendations on real estate and investment migration set the «bar» for the EU;
• countries not in the EU but oriented toward the European market (for example, jurisdictions where clients register holding companies) are raising AML rules to the European level;
• multi-jurisdictional standards require a unified risk framework for groups operating in multiple European countries and beyond.

The COREDO team often builds a single AML framework for such groups, where European requirements serve as the «upper bound», and local rules are adapted as special cases.

Foreign investors and capital migration
AML specifics for investment migration and international real estate transactions include:

• enhanced due diligence on the source of wealth;
• checks across multiple jurisdictions, including country of citizenship and tax residence;
• coordination with banks, migration consultants and legal advisers.

Preparing a Real Estate Agency for an AML Audit and Staff Training

Preparing a real estate agency for an AML audit and staff training begins with building transparent processes that are clear not only to regulators but to every employee. To confidently pass inspections and reduce risks, it is important to establish internal control, regulations, and a system of regular AML audits in advance, which then underpin all staff training.

Internal control and audits
Effective AML internal control includes:

• an annual independent review of AML procedures (internal or external audit);
• regular review of the risk model in light of new threats and AMLA guidance;
• testing of random transactions for completeness of KYC and correctness of decisions.

At COREDO we often begin cooperation with a “diagnostic” AML audit: based on its results a roadmap to compliance with AML standards for real estate agencies is formed.

Staff training and compliance culture
How to prepare for an AML audit and staff training in real estate:

• conduct regular training for the front office, middle office, and management;
• use case studies based on real predicate offences in real estate;
• record staff participation and test results.

Role of the compliance officer
The role of the compliance officer in AML for realtors is being strengthened by 2025:

• responsibility for developing and updating AML policies;
• oversight of AML reporting and interaction with regulators;
• coordination of training and internal investigations.

In COREDO projects we often help clients build a turnkey compliance officer function: from describing the role and KPIs to implementing monitoring tools.

Metrics and KPIs for assessing AML
So that the 2025 AML requirements do not turn into a “black box”, it is important to measure effectiveness:

• share of clients who have completed full KYC/eKYC;
• the number and quality of submitted suspicious activity reports;
• average onboarding time and alert handling;
• the number of violations identified in internal audits and their trend.

AML and the ROI from implementing AML systems are directly related: the better processes and technologies are configured, the less manual work, errors, and regulatory risk.

Key findings and recommendations for real estate agents

This section contains key findings and practical recommendations for real estate agents to help them smoothly adapt to the new AML requirements. Below you will find which main changes to AML requirements by 2025 will affect your daily work and what steps you should plan now.

Key changes to AML requirements by 2025
A brief overview of what is changing for AML affecting real estate agents in Europe:

• direct effect of the AMLR and the launch of AMLA with unified AML compliance standards for real estate agents;
• strengthening of KYC, requirements for eKYC and digital onboarding, emphasis on a risk-based approach;
• increase in fines and personal liability;
• heightened scrutiny of investment migration and cryptocurrency transactions.

AML compliance checklist for a real estate agency
A practical checklist that the COREDO team often uses as a project baseline:

1. Conduct a comprehensive AML diagnostic and risk assessment.
2. Update policies and procedures in line with 6AMLD and AMLR.
3. Define and formalize the role of the compliance officer.
4. Implement eKYC and digital onboarding for clients.
5. Integrate AML processes with CRM and accounting systems.
6. Launch automated transaction monitoring (including KYT).
7. Organize regular staff training and internal audits.

Technology: selection and integration
When selecting technologies, COREDO recommends focusing on:

• availability of explainable AI and transparent scoring algorithms;
• ready-made connectors to CRM and external registers (sanctions, PEPs, beneficiaries);
• support for multi-jurisdictional profiles and varying risk levels;
• a quantifiable effect on ROI and business scaling considering compliance.

How to minimize risks and fines and grow
AML risks and their management in real estate are not about «slowing growth», but about a sustainable model:

• design processes so that it is easier for managers to comply with AML than to circumvent it;
• invest in digital technologies in real estate, eKYC, AI, integration with state registers and eIDAS;
• consider AML digital trust infrastructure as an asset that increases the value of your business to banks, investors, and regulators.

COREDO’s experience in the EU, Asia and the CIS shows: real estate agencies that adopted AML as a strategic priority in a timely manner already feel more confident in negotiations with banks and investors and are more relaxed about AML in the EU 2025.

In this article I will break down what the new EU beneficiary requirements mean for businesses in Europe, Asia and the CIS, how the 2025 AML directives are changing, and — most importantly — which practical steps to build into your strategy now. If you are planning expansion, restructuring your corporate structure or obtaining financial licenses in the EU, I recommend reading to the end: this is not theory but a distillation of what the COREDO team deals with every day in real projects.

New requirements for beneficiaries in the EU in 2025

By 2025 the EU is moving from fragmented directives to a coherent regulatory architecture:
a single AML/CFT regulation, an updated EU Anti-Money Laundering Directive (AMLD) and the supranational regulator AMLA strengthen control over who really stands behind companies and transactions.

Key areas of change:

1. Expansion of criteria for determining beneficiaries in Europe 2025
   The traditional 25% ownership threshold remains, but is no longer sufficient. Regulators increasingly use the concept of “criteria of substantial control”: the right to appoint and remove directors, control over key contracts, veto over strategic decisions, existence of trust and shareholder agreements. Formal splitting of shares no longer works: controlling influence matters more than the percentage of shares.
2. Mandatory and more frequent updating of beneficiary data in the EU
   A strict obligation to update beneficiary information upon any material change in the structure is being introduced, rather than “once a year for form’s sake”. Many EU jurisdictions are already moving to a regime where delays in updating data in digital beneficiary registers are treated as an AML breach, not a corporate formality.
3. Digital beneficiary register and unified transparency standards
   EU countries are moving toward unifying data formats and closer integration of registers. Information exchange between registers, banks, licensing authorities and AMLA is expanding. This increases the transparency of ultimate beneficiaries but sharply reduces room for incorrect structures.
4. Strengthening KYC procedures in Europe and control of ultimate company owners
   Banks, payment organizations, crypto providers, investment firms and even certain non-banking entities (for example, luxury goods traders) fall under stricter KYC (Know Your Customer) procedures. Checks are not limited to form: regulators expect an analytical approach to ownership chains, sources of funds and potential sanctions risks.

Who is the ultimate beneficiary under the new EU standards?

Criteria of substantial control

Corporate audit of ownership structure

# Responsibility of directors and controlling persons

Digital beneficiary registers in AML compliance

# Open and closed registers

Automation of data updates and integration with ERP

# The impact of digitization on ownership transparency

Registration of legal entities in the EU: new requirements and international business

AML control in Asia, the CIS and Africa

Impact of EU sanctions on beneficiaries and owners

Risks and challenges of non-compliance with the new requirements

New restrictions on cash payments and business processes

Best practices for AML compliance and risk management in 2025

Recommendations for business preparation

Due diligence methods and risk management

New AML monitoring technologies: AI and blockchain

Integrating AML and scaling in ERP

AML controls for companies with international operations

Preparing businesses for EU beneficial owner requirements

1. Step-by-step update of ultimate owner data
   • conduct an internal corporate audit of the ownership structure;
   • identify all beneficial owners under the new substantial control criteria;
   • harmonize disclosures across all jurisdictions where the company operates;
   • establish a process for regularly updating data on EU beneficial owners.
2. Organizing internal controls
   • appoint persons responsible for reporting requirements on ultimate owners in the EU;
   • implement a procedure requiring legal department approval for any changes to the structure;
   • document procedures for interaction with registrars, banks and licensing authorities.
3. Implementation and optimization of KYC and AML procedures
   • update KYC questionnaires, taking into account changes in KYC procedures in Europe in 2025;
   • adapt policies to the requirements of the AMLD and national regulators;
   • take into account the widening scope of AML supervision, including non-bank entities.
4. Training and accountability of directors and employees
   • conduct training on the responsibilities of directors and controllers;
   • develop practical guides for interacting with banks and regulators;
   • establish internal standards of conduct for responding to compliance requests.
5. Preparation for inspections and audits under the new AML standards
   • conduct a trial internal audit simulating a regulatory inspection;
   • remediate identified gaps in documentation and processes;
   • prepare a package of evidence that the company complies with the new EU beneficial owner requirements and AML standards.

Conclusion: what is important for a manager now

Over the past three years the COREDO team has been seeing the same scenario more and more often: an IT company with annual revenue of 10–30 million spends up to 9–12 months changing jurisdiction, and two years later is forced to start the process again due to changes in tax regulation and AML requirements.

The overly simple question “in which country to open a company?” becomes risky in 2026.

Choosing a jurisdiction for an IT company in 2026

When I hold a strategic session with IT business founders, we always start not with the country but with the criteria. Jurisdiction is a derivative of the business model, client geography, investment plans and the level of product regulation (fintech, AI, SaaS, marketplace, etc.).

Due diligence of jurisdictions

The first filter is due diligence of jurisdictions. At COREDO we analyze a country across several dimensions.

1. Reputation and stability of the legal system
   For IT businesses it is important not only corporate law but also how courts and regulators treat digital models, crypto elements, remote teams and data handling. A country may offer attractive tax incentives for IT companies, but if it has weak judicial protection or unpredictable law enforcement, this immediately reduces the jurisdiction’s investment attractiveness for IT businesses.
2. Tax burden and optimization
   We always calculate not the nominal, but the effective tax rate: corporate tax + dividend taxes + social contributions + local levies. It’s important not only the rate, but also the ability to use international tax planning, double taxation avoidance treaties and the presence of a sustainable regime not tied to temporary incentives.
3. Corporate reporting and audit requirements
   For clients focused on funds, reporting requirements for IT companies in the EU and transparency to investors are very important. At COREDO we see a trend: investors expect clear, comparable reporting in accordance with international standards and a transparent ownership structure, including holdings and sub-holdings.
4. legal risks of changing jurisdiction
   Changing the country of incorporation is often accompanied by exit tax triggers, contract renegotiations, changes in tax residency and risks of substance-related claims. We now build risk management for changing jurisdiction into the structure from the start: we look at how painlessly it will be possible in the future to move IP, create a separate holding or trust.
5. impact of sanctions and geopolitics
   For businesses from the CIS and some Asian countries, the impact of sanctions and geopolitics on jurisdiction choice is a critical factor. Some countries are formally open, but their banks practically do not work with certain regions. The COREDO team always includes an analysis of sanctions risks in due diligence, even if the company does not operate in sensitive goods or services.

Tax regulation and incentives for IT companies in Europe and Asia

The next layer is tax regulation for IT companies in 2026 and a comparison of tax rates for IT companies in Europe and Asia. In practice we most often discuss Cyprus, Ireland, Lithuania, Poland and Singapore.

1. Cyprus
   For IT structures Cyprus remains interesting as a platform for IP holdings and in terms of double taxation avoidance agreements. Registration features of companies in Cyprus include flexible corporate law, clear substance requirements (office, director, staff) and access to European infrastructure with a moderate tax burden.
2. Ireland
   Registering an IT company in Europe through Ireland is often justified when focusing on large B2B clients and entering English-speaking markets. The features of company registration in Ireland are important for structures with a strong IP base and R&D. Ireland offers a developed ecosystem, R&D support programs and clear corporate reporting requirements for IT companies in the EU.
3. Lithuania and Poland
   These countries strengthen their positions through fintech licensing and startup support. Company registration features in Lithuania and Poland include a focus on regulatory predictability, access to fintech infrastructure and European grant programs. For some COREDO clients, Lithuanian and Polish structures become a base for fintech licenses and AML/KYC-intensive businesses.
4. Singapore
   Registering an IT company in Asia is often associated with Singapore. For startups and scalable products, the features of registering startups in Singapore include a low entry threshold, a fast process via ACRA and BizFile+, a supportive tax environment and R&D support programs. Regulators actively work with fintech and AI, and the country offers a developed banking infrastructure for IT businesses and access to Asian markets.
5. Tax residency and reporting
   In the EU, not only rates are critical, but also the criteria and definition of tax residency. In COREDO practice we regularly explain to clients that the physical location of management, place of management and location of mind and management can affect where a company is considered a resident. This is directly related to corporate reporting and audit and affects the effective tax rate.

Substance requirements and compliance with international standards

From 2026 regulators take an even stricter approach to formal structures. Substance requirements (requirements for economic presence) are becoming not just a recommendation but a mandatory condition for access to tax benefits and international banks.

1. What is substance and why is it needed
   Substance requirements for IT companies – это не только офис и местный директор. Это реальное управление из юрисдикции, локальная команда, расходы, которые подтверждают экономическую суть. Практика COREDO подтверждает: банки и налоговые службы больше всего обращают внимание именно на соответствие деятельности заявленной модели, а не на красивую схему.
2. Substance implementation practice
   In some cases the COREDO team helps build a full-fledged R&D‑office in Europe, in others to create a management center in Asia while leaving the operational unit in another country. The main point is that the substance corresponds to the actual picture of the business and does not look like a formal shell.
3. AML/KYC procedures and international standards
   AML services for IT companies in 2026 are becoming not only a matter of licensing but also a matter of access to banking and payment systems. AML/KYC procedures must be embedded into the product: verification processes, transaction monitoring, reporting. For COREDO clients obtaining fintech licenses and AML/KYC‑dependent permits, we build a full compliance framework taking into account international AML standards and the requirements of specific regulators.
4. Digital compliance and cybersecurity
   For IT players, digital compliance and cybersecurity are becoming a separate criterion for choosing a jurisdiction. Regulators increasingly assess how the company protects data, what security protocols it applies, and how well processes comply with international data security standards.

Registering an IT Company in Europe and Asia: Process and Features

Once the criteria are clear, we move on to practice: registration of a legal entity in the EU or Asia. Here it is important to combine corporate law, requirements for participants and subsequent access to banking infrastructure.

1. Main legal forms
   In most cases COREDO uses analogues of a private limited company: s.r.o., limited, GmbH‑types. For the IT business, limited liability, a clear share structure, the ability to attract investors and option programs are important.
2. Founding documents and composition of participants
   Requirements for the share of foreign participation, the presence of a local director, and requirements for authorized capital are important. In some countries there are separate rules for registering offshore and non-resident companies, but by 2026 low-tax jurisdictions almost always require enhanced substance.
3. Registration procedure in the EU and Asia
   In practice the COREDO team structures the process so that in parallel they proceed with: preparation of founding documents, KYC on beneficiaries, bank selection and formation of a legal opinion when registering an IT company abroad. In the EU we pay special attention to corporate law for IT companies: articles of association, corporate agreements, option programs, protection of minority shareholders.
4. opening a bank account for an IT company
   This is one of the most difficult stages. The legal aspects of opening an account with international banks include verification of the structure, beneficiaries, business model, AML risks. Our experience at COREDO shows: having a well-thought-out compliance package, documented business logic, AML/KYC policies and a clear source of funds critically increases the chances of successful account opening.
5. The role of legal opinion and legal support for IT business
   For many transactions and dealing with international banks a legal opinion is required: confirmation of company status, compliance of activities with legislation, tax residency. The solution developed by COREDO usually includes a bundle: legal opinion + tax opinion + a funds flow scheme understandable to the bank and investors.

Registration of startups and fintech companies

A special layer of requirements applies to startups and fintech players.

1. Startups in Singapore and Europe
   The specifics of registering startups in Singapore include a low entry threshold, a fast process at ACRA and a flexible innovation support ecosystem. In Europe, a number of countries (for example, Ireland, Lithuania, Poland) offer innovative tax regimes for startups in 2026, grants and acceleration programs. The COREDO team often builds structures where a legal entity in the EU is combined with an R&D centre and R&D support programs.
2. Fintech licensing
   Fintech licenses and AML/KYC are a separate matter. Payment institutions, e-money, forex, crypto services require licensing and a detailed AML framework. Requirements of CySEC and other regulators are tightening by 2026: the role of internal control, reporting and an independent compliance officer is increasing.
3. The impact of international AML and KYC on fintech
   The impact of international AML on IT companies is especially noticeable in fintech. Banks and payment institutions expect the client to have documented onboarding, monitoring and reporting processes. In COREDO’s practice we often see that the maturity of the AML/KYC system determines whether a company gets access to partner banks and payment providers.
4. R&D support programs and cooperation with universities
   Many jurisdictions in 2026 link tax incentives and state accreditation of IT companies to participation in R&D support programs and to IT companies’ support of universities and educational programs. For international structures, COREDO builds cooperation with universities into the strategy as a tool both for incentives and for access to talent.

Risks and consequences of changing jurisdiction for IT companies

In 2026, more and more clients come to us already after a first jurisdiction change and want to make the second one “painless.” It is important to honestly name the risks here.

1. Tax and legal risks
   Legal risks of changing jurisdiction for IT companies include possible taxation when transferring IP, revaluation of assets, recognition as a controlled foreign company, and a change in tax residency status. Legal consequences of changing jurisdiction may also affect contracts: change of applicable law, the need to reissue or re-execute contracts, licenses and IP rights.
2. GDPR and international data protection
   When operating across borders, the influence of the GDPR on choosing a jurisdiction for an IT company becomes decisive. If the primary customer base is in the EU and data are processed outside the EU, it will be necessary to build a complex GDPR and international data protection framework by adopting standard contractual clauses, adapting the privacy policy and technical measures.
3. Corporate structures, trusts and funds
   For mature IT groups we often use corporate structures such as holdings, sub-holdings and the use of trusts and funds within the IT business structure. This allows separating operational risks and IP ownership, protecting assets and simplifying investor attraction. But when changing jurisdiction any structural changes require careful assessment from the standpoint of international law and taxation.

Choosing a jurisdiction for an IT company in 2026

To turn analysis into action, at COREDO we use a clear algorithm.

1. Algorithm for choosing the country of registration
   • Formalize the business model, client geography, and planned markets.
   • Determine licensing requirements (including which fintech licenses IT companies need to operate in the EU and Asia).
   • Establish criteria: tax burden, substance requirements, access to banks, data regulation, investment attractiveness.
   • Conduct due diligence on jurisdictions for IT companies in 2026 based on these criteria.
   • Model scaling of the IT business through international structures and scenarios for a possible change of jurisdiction.
2. Assessment of investment attractiveness and ROI of jurisdictions
   Investors care about reporting and transparency requirements, predictability of regulation, and clarity of corporate governance. The COREDO team often prepares comparative analyses: tax changes in 2026 and their impact on IT businesses, requirements for financial reporting and auditing in the EU, and the impact of ESG and sustainability on IT companies in a particular country.
3. Comprehensive legal and financial support
   Financial support and legal consulting become not a one-off project but an ongoing function. COREDO’s practice shows: companies that regularly review their structure, compliance, and tax burden cope more easily with regulatory changes and enter new markets faster.
4. Digital nomad visas and migration programs
   For distributed teams, digital nomad visas and migration programs for IT specialists are relevant. They affect founders’ personal tax residency and substance possibilities: sometimes it’s easier to carefully move part of the management to a country that offers clear rules for digital nomads and freelancers.
5. Optimization of insurance contributions and taxes
   In some structures, it is the insurance contributions and their optimization that significantly affect the effective tax rate. The COREDO team often designs models where part of the team is employed in jurisdictions with more flexible regimes, while maintaining compliance with local labor and social legislation.

Conclusion: what to rely on in 2026

By 2026 the question of how to choose a jurisdiction for an IT company is no longer about the «top‑10 countries with low taxes», but about building an international structure that takes into account: tax regulation of IT companies in 2026, substance requirements, international AML and compliance standards, GDPR and digital compliance, as well as long-term investment attractiveness.

EU and Swiss crypto regulation in 2026: a choice between strictness and flexibility

In 2026 cryptocurrency legislation in Europe and Switzerland enters a new phase: digital assets cease to be a “gray area” and are integrated into the traditional financial system at the level of laws, reporting standards, and supervision. Entrepreneurs face a choice: register in the EU with its strict but predictable MiCA/AMLR framework, or choose Switzerland with a more flexible but increasingly transparent model.

Three key trends in crypto regulation for 2026

Cryptocurrency regulation in the EU in 2026

MiCA: structuring the market by asset types

impact on business is twofold: on one hand, it is a significant entry barrier with capital and corporate governance requirements, on the other – a single CASP (Crypto Asset Service Provider) authorization opens access to the entire EU market without the need to obtain licenses in each country separately.

AMLR: aligning requirements with financial institutions

Notably, more than 90% of crypto platforms and wallet providers serving clients from the EU fall under the scope of MiCA and AMLR, even if the company is legally located outside the Union.

Licensing in the EU: jurisdictions and requirements

Crypto regulation in Switzerland in 2026

Automatic exchange of information on crypto-assets

It is important to note: inclusion on the list does not guarantee an immediate start of exchange. Interaction will be carried out only with those countries that express readiness to cooperate and implement reporting standards that correspond to OECD norms.

Licensing and FINMA

Regulation in Switzerland places extremely high demands on the quality of internal control and documentation of processes. Switzerland, as the Zug “crypto valley”, sets benchmark regulatory standards, but this is achieved at the cost of longer approval times and higher substance requirements for companies.

The Swiss National Bank’s position

Comparative analysis of the EU and Switzerland

Practical criteria for choosing a jurisdiction

Choose the EU if:

• priority — a broad market and scaling across a single market
• you need predictability and uniform rules for everyone
• target clients — retail users and SMEs in Europe
• you want to minimize the complexity of regulatory interaction

Choose Switzerland if:

• you work with HNWIs and institutional clients
• you need flexibility in structuring and complex financial arrangements
• you plan R&D, tokenization, or innovative models
• you are prepared for higher costs and longer licensing timelines

Key risks and recommendations

To comply with the new requirements:

• Establish AML/CFT processes with a risk‑based approach, client segmentation and regular review of risk ratings
• Integrate technologies for automatic exchange of crypto-asset data and CARF reporting preparation
• Deploy blockchain analytics and transaction monitoring tools
• Budget for comprehensive legal support and regular compliance reviews

When the COREDO team began actively supporting fintech clients in Switzerland, one figure surprised me: according to the Swiss Financial Market Supervisory Authority (FINMA), more than half of licensing applications are returned for revision precisely because of weak compliance procedures and poorly thought‑out risk management. Against this background, Switzerland retains its status as one of the strictest and at the same time most attractive financial centres in Europe.

In this article I explain how, in practice, to obtain a license from FINMA in Switzerland:

• which FINMA requirements are truly “red lines”;
• how to design the legal structure and capital;
• which compliance procedures FINMA expects to see in 2025;
• how to set up the process so as not to “burn” the budget and timelines.

What is a FINMA licence and why is it needed?

By “FINMA licence” people in practice mean a whole range of regimes:

• a bank licence or a securities dealer licence;
• a licence for a payments institute or electronic money institution (EMI);
• an asset manager licence;
• licenses for virtual asset service providers (VASP licence);
• authorization to operate a DLT trading facility for distributed ledger infrastructures.

For international business this is not just formal FINMA Licensing. A licence in Switzerland:

• opens doors to Swiss and European banks, large corporate clients and funds;
• facilitates scaling the business in the EU and Asia due to the high degree of trust in Swiss supervision;
• reduces regulatory risks when subsequently entering other markets (Liechtenstein, Germany, Singapore), where a Swiss background is perceived as a mark of quality.

Key FINMA requirements for a license in Switzerland

Key FINMA requirements for obtaining a license in Switzerland cover not only financial metrics, but also how you build your business at the level of structure and governance. To obtain a license, the regulator primarily assesses the corporate and legal structure of the company, its transparency, presence in Switzerland and compliance with local legislation.

corporate structure and legal framework

First step: registration of a legal entity in Switzerland with the correct ownership and governance structure. In most cases clients choose the form of a joint-stock company (AG) or a limited liability company (GmbH) depending on the type of license and capital requirements.

Key points FINMA looks at:

• The legal structure of the company in Switzerland must be transparent: identifiable beneficiaries, absence of convoluted offshore chains, justified use of holding levels.
• A genuine management center, the board and key functions (risk, compliance, MLRO) must be actively involved in the activities of the Swiss entity, not be “nominal”.

FINMA requirements for the management team include:

• proven experience in the financial sector, risk management and compliance;
• an impeccable professional reputation, confirmed by background checks and the absence of sanctions or significant past violations;
• sufficient presence in Switzerland (often, a resident director and local key functions).

Financial requirements and capitalization

The minimum capital for a FINMA license depends on the type of activity and the scale of operations:

• for payment institutions and EMI, from several hundred thousand CHF;
• for an asset manager license: from hundreds of thousands to millions CHF;
• for banks and large brokers: significantly higher, taking into account risk buffers.

FINMA assesses not only formal compliance with the threshold but also financial resilience and capitalization:

• sufficient capital taking into account stress scenarios;
• availability of reserves for operational, market and compliance risks;
• a sustainable business model supported by a realistic financial plan.

Key requirements for financial reporting under FINMA standards:

• preparation of reports according to International Financial Reporting Standards (IFRS) or Swiss GAAP, depending on the type of license and group structure;
• annual audit by an independent auditor recognized by FINMA;
• ability to provide interim reports and reports on special requests from the regulator.

Compliance, AML and KYC requirements

A separate section — AML and KYC in Switzerland. The regulator expects not a formal set of policies, but a genuinely functioning system:

• detailed anti-money laundering (AML) and counter-terrorist financing policies;
• clearly described Know Your Customer (KYC) procedures, including identification, verification and ongoing customer monitoring;
• a well-developed Source of Funds check and, if necessary, Source of Wealth, especially for high‑risk clients.

implementation of AML/KYC procedures for FINMA includes:

• a risk‑based approach with classification of clients and transactions by risk categories;
• use of transaction monitoring technology systems (rules‑based and/or ML solutions);
• clear separation of first, second and, if necessary, third line of defense.

FINMA compliance procedures for 2025 are built taking into account FINMASA and FINMA’s current guidance:

• appointment of a responsible MLRO and compliance officer;
• regular staff training;
• a documented system of internal control and incident escalation;
• readiness to provide the regulator with a full trace of actions on AML/KYC cases.

How to obtain a FINMA license in Switzerland?

procedure for obtaining a FINMA license in Switzerland requires careful preparation of documents, a sound business model and strict adherence to regulatory requirements for finance and compliance. Below we outline the key stages of submitting and reviewing an application that every company planning to operate legally under FINMA supervision goes through.

Stages of submitting an application and its review

In practice, the procedure for obtaining a FINMA license is divided into several stages:

1. Diagnosis and architecture (1–2 months)
   At this step at COREDO we carry out a GAP analysis:
   • alignment of the business model with the licensed activity;
   • readiness of corporate governance;
   • maturity of compliance and IT systems.

   Result, a roadmap and the structure of the document package.

2. Package preparation (2–4 months)
   Includes:
   • a detailed business plan with financial models and a description of risk management in the financial sector;
   • compliance, AML/KYC, operational and IT risk management policies;
   • a description of the IT infrastructure for licensing (architecture, security, backup, cyber incident plans);
   • shareholder register and group structure.
3. Submission of the application
   At this step the formal process of preparing an application for obtaining a license FINMA in Switzerland begins:
   • set of FINMA forms;
   • certified incorporation documents;
   • information about responsible persons and the management team;
   • description of processes and systems.
4. FINMA application review (usually 4–6 months)
   At this stage the regulator:
   • analyses the documents;
   • sends requests for clarifications;
   • may initiate an audit and on‑site FINMA inspection to verify that the declared processes correspond to reality.
5. Conditional license and implementation phase (3–4 months)
   Often FINMA issues a conditional license subject to a number of additional conditions: fine‑tuning IT systems, strengthening compliance, hiring additional specialists. In such cases the COREDO team guides the client through the checklist for fulfilling the conditions and communications with the regulator.
6. Final licensing and launch
   After confirmation that all conditions have been met a full license is issued and the company begins operations at full capacity.

Documents required for the application

licensing specifics DLT trading facility FINMA:

• a detailed description of the DLT architecture, consensus mechanisms, key management;
• assessment of cyber risks and an incident response plan;
• a demonstration of how the DLT platform protects investors and market integrity.

Conditions for obtaining a FINMA VASP license for companies working with virtual assets:

• clear separation of custody, exchange and other functions;
• advanced AML procedures taking into account on‑chain risks;
• demonstrable measures to protect client assets (custody model, segregated accounts, insurance).

Features of licensing fintech and virtual assets

For fintech players, the question of how to obtain a FINMA license in Switzerland inevitably boils down to three areas: governance, IT, and risks.

FINMA requirements for fintech companies include:

• well-considered corporate governance in fintech: roles and responsibilities of the board of directors, risk and audit committees;
• a mature risk management system in the financial sector — credit, market, operational, compliance and IT risks;
• provable reliability of the IT infrastructure for licensing: redundancy, change management, cybersecurity, independent testing.

For crypto businesses and virtual asset providers:

• A FINMA VASP license requires strict segregation of client and own funds, a transparent fee structure and asset custody arrangements;
• AML/KYC implementation in crypto business must take into account anonymous and mixing services, DeFi risks and cross-border flows.

FINMA Risk Management and Compliance

In practice, risk management during FINMA licensing is not a one-off exercise to obtain a license, but a transition to ongoing regulatory supervision. FINMA expects to see:

• a formalized risk appetite and limits;
• regular reports on key risk indicators;
• an independent risk management function.

Implementing transaction monitoring technologies is a mandatory element:

• systems must be able to detect anomalies and suspicious activity scenarios;
• configurable rule logic and a documented process for handling alerts are required;
• the result — a transparent history of actions for each case, available for review.

On-site FINMA audits and inspections usually include:

• checking that actual processes comply with those described in the documents;
• selective review of client files and AML case files;
• assessment of the effectiveness of internal controls.

How to obtain a FINMA license: timelines and ROI

From COREDO’s project experience, the timeframes for FINMA’s review of fintech and VASP cases on average are:

• 2–6 months for preparation;
• 4–8 months for review and revisions;
• 3–4 months to meet conditions and launch.

Benefits of obtaining a conditional FINMA license:

• a clear list of required revisions instead of a rejection;
• the ability to build partnerships and processes for an almost approved model;
• increased trust from investors and banks, even before full licensing.

Recommendations and conclusions for entrepreneurs and executives

In conclusion – a condensed checklist I usually discuss with founders and the CFO.

Checklist for obtaining a FINMA license

• Clearly determine the type of FINMA license and verify that the business model complies with it.
• Design the company’s legal structure in Switzerland with a transparent beneficial ownership chain.
• Assess and, if necessary, recapitalize the business to meet the minimum capital required for a FINMA license, with a buffer.
• Form a management team that meets FINMA requirements regarding experience, reputation, and presence in Switzerland.
• Build comprehensive FINMA 2025 compliance procedures, including AML/KYC, risk management and internal control.
• Prepare a financial model and financial reporting according to FINMA standards (IFRS or Swiss GAAP).

How to form the management team and compliance function

• Include specialists with real experience in the banking, payments, or investment sector on the board of directors and in top management.
• Define independent compliance, risk, and, where necessary, internal audit functions.
• Ensure key roles are not combined in ways that create conflicts of interest.

How to ensure AML and KYC compliance

• Implement risk-based AML/KYC adapted to your type of activity and client geography.
• Set up source-of-funds verification and continuous transaction monitoring.
• Provide regular staff training and testing of procedures under stress scenarios.

How to minimize risks and accelerate licensing

• Start with a preliminary GAP analysis of FINMASA requirements and relevant regulations.
• Don’t skimp on document quality: FINMA quickly spots templated and “dead” policies.
• Plan the project at least a year ahead, synchronizing it with growth and capital-raising plans.

According to the ČNB and European regulators, in recent years the volume of assets under management by collective investment structures in the Czech Republic has been steadily growing at double-digit rates, and the share of cross-border investments through local structures within the EU and beyond is becoming one of the drivers of that growth. For entrepreneurs from Europe, Asia and the CIS this is not abstract statistics: access to the EU single market, predictable regulation and a transparent tax environment turn an investment company in the Czech Republic into a practical tool for scaling capital and business.

In practice this means: the market entry threshold is rising, but those who set up the structure correctly from the start gain a long-term competitive advantage and easier access to institutional capital.

In this article I have gathered for you a distillation of COREDO‘s practice: a step-by-step procedure for registering an investment company in the Czech Republic in 2026, realistic timelines, requirements for the share capital, nuances of interaction with the Czech National Bank (ČNB) and the key strategic decisions that are best made before submitting the first application.

Company registration in the Czech Republic for investments

The specifics of registering a company in the Czech Republic for investment business are important for those who want to combine access to the EU market, transparent regulation and a considered tax burden. Once you understand why the Czech Republic is considered a workable jurisdiction for an investment company, it will be easier to assess the real advantages, risks and requirements for the structure of your future business.

Why the Czech Republic as a jurisdiction for an investment company?

When entrepreneurs ask me which country is reasonable to start a European expansion from, the Czech Republic makes the short list. The reasons are practical:

• A stable legal system and predictable corporate law of the Czech Republic. The Act on Investment Companies and Funds (ZISIF) clearly describes the forms, licensing procedures and management requirements.
• EU membership and direct access to the single market through passporting mechanisms for certain licenses and cross-border distribution of products.
• Developed infrastructure: local custodians, auditors, fund administrators, IT providers for asset and investment portfolio management.
• A balance between the level of regulation and operating costs compared to a number of “top” Western European jurisdictions.

For those considering registering a company in the Czech Republic as a first step toward cross-border investments in the EU and CIS, this combination provides the opportunity to build a sustainable structure without excessive ownership costs.

Types of investment funds in the Czech Republic

Czech regulation offers several types of structures if you are targeting an investment fund in the Czech Republic or a management company:

• classic investment companies (akciová společnost, SICAV) under asset management;
• investment funds with various legal forms (including a fund for qualified investors – a fund for professional and semi-professional participants);
• open-ended funds (retail segment, closer to the UCITS model);
• closed structures (private equity, venture, property funds for real estate, infrastructure, private debt).

The choice of form determines the ČNB’s requirements for capital, corporate governance and disclosure. In one of the recent projects the COREDO team structured a hybrid model for a client: an investment management company + a separate Czech investment fund for qualified investors. This allowed splitting licensing risks and flexibly managing new sub-funds for different strategies.

The role of the Czech Republic in the EU and cross-border investments

A properly structured legal entity registration in the EU in the form of a Czech investment structure opens up:

• the distribution of products among investors in other EU countries, taking into account the AIFMD/UCITS regimes and local marketing rules;
• a convenient hub for cross-border capital flows between the EU and Asia, including the use of SPVs and sub-funds for deals in different currencies;
• a legal basis for cross-border legal support of projects in EU and CIS countries with a single decision-making centre.

COREDO’s experience shows that a well-designed investment fund structure in the Czech Republic allows managing a portfolio of assets across several jurisdictions, while compliance and reporting are centralized and clear to the regulator.

Registration of an Investment Company in the Czech Republic 2026

The procedure for registering an investment company in the Czech Republic in 2026 includes several sequential legal and regulatory stages, from choosing the legal form to obtaining a license from the Czech National Bank. Below we will consider the general logic of the process: which steps need to be taken, which authorities are involved and what requirements must be taken into account already at the planning stage of the structure and investment strategy.

Overall logic of the process

The procedure for registering an investment company in the Czech Republic in 2026 remains formally similar to the current one, but taking into account tightened requirements for disclosure of ultimate beneficial owners, AML control and the quality of business plans in the financial services sector. In practice I divide it into six blocks.

Name verification and selection

First step: checking the uniqueness of the company name in the commercial register and compliance with restrictions for the financial sector (references to “investment fund”, “asset management” etc. must be agreed with the ČNB). At this stage, COREDO lawyers immediately tie the name to the future license and marketing strategy to avoid changing the brand after obtaining permits.

Founding documents and business plan

To register a company in the Czech Republic for investment activities the following will be required:

• charter and founding agreement with a clear description of the scope of activities;
• a detailed business plan of the investment company: target markets, product line, investment strategies and ROI, cost structure, assets under management forecast, risk management model;
• internal policies: conflict of interest management, compliance, AML for investment companies, internal control.

When the COREDO team prepares the package, we proceed from the fact that the ČNB looks at these documents effectively as a “Due Diligence dossier” of a future market participant, rather than a formality.

Legal address and bank account

You will need:

• a confirmed legal address in the Czech Republic (an office or an office solution from a certified provider);
• a preliminary agreement with a bank or a licensed payment/EMI organization on opening an account.

Depending on the business model, it is possible that a classic bank account is combined with infrastructure for electronic money services (EMI license). In one of COREDO’s cases the client required a combined structure: an investment company + a Czech EMI provider as a partner for settlements with investors in different regions.

Preparation and submission of documents

documents for registering an investment company in the Czech Republic include:

• founding documents;
• information about beneficiaries and ownership structure (including registration of a company with foreign founders);
• confirmation of the source of funds for forming the share capital;
• resumes and proof of qualifications of key executives and board members;
• internal regulations on compliance, AML, risk management;
• draft agreements with a depositary (for certain fund structures) and with an external auditor.

The package is sent to the commercial court for incorporation and simultaneously to the ČNB for obtaining a license.

Notarization of documents

Some documents must be notarized and, if necessary, apostilled (if the founders are non-EU residents). COREDO’s practice shows that careful preliminary verification of the wording and the signatories’ powers at this stage can save up to several weeks in the overall launch timeline.

Awaiting the decision and issuance of the license

After submitting the application, the ČNB conducts a comprehensive review: it analyzes the business reputation of the beneficial owners, the sustainability of the business model, the internal control system and the company’s readiness to comply with regulatory requirements for investment companies. In a number of projects COREDO accompanied written requests from the regulator and participated in meetings where it was necessary to present the risk and compliance model in detail.

Estimated timelines for stages

These timelines are averages. In complex projects with multi-level structures and cross-border flows the regulatory phase can be longer; COREDO’s experience allows managing expectations and building a roadmap in advance.

Requirements and licensing for an investment company in the Czech Republic

Requirements for an investment company in the Czech Republic and Licensing: this is not a formal procedure, but a set of strict regulatory rules that determine access to working with investors’ capital. To actually enter the market, it is important to understand not only the minimum figures for share capital, but also what capitalization and structural parameters the company must demonstrate to the regulator in practice.

Share capital: minimum and reality

The formal share capital for an investment company in the Czech Republic depends on the specific type of license and whether the structure falls under the UCITS/AIFMD directives. For a number of management companies and funds there is a minimum threshold comparable to pan‑European standards (from hundreds of thousands to millions of units of the base currency), while for lighter regimes: lower.

In practice, the COREDO team recommends focusing not only on the minimum share capital and its bare minimum, but on a “comfortable” level: it should demonstrate to ČNB the resilience of the business model and create a buffer for operational risks. In several cases the regulator explicitly pointed to the insufficiency of the initially declared capital given the scale of planned operations.

Czech National Bank requirements for structure and management

A Czech National Bank (ČNB) license for an investment company requires meeting a number of criteria:

• a transparent ownership structure without “black boxes” in offshore jurisdictions;
• the qualification and experience of board members and top management in asset management;
• an effective compliance and internal control system, and an independent risk management function;
• policies for managing liquidity, market, credit and operational risks.

ČNB’s role in licensing investment companies is not limited to issuing the permit: supervision continues in the form of regular reporting, inspections and monitoring of key risk indicators and capital adequacy.

Licensing, AML and EMI

licensing specifics of investment companies in the Czech Republic in 2026 will largely be determined by updated European standards:

• thorough AML compliance checks (anti‑money laundering) for investment companies: KYC procedures, transaction monitoring, sanctions screening;
• assessment of readiness for new sustainable finance requirements (ESG disclosure, SFDR) for products distributed in the EU;
• increased attention to cross‑border investments and funding channels.

In some cases it makes sense to separate functions: the investment company concentrates on asset management, while the payment/EMI structure focuses on payments and the issuance of electronic money. But there are scenarios where a group of companies under common control builds a vertically integrated model.

Taxation and incentives for investment companies in the Czech Republic

Tax regulation and incentives for investment companies in the Czech Republic determine not only the size of the fiscal burden but also the overall profitability of investment projects in this jurisdiction. Understanding current tax rates and obligations is the first step to properly structuring a company and making the most of available benefits.

Tax rates and obligations

The Czech tax regime remains competitive within the EU context, especially taking into account double taxation agreements and the specifics of taxation of collective investment funds. For investment companies the key points are:

• corporate income tax;
• taxation of dividends and interest income;
• rules on thin capitalization and transfer pricing for intra-group transactions.

When planning a structure, COREDO always models how registration of an investment company in the Czech Republic will affect the tax obligations of the business in the investors’ countries and the countries of the target assets.

Tax incentives and planning

For investment companies in the Czech Republic in 2026 the following are important:

• preferential regimes for certain types of investment funds in the Czech Republic (including funds for qualified investors);
• opportunities to use a Czech company as a holding with a preferential regime for dividends and capital gains when criteria are met;
• tools for optimizing taxation of cross-border investments in the EU and Asia.

In several projects COREDO structured arrangements so that a Czech company acted as the center of managerial and investment expertise, while the risk and tax burden at the level of the target countries were allocated through sub-holdings and SPVs.

Compliance, AML and Internal Control in Czech Investments

Compliance, AML and internal control in Czech investment companies today are becoming an integral part of launching and scaling a financial business: without a built AML framework, transparent KYC procedures and documented internal control it is practically impossible to obtain a licence and work with banks. In the following sections we will explain how to correctly build an AML framework and internal control already at the business launch stage in order to meet the requirements of Czech regulators and avoid critical risks.

AML framework and launching a business

From the regulators’ point of view, ensuring AML compliance when registering an investment company in the Czech Republic is one of the key questions for market admission. Typically required:

• a developed client identification system (KYC), including beneficiaries and sources of funds;
• procedures for monitoring transactions and detecting unusual activity;
• staff training and fixed accountability for violations.

COREDO’s practice confirms: if the AML framework is designed at the project stage, questions from the ČNB during licensing are reduced both in volume and in depth.

Internal Control and Risk Management

Risk management in Czech investment companies goes far beyond standard VaR models. The regulator expects:

• independence of the risk management function from the front office;
• regular stress tests and scenario modelling;
• clear documentation on limits for country, instrument and counterparty levels.

The COREDO team develops practical procedures for clients: from investment committee regulations to dashboards for monitoring key metrics in real time using specialized technologies for managing investment funds.

Impact of EU Regulations 2026

EU financial regulation in 2026 increases requirements for:

• transparency of ownership structures;
• reporting on sustainable finance and ESG risks;
• information exchange between national regulators.

For Czech investment companies this means the need to integrate an expanded set of metrics and reports into processes in advance. In a recent project COREDO helped a client adapt an existing Czech structure to the new European standards to preserve the right to market products in multiple EU jurisdictions.

Structure of an investment fund

The structure of an investment fund and asset management determine how the fund is organized, who makes the key decisions and under what rules risks and returns are allocated among investors. Understanding common fund structures makes it easier to choose the appropriate investment format and to build your own capital management taking into account objectives, the investment horizon and risk tolerance.

Typical fund structures

In the Czech Republic, several basic architectures are used:

• corporate fund (SICAV) with a sub-fund structure – convenient for parallel strategies across different asset classes or geographies;
• trust-like and partnership forms for a limited group of investors;
• real estate funds and infrastructure funds with a focus on physical assets.

The choice of an investment fund’s structure is always linked to the investment strategy for Czech investment funds and their target investor audience.

Capital and risk management

Effective capital and risk management includes:

• diversification across countries and sectors taking into account political and regulatory risk;
• integration of currency and interest-rate risk into the overall portfolio model;
• use of derivatives and structured products within limits permitted by regulators.

In one COREDO case, we support a Czech fund that invests simultaneously in debt instruments in the EU and stakes in fast-growing companies in Asia. For that fund we built a multi-level system of limits and hedging procedures.

Technologies and operational model

A modern investment company in the Czech Republic relies on:

• centralized accounting and risk analytics platforms;
• automation of reporting to regulators and investors;
• integration with banks, custodians and payment systems via APIs.

Solutions developed by COREDO together with technology partners enable clients to roll out reporting under new regulatory requirements with minimal changes to the operational cycle.

Recommendations for entrepreneurs and key takeaways

In this section you will find practical recommendations and key takeaways for entrepreneurs that can be applied immediately to your project. Below is a step-by-step launch checklist that will guide you through all stages: from idea validation and risk assessment to first sales and scaling.

Step-by-step launch checklist

If you are thinking about how to open an investment company in the Czech Republic in 2026, the practical sequence of actions will be as follows:

1. Define the target model: an investment company, a fund, or a combination; fix the target markets and product range.
2. Develop the investment company’s business plan with realistic scenarios for AUM, returns, and expense structure.
3. Choose the legal entity form and prepare the articles of association taking into account the requirements of ZISIF and ČNB.
4. Agree on the trade name and legal address, prepare infrastructure for opening a bank account.
5. Establish the registered capital at a level that will satisfy the regulator and provide stability.
6. Develop document packages for AML, compliance, internal control, and corporate governance.
7. Prepare and notarize the documents for registering the investment company in the Czech Republic.
8. Submit applications to the commercial court and the ČNB, and manage communication with the regulator.
9. Set up operational processes, reporting, and IT infrastructure before starting to accept investments.

Legal address, bank account, and EMI

When choosing a legal address and bank account for the company, the following are important:

• reputation and experience of the counterparty (landlord, bank, or EMI provider);
• the bank’s willingness to work with an investment profile and the geography of your investors;
• potential integration with payment infrastructure if you plan to obtain an EMI license or cooperate with such providers.

The COREDO team implemented several projects where preliminary work with the bank before the company’s incorporation helped avoid prolonged KYC processes after obtaining the ČNB license.

How to minimize difficulties and time costs

The main difficulties in registration are not “paperwork”, but:

• underestimating the depth of ČNB’s requirements for risk management and compliance;
• an overly optimistic business plan;
• an opaque beneficiary structure.

Our experience at COREDO has shown that early auditing of the structure (including sources of capital, the group’s corporate structure, and planned cross-border flows) reduces the likelihood of additional rounds of questions from the regulator and helps meet the originally stated timelines for registering an investment company in the Czech Republic.

Impact of the New EU Rules on Investment Business in the Czech Republic 2026

The impact of the new EU rules and the prospects for the development of the investment business in the Czech Republic in 2026 are directly linked to a comprehensive overhaul of financial regulation, tighter requirements for transparency and capital control, and the reallocation of EU budgetary priorities in favor of innovation and digitalization. For the investment business in the Czech Republic this means not only an increase in compliance burden, but also new niches for products, structures and services that meet the updated EU standards in 2026.

New EU financial regulation 2026

The impact of the new EU regulations on investment companies in the Czech Republic will appear along several lines:

• strengthening requirements for transparency, reporting and corporate governance;
• development of unified ESG disclosure standards;
• further digitalization of interaction with regulators and data exchange.

For Czech market participants this is both a challenge and an opportunity: companies that are already integrating future requirements into their processes today will be able to bring products to other EU markets more quickly.

Scaling and long-term effects

From a strategic perspective, opportunities to scale the investment business in the Czech Republic include:

• launching additional sub-funds for new strategies without creating a separate legal entity;
• expanding the geography of investments (EU, Asia, Middle East) with centralized management and compliance;
• using the Czech Republic as the group’s centre of competence with branches or partners in other countries.

For entrepreneurs focused on the long term, registering an investment company in the Czech Republic is not a one-off legal operation, but a foundation for building a sustainable international investment business. COREDO’s practice confirms: careful preparation at the start, the right choice of structure and a constructive dialogue with ČNB turn the regulatory environment from a barrier into a competitive advantage.

The key question I hear more and more often from COREDO clients:

Czechia today is one of the entry points to the European crypto market: flexible national VASP regulation, clear case law, and access to consulting expertise in Prague and Brno. But from 2026 it will be a completely different game: the national regime for VASPs will transform into the CASP regime under MiCA, and AML/KYC and cybersecurity requirements will move closer to banking standards.

In this article I will lay out step by step what the process of obtaining a crypto license in the Czech Republic will look like in 2026, what the realistic timelines are, what the requirements are for capital, corporate governance, AML/KYC and DORA, and at which stages having an experienced partner like COREDO saves months and tens of thousands of euros of budget.

If you are planning to register a crypto company in the Czech Republic or to relicense an existing VASP to the Czech CASP regime, I recommend reading to the end: what follows is a practical guide, not a theoretical overview.

Crypto license in the Czech Republic in 2026: what is it and why is it needed?

From 2026 the focus shifts: the key regime becomes the MiCA crypto license, and providers will convert into Crypto‑Asset Service Providers (CASP). This status gives not only the right to operate in the Czech Republic but also passporting across the entire EU, provided MiCA standards on capital, risk management, client protection and disclosure are met.

The Markets in Crypto‑Assets (MiCA) regulation introduces uniform rules for issuers and providers of crypto-asset services across the Union:

• strict requirements for the crypto license in the Czech Republic regarding capital, corporate governance, IT security and reserves;
• a clear classification of services (custody, exchange, order execution, portfolio management, etc.);
• expanded AML obligations (Anti‑Money Laundering) and KYC (Know Your Customer) in conjunction with the existing European AML framework.

For existing Czech VASPs this means relicensing under MiCA in the Czech Republic: companies that currently operate under national rules will have to:

• adapt their governance structure, risk management and IT systems to CASP standards;
• confirm the minimum share capital for the crypto license and the existence of financial reserves;
• update internal policies on AML/CFT, incident management and data protection.

In practical COREDO projects I see a simple pattern: companies that view MiCA as a ‘tick-box’ requirement enter the market with a fragile model. Those who build their business architecture ‘for MiCA from scratch’ gain a competitive advantage in scaling and in banks’ trust.

Obtaining a crypto license in the Czech Republic in 2026

The process of obtaining a crypto license in the Czech Republic in 2026: this is no longer a formality, but a complex sequence of legal and compliance steps within the MiCA framework and the requirements of the Czech National Bank. To successfully go through this path, the first key step becomes registration of a legal entity for crypto business, which defines the legal basis and structure of the future licensable activity.

Registration of a legal entity for crypto business
The first step is the registration of a legal entity (s.r.o. or a.s.) in the Czech Republic. In practice, 90% of crypto projects choose s.r.o. as the analogue of a private limited company: flexible charter, clear corporate governance and adequate capital requirements. For more capital‑intensive projects (crypto exchanges, custody providers) an a.s. (joint‑stock company) is sometimes appropriate.

registration requirements in the Commercial Register include:

• signing the founding documents;
• specifying the ownership and beneficiaries structure;
• registered address.

MiCA and local practice effectively establish requirements for a physical office in the Czech Republic and actual presence:

• an office or a full registered address with actual operational activity;
• the presence of a compliance officer and internal controls that are actually located in the jurisdiction and can interact with the regulator.

Preparation and submission of documents
The next block is the documents for a crypto license in the Czech Republic. The standard package that the COREDO team prepares for clients includes:

• a detailed business‑plan and financial forecast for at least 3 years with stress‑scenario modelling;
• financial statements (for existing companies) and confirmation of founders’ sources of funds;
• policies and procedures on AML/KYC, risk management, information security, incident management;
• description of IT architecture, encryption technologies, backup and recovery procedures.

• detailed CVs demonstrating relevant experience in finance, IT, and risk management;
• Due Diligence of management and owners, including checks against international sanctions and PEP lists;
• background checks and certificates of no criminal record from countries of citizenship and residence.

For a CASP license, the regulator assesses the minimum capital for a crypto license in the Czech Republic and the financial resilience and reserves for crypto companies. Specific requirements for the share capital for a crypto license in the Czech Republic depend on the type of services:

• custody and asset storage – a higher capital and reserve threshold;
• brokerage and exchange services, separate requirements for own funds and liquidity;
• lighter models (for example, single exchange services): reduced limits, but still higher than for an ordinary s.r.o. without a license.

implementation of AML, KYC and compliance programs
AML requirements for crypto business in the Czech Republic in 2026 will combine national rules and the pan‑European AML package. For the license the key elements are:

• a formal and functioning AML/CFT program covering client identification, transaction monitoring, management of suspicious operations and reporting;
• clearly described KYC and AML for crypto companies in the Czech Republic with a risk‑based approach (different levels of checks for different client categories and geographies);
• regular internal and external audits of AML/CFT program implementation for crypto companies in the Czech Republic.

Separate block: corporate risk management in the crypto sector: here COREDO helps clients build:

• a risk matrix (regulatory, market, operational, IT risks);
• incident escalation procedures;
• an internal control system where the compliance officer has a real veto right over transactions and products.

Technological requirements and cybersecurity
After the implementation of MiCA and DORA (Digital Operational Resilience Act), crypto companies in terms of IT risk requirements are effectively approaching banks and payment organizations.

For cybersecurity and DORA in crypto licensing in the Czech Republic the following are important:

• a formalized IT risk management framework: identify, protect, detect, respond and recover;
• regular testing of digital operational resilience: stress tests, penetration testing, cyber incident drills;
• documented procedures for interaction with IT services outsourcing providers.

Technological standards and innovations in crypto licensing include:

• implementation of encryption technologies for storing keys and personal data;
• multi‑factor authentication and role separation for critical operations;
• testing for resilience to attacks as a mandatory part of licensing.

Timelines and stages for obtaining a crypto license in the Czech Republic

Conventionally, the stages and timelines for obtaining a crypto license in the Czech Republic look like this:

1. 1–2 months – company registration, office selection, formation of the management team;
2. 2–3 months, preparation of documentation, financial models, IT descriptions and compliance policies;
3. 3–4 months: review of the application by the regulator, responses to requests, revision of documents.

• the complexity of the business model (custody, exchange, brokerage usually require more detailed elaboration);
• the completeness of the provided data;
• the company’s readiness to respond promptly to regulator requests.

Features of MiCA relicensing in the Czech Republic

For existing VASPs the key question is: how does relicensing of crypto companies in Czechia under MiCA proceed. Essentially, this is about transforming the status into a CASP license in Czechia.

Procedures for relicensing under MiCA include:

• an audit of the current model for compliance with MiCA and DORA;
• analysis of corporate governance, capital, IT systems and AML/KYC;
• preparation of a transition plan and a roadmap to close gaps.

• weak and undercapitalized participants will most likely exit the market or be acquired;
• strong players with well-thought governance and IT setup will gain a strategic advantage through access to the pan-European market.

In COREDO’s relicensing projects we usually build a phased plan: first we address the ‘critical’ requirements (capital, governance, AML), then DORA and fine IT tuning.

Tax and finances of crypto business in the Czech Republic

The financial section begins with the minimum share capital and financial reserves. Depending on the type of CASP, the regulator sets:

• minimum own funds;
• additional reserves for operational and IT risks;
• liquidity requirements and coverage of client obligations.

Tax regulation of the crypto business in the Czech Republic is built on general corporate rules, but is supplemented by specific issues:

• tax accounting of cryptoasset transactions;
• rules for recognition of income and expenses of crypto exchanges and exchangers;
• requirements for documenting cross-border transactions.

With a well-structured setup, tax incentives for crypto business in the Czech Republic are possible, especially when using innovative and R&D models, but this is always calculated individually.

For the license the following are required:

• detailed financial statements and a business plan for the crypto license, including scenario analysis;
• proof of financial stability and reserves for crypto companies;
• a realistic ROI model in crypto licensing: an assessment of the costs of preparation, maintaining the license and potential revenue.

Key takeaways for entrepreneurs

If we systematize our experience at COREDO on how to obtain a crypto license in the Czech Republic in 2026 under MiCA, the practical steps are as follows:

1. Define the target business model and list of services (custody, exchange, brokerage, exchange service), as capital, IT and the scope of compliance depend on this.
2. Choose the form of legal entity registration (s.r.o., a.s.) in the Czech Republic, taking into account capital and governance requirements.
3. Form the management team and appoint a strong compliance officer with real authority.
4. Develop and implement AML and KYC programs for a crypto company in the Czech Republic, embedding a risk‑based approach and regular audits.
5. Bring the IT infrastructure in line with DORA requirements, crypto platform cybersecurity and digital operational resilience.
6. Prepare a business plan, financial forecast and documentation package taking into account regulator requirements and the specifics of beneficiary profiles.

To minimize risks and speed up the process, in COREDO projects we focus on:

• preventive work on vulnerable areas (beneficiaries, sources of funds, IT outsourcing);
• building corporate risk management in the crypto sector before submitting the application;
• proactive communication with the regulator at the questions and clarifications stage.

• cross‑border regulation of crypto services in the EU;
• reporting and control standards for crypto providers;
• real processes for digital and financial resilience.

From COREDO’s experience, those who start thinking about MiCA, DORA, AML and cybersecurity in advance perceive 2026 not as a threat but as a window of opportunity: the market will become more transparent and the barriers to entry higher. And it is precisely here that a well‑thought‑out crypto license in the Czech Republic turns into a strategic asset, not just a regulatory obligation.

According to the European Banking Authority, in recent years the number of licensed Electronic Money Institutions in the EU has grown many times over, and competition for customers in cross‑border payments has become tougher than in the traditional banking market. Against this background choice of jurisdiction for an EMI license has ceased to be a technical matter: it determines the cost of raising capital, the speed of entering the EU market and even the final business model.

I suggest looking at the question “how to choose a country for an EMI license” as a strategic decision rather than a formal registration. In this article I will examine:

• what an EMI license actually means / EMI license EU;
• which selection criteria for a jurisdiction actually affect PL
• how Lithuania, Portugal, Germany and the Czech Republic differ in regulatory and operational parameters;
• what practical steps need to be taken to obtain an EMI license and preserve flexibility for scaling.

If you are considering registering an EMI company in the EU not as an experiment but as a long-term project, I recommend reading the material in full: below is not theory, but a distillation from real COREDO cases in Europe and the EEA.

EMI license: what it is and why it is needed in Europe

• access to the EU and EEA single market with the ability to passport services;
• the right to open and operate e-wallets, issue prepaid instruments, work with merchant acquiring;
• operation within a clear regulatory environment with established approaches to risk and compliance in fintech.

It’s important to understand the differences between Small EMI and Full EMI:

• Small EMI (sEMI):
  • typically operates within a single country;
  • limited in transaction volume and average monthly balance of client funds;
  • offers a fast market entry but scales poorly beyond the national market.
• Full EMI:
  • full EMI license EU with the standard initial capital (€350 000);
  • ability to freely passport across the EU/EEA;
  • stricter requirements for capital, governance, operational risk management and IT‑infrastructure.

Criteria for choosing a country for an EMI license in Europe

regulatory requirements and legislation

• the level of formalism of the financial services regulator (BaFin, CNB, Bank of Lithuania, Central Bank of Portugal);
• willingness to engage in dialogue in English;
• the depth of assessment of the business model and IT architecture;
• emphasis on local presence, office, resident management.

Share capital and financial requirements

• requirements for additional capital depending on the volume of operations;
• expectations regarding the structure of equity, liquidity and financial stability and reporting.

• forecast of turnovers and commission income;
• potential capital requirements over a 3–5 year horizon;
• impact on the project’s ROI and KPIs.

Application process and document review timelines

• the format of communication with the regulator (online portal, email, in-person meetings);
• number of rounds of questions;
• typical application process and review timelines in a specific country.

Taxation and cost of support

• corporate tax and the tax treatment of IP and revenues from payment services;
• the cost of external audit and accounting, the requirement for a local auditor;
• the price of ongoing compliance support and audits for the EMI business.

Requirements for top management and residency

• proven experience in payments, risk management, the banking sector;
• an impeccable business reputation;
• actual involvement in management.

• the share of resident directors;
• the need for physical presence of C-level executives;
• formal requirements for staff qualifications.

AML, KYC and compliance

• the depth and detail of the Anti‑Money Laundering (AML) policy;
• mandatory KYC procedures and AML for EMI companies;
• the models used for risk‑scoring, restrictions by jurisdictions and client types.

IT infrastructure and cybersecurity

• architecture of the core platform and accounting systems;
• presence of a PCI DSS security certificate when working with cards;
• logging systems, event monitoring, disaster recovery plan;
• data protection, compliance with European payment security standards.

External factors: Brexit and regulatory trends

• requirements for comprehensive internal documentation of an EMI company;
• expectations for disclosure of information on risks and operational processes;
• an emphasis on the resilience of models to technological and cyber risks.

Regulatory requirements in key European countries

# EMI license in Lithuania

• clear requirements, transparency and speed of review;
• willingness to engage in dialogue in English;
• clear expectations for sEMI and Full EMI licenses.

• standard share capital for an EMI license €350 000 for the full model;
• detailed requirements for the business plan and financial reporting and 3-year projections;
• special attention to the description of the product line and customer geography;
• emphasis on well-developed operational risk management and IT security policies.

# EMI license in Portugal

• standard capital, but a stricter emphasis on funds safeguarding models;
• increased focus on holding client funds in a separate account and on audit procedures for EMI companies in Portugal;
• mandatory regular external audit and accounting;
• attention to IT architecture and business continuity plans.

# EMI license in Germany

• deep analysis of financial resilience and reporting, sources of capital;
• high requirements are imposed on top management and residency, real presence in Germany;
• risks and limitations are assessed separately when licensing EMIs in Germany, including the business model and partnerships.

Specifics of EMI licensing in the Czech Republic

• standard minimum capital for a Full EMI;
• registration requirements for the legal entity (s.r.o.), a local office and part of the staff;
• emphasis on the internal control system and risk control procedures;
• clear timeframes for obtaining a license when the dossier is well prepared.

Comparison of key parameters in a table

Obtaining an EMI license in the chosen country: practical steps

Business plan and financial forecasts

• describe the target audience, product line, geography and competitive positioning;
• prepare financial statements and 3-year forecasts: P&L, cash‑flow, balance sheet, scenario analysis;
• demonstrate capital resilience and the realism of unit economics.

Internal documentation and risk management

• AML policy and KYC and AML procedures for EMI companies;
• policies and procedures for managing operational risks;
• IT security regulations, including a disaster recovery plan and business continuity;
• descriptions of risk control, escalation and reporting procedures.

company registration

• forming the shareholder structure and governance;
• appointing directors and key functions (CEO, CFO, COO, MLRO);
• opening temporary accounts for depositing the authorized capital.

Preparation and submission of the dossier

• questionnaires and resumes of key personnel;
• business plan, financial models;
• all policies and procedures;
• descriptions of IT architecture, technology base and software for the EMI;
• evidence of shareholders’ sources of funds.

Interaction with the regulator

• responses to clarification requests;
• revisions of specific sections;
• clarification of technical and organizational details.

Post-licensing support

• regular regulatory reporting and external audit;
• maintaining up-to-date AML/KYC and IT policies;
• preparation for checks and inspections;
• planned scaling of the EMI business in Europe: new countries, products, partnerships.

PSD2 compliance specifics and protection of client funds

PSD2, key requirements

• requirements for transparency of fees and terms;
• standards for access to accounts and interaction with third parties (TPP);
• the requirement for strong customer authentication and security incident management.

Safekeeping of client funds

• safeguarded accounts in banks;
• insurance or similar protection mechanisms for certain models.

Payment security and IT infrastructure

• compliance with the PCI DSS standard and security certification when working with card data;
• secure transmission channels, encryption, and segmentation of environments;
• a well-designed disaster recovery plan and business continuity plans.

AML/KYC and risk management

• multi-level customer identification (remote/on-site, by risk segments);
• transaction monitoring and detection scenarios for suspicious activity;
• regular risk reassessment and updating of customer profiles.

How to scale an EMI business in Europe after obtaining a license?

Strategy for entering the EU and EEA markets

• notifying regulators in target countries;
• setting up local processes (support, localization of documents, marketing);
• building partnerships with banks and payment infrastructure providers.

Technology base and services

• rapidly adding new payment methods and currencies;
• integrating with local payment systems;
• using data to improve risk‑scoring and the product.

Financial resilience and performance metrics

• continuous monitoring of financial resilience and reporting;
• managing capital and liquidity;
• assessing performance through key metrics (ROI and KPIs): LTV/CAC, cost‑to‑serve, share of problematic transactions, retention.

Impact of regulatory requirements on scaling

• increased focus on governance and independent directors;
• higher expectations for internal audit, second line of defence;
• requirements for capital buffers and risk models change.

Key findings and recommendations

1. Regulatory framework and practice: transparency of requirements, the regulator’s experience with fintech, realistic timelines.
2. Finances: minimum and operating capital, taxes, the cost of audit and compliance.
3. Operations and technology: requirements for office premises, personnel, IT infrastructure, payment security.
4. Growth strategy: passporting opportunities, market reception of the jurisdiction, prospects for scaling across the EU and EEA.

Over the past three years the average size of regulatory fines for financial companies in the EU and Asia has increased many times over, and some individual cases reached hundreds of millions in base currency units. The 2024–2025 sanctions restrictions led to account freezes and license revocations for otherwise stable businesses simply because their compliance system failed to keep up with the changes.

When is a compliance audit mandatory for companies

Regulatory framework: EU, Asia, CIS
In the work of the COREDO team I see three main drivers that make a compliance audit mandatory:

• direct regulatory requirements,
• conditions of financial licensing,
• sanctions-related and banking expectations regarding sanctions compliance and AML.

In the EU mandatory compliance audits for legal entities are established primarily for:

• credit and payment institutions, electronic money issuers, investment firms (MiFID, PSD2 licenses and their local implementations),
• crypto providers subject to the updated AML directives and MiCA,
• issuers of securities and companies whose securities are traded on regulated markets (requirements on internal control and risk management).

In Asia the picture is more fragmented, but the general trend is similar. In centres such as Singapore and Hong Kong, for licensable financial, payment and crypto companies:

• detailed regulatory requirements for internal control and compliance are established,
• regular monitoring and compliance audits are prescribed, often with involvement of external consultants,
• special attention is paid to compliance and AML (anti‑money laundering), as well as compliance and data protection.

Sectors with mandatory compliance audits
COREDO’s experience shows: regardless of the literal law, there are sectors where without a regular audit you will not pass either Licensing or banking compliance:

• the financial sector (banks, payment organizations, PSP, EMI, forex dealers, investment companies);
• crypto and fintech services operating in the EU, Singapore, Dubai, Cyprus, Estonia and the United Kingdom;
• companies registering legal entities in the EU with subsequent financial licensing;
• international holdings operating with sensitive markets and currencies: here compliance and risk management are already expected by the banks and partners themselves.

Sanctions, AML and increasing obligations
The 2025 sanctions regime turns compliance and sanctions risks into a key factor making checks mandatory. Banks and payment providers require from clients:

• formalized sanctions compliance,
• procedures for counterparty due diligence and supply chain control,
• evidence that compliance and protection from sanctions for the business are not a declaration but a functioning system.

Risks of non-compliance: fines and loss of licenses
Companies whose compliance and risk management exist only “on paper” face three types of consequences:

• financial fines and freezing of operations,
• regulatory risks – revocation or suspension of licenses, restrictions on new products and markets,
• reputational losses and severing of relationships with banks, payment providers and key partners.

Stages of a compliance audit from preparation to remediation
A compliance audit is a systematic review of the company’s conformity to laws, standards and internal rules, covering all key stages: from preparation and gathering the regulatory base to identifying and remedying non-compliances. For the audit to be effective, it is important to clearly define its scope and prepare a complete set of data and documents.

Preparation: verification and data collection
When I am asked how to conduct a compliance audit in a company, I always start by defining the perimeter:

• which jurisdictions (EU, Asia, CIS),
• which licenjurisdictions and types of activities,
• what processes (KYC, sanctions screening, compliance and transaction monitoring, data protection, information security, anti-corruption).

Internal compliance audit: documents and practice
Modern internal audit inevitably goes beyond a ‘paper review’. In our practice it includes:

• document analysis: compliance procedures, AML policies, anti-corruption regulations, compliance and data protection standards, information security;
• interviews with responsible persons: compliance manager, lawyers, operations specialists, risk managers;
• sample testing: how compliance and counterparty control work, how decisions on high-risk clients are documented, how red flags are recorded.

Assessment of conformity with rules and standards
The next layer: formal assessment of compliance and conformity with regulations:

• relevant EU and Asian laws on AML, sanctions, data protection and corporate governance;
• local regulatory requirements for compliance in the financial sector;
• international standards such as ISO 27001 for information security and elements of corporate governance standards.

Audit report: structure and focus
A good report is not just a list of violations. When preparing compliance audit reports I always aim for three things:

• a clear risk map by areas: AML, sanctions compliance, anti-corruption, data protection, information security, contract work;
• reference to standards: specific statutory provisions and regulator requirements that the systems fail to meet;
• impact assessment: legal, financial and reputational risks, impact on licenses and banking relationships.

Corrective measures and roadmap
The next step is recommendations to eliminate compliance gaps. At COREDO we always present them as a roadmap with prioritization:

• quick measures (1–3 months): policy amendments, strengthening counterparty due diligence procedures, additional internal control and compliance for high-risk deals;
• medium-term (3–9 months): implementation or upgrade of IT systems for compliance and process automation, strengthening compliance and information security audit, staff training;
• strategic (9–18 months): restructuring the compliance system, integration with the legal department, updating the compliance risk management model.

Monitoring and repeat checks
An audit is not the end, but a starting point. I always recommend:

• embed regular monitoring and compliance audits into policy,
• conduct selective repeat checks of key processes,
• track compliance and process maturity assessment against predefined KPIs.

The role of legal support and AML in the compliance audit
The role of legal support and AML services in the compliance audit is especially noticeable where companies need not only formal compliance with regulator requirements, but also to build a sustainable risk management system. Legal support and specialized AML services allow the compliance audit to be deeper, more accurate and directly affect the effectiveness of further integration between compliance and the legal service.

Integration of compliance and the legal department

The optimal model is integration of compliance and the legal department:

• lawyers provide legal business support, analyze legal liability, sanctions and regulatory restrictions on transactions;
• the compliance manager and his team are responsible for customer, counterparty, beneficial owner and transaction screening procedures;
• together they establish compliance and Legal review of contracts, including sanctions and AML restrictions, reps & warranties, termination clauses in case of regulatory risks.

AML services as the core of risk control
For companies applying for financial licensing or working with cross-border payments, AML services are no longer an option but a foundation:

• KYC/KYB procedures,
• screening against sanctions and PEP lists,
• transaction monitoring,
• investigation of suspicious transactions and preparation of reports to the regulator.

Company registration and compliance requirements
When registering legal entities in the EU or Asian jurisdictions, incorporation itself is no longer limited to filing documents. Banks, licensing authorities and investors expect:

• a basic compliance system,
• formalized internal control and compliance,
• compliance procedures and management of internal procedures and approval chains for transactions.

Preparation for inspections

policies, but also evidence of their real application. In such cases legal support for business and compliance work together:

• prepare a package of documents for review,
• address possible questions from the regulator,
• prepare an internal presentation of the control and sanctions risk management system.

COREDO’s experience shows: companies that have previously completed an internal compliance audit and implemented corrective measures pass external inspections noticeably more calmly.

Compliance audit under sanctions 2025
The compliance audit under sanctions in 2025 has ceased to be a “checkbox” option and has become a working tool for business survival in international markets. With increasing pressure from regulators and the growth of secondary restrictions, competent sanctions compliance has become a mandatory module of risk control systems and the basis for further steps to adapt to new requirements.

Sanctions compliance: a mandatory module
In 2025, the compliance audit under sanctions became a separate area. It includes:

• checking how sanctions filters are integrated into compliance and transaction controls;
• analysis of the geography of operations, supply chains and the financial stability of counterparties taking into account sanctions regimes;
• assessment of how quickly the company can respond to changes in lists and requirements.

Role of the compliance manager
In the sanctions agenda, the role of the compliance manager in audits is changing:

• from a “document controller” he moves to the role of a risk partner of management;
• participates in the assessment of new markets, products and partnerships;
• is responsible for compliance and the management of sanctions risks and for communication with banks and regulators.

Technology and automation

Practical recommendations for entrepreneurs and managers
For entrepreneurs and managers, a mandatory audit is not just a formality, but an important tool to verify the reliability and transparency of the business. Below are practical steps and recommendations that will help you properly prepare for the audit and pass it with minimal risks.

Preparing for the mandatory audit
If you understand that your industry and jurisdictions make a compliance audit inevitable, I recommend starting with three steps:

1. Define the regulatory map: which laws of the EU, Asia, CIS, which standards (AML, sanctions, information security, corporate governance) apply to you.
2. Conduct a rapid assessment of the compliance system: whether there are formalized policies, procedures, internal control and compliance, allocation of roles.
3. Set a budget and timeline for an internal or external compliance audit in the company.

Internal control and staff training

Scaling the compliance system

KPI and ROI of compliance

Actions when discrepancies are identified

The COREDO team often accompanies clients at this stage, helping to turn a crisis into an opportunity to strengthen the system and reinforce the trust of regulators and partners.

Mandatory compliance audit for business

Table of mandatory compliance audits by regions and industries

European regulators have radically changed their approach to card issuance. Where requirements used to be relatively flexible, they are now strict and relentless. The tightening affects everything: from customer verification procedures to technological security standards, from sanctions restrictions to tax regulation. And this is only the beginning.

Over nine years of work COREDO we have helped over 500 companies from Europe, Asia and the CIS successfully register payment services and obtain the necessary licences. Our experience has shown that success depends not only on knowledge of the law, but also on understanding how regulators interpret these requirements in practice. In this article I will share what every entrepreneur planning to work with card issuance in Europe needs to know.

Issuance of EU payment cards: who controls?

The European financial regulatory system is arranged like a matryoshka. At the top level are supranational bodies, the European Central Bank and the European Banking Authority. They set common rules and standards. At the middle level operate national central banks and financial regulators of each country. They adapt European requirements to local conditions and conduct supervision. At the lowest level are the companies themselves, which must comply with all these requirements at the same time.

COREDO’s practice confirms: companies often do not understand exactly who supervises them. For example, if you register a payment institution in Spain, you will be supervised by the Spanish regulator (Banco de España), but at the same time you must comply with the requirements of the EBA and the ECB. This means you are subject to three levels of regulation at once.

Role of the ECB, EBA and regulators in card issuance

The European Central Bank focuses on macroeconomic stability and monetary policy. But in the context of card issuance its role is critical: the ECB sets requirements for payment systems, defines security standards and monitors systemic risks. When the ECB issues a recommendation, it is not just advice — it is effectively a mandatory requirement for all market participants.

The European Banking Authority (EBA) is the body that develops technical standards for payment services. The EBA issues regular updates that define exactly how companies must implement PSD2 (Payment Services Directive 2) requirements. For example, the EBA determines which customer verification methods are considered sufficient, which technologies should be used to protect data, and how to organize monitoring of suspicious transactions.

National regulators are those who issue licenses and carry out on-site supervision. They have some freedom in interpreting European requirements, but they cannot ignore them. For example, the Spanish Banco de España may set higher capital requirements than the minimum established by the EBA, but it cannot set lower ones.

PSD2 and card issuance in 2025–2026

The main principle of PSD2 is openness and competition. The directive requires banks to open access to accounts to third parties (Open Banking), so that payment services are available not only to banks but also to specialized payment institutions, and so that customers have a choice among different service providers.

Third, Open Banking requirements. If a customer wants to connect your card to a payment aggregator service, you must provide an API for integration. This creates new opportunities but also new risks: you need to ensure that third parties meet security requirements.

COREDO’s practice has shown that many companies underestimate PSD2 requirements. They think that simply adding two-factor authentication is enough and that everything is fine. In reality, the requirements go much deeper. You need to review the entire system architecture, update processes, and train the team. We helped a Spanish company conduct a full compliance audit of PSD2, and it turned out they had more than 50 compliance gaps. After fixing these gaps the company not only avoided fines but also improved the user experience.

Sanctions restrictions and card issuance in 2025–2026

For card issuers this creates a difficult situation. If you issue cards that can be used for payments through sanctioned systems, you may be held liable. This is not just a fine; it may lead to license revocation and criminal prosecution of company executives.

The solution developed by the COREDO team: we created a sanctions monitoring system that integrates with payment systems. The system automatically checks every transaction against sanctions lists and blocks suspicious operations. This requires investment in technology, but it is necessary to comply with regulator requirements.

In addition, companies must regularly update their sanctions policies. You need to clearly define which countries and companies you do not serve, which payment systems you do not use, and how you screen customers for sanctions restrictions. All of this must be documented and reviewed regularly.

AML requirements for card issuance in 2025–2026

Regulators tightened requirements because money laundering volumes are increasing. According to the International Monetary Fund, between 2 and 5% of global GDP is laundered each year. That’s trillions of dollars. And payment systems often become a channel for these operations. Regulators decided this must change.

Updated AML and KYC standards in the EU for card issuance

Previously companies could use simplified verification for low-risk customers. Now all customers must undergo full verification. This means collecting not only passport details but also information about income sources, the company’s structure (if the customer is a legal entity), and beneficial owners.

For individuals the process looks like this: the customer uploads a copy of their passport, takes a selfie, and confirms their residential address. The system checks this data against databases (for example, against PEP lists, politically exposed persons). If the customer falls into a higher-risk category, additional verification is required.

For companies the process is much more complex. You need to collect incorporation documents, information about ownership structure, data on beneficial owners (Ultimate Beneficial Owners, UBO). You must check whether the company is connected to sanctioned countries or engaged in activities that could be linked to money laundering (for example, casinos, arms trading).

COREDO’s practice has shown that many companies underestimate the complexity of KYC for corporate clients. We helped a Lithuanian payment company develop a KYC process that includes 15 verification steps. It may seem like a lot, but it is necessary to meet regulatory requirements and to protect the company from risks.

Verification timelines have also tightened. Previously companies could complete verification within 10 days. Now verification is required within 2–5 days. This means investing in process automation. We recommend using digital identification systems (for example, eIDAS in the EU), which allow speeding up the verification process.

Reporting and monitoring of AML operations

What is considered suspicious? For example, if a customer suddenly starts making transactions totaling ten times more than usual. Or if a customer who lives in Europe makes payments to countries that are under sanctions. Or if a customer makes many small transactions that together add up to a large sum (this is called “structuring” and is a sign of money laundering).

Monitoring systems must automatically detect these patterns and generate alerts. Then a compliance specialist must analyze the alert and decide whether to file a Suspicious Activity Report (SAR) with the regulator.

Risks and management of issuing corporate cards in the EU

The main risk when issuing corporate cards is that the card may be used to finance terrorism or other illegal activities. For example, a company may be a front for money laundering. Or the card may be used to finance terrorist organizations.

To minimize these risks, companies must carry out enhanced verification for corporate clients. This includes checking the company’s ownership structure, verifying beneficial owners, screening against sanctions lists, and checking the company’s history.

In addition, companies should set limits on corporate card transactions. For example, a daily transaction amount limit, a limit on the number of transactions per day, and limits on transactions in certain countries.

COREDO’s practice has shown that companies that take risk management seriously gain an advantage. They avoid fines, they avoid account closures by banks, and they gain regulators’ trust. We helped a Spanish company develop a risk management system that includes automatic screening of all corporate clients. This led the company to identify several suspicious clients and avoid serious problems.

Registration of legal entities for card issuance in the EU

If you decided to launch a payment service with card issuance, the first question is: where to register the company? This is a critical decision that affects everything else: capital requirements, taxes, compliance requirements, and the ability to scale.

Selecting a jurisdiction to register a company for card issuance

There are several jurisdictions in the EU that specialize in payment services. Each has its own advantages and disadvantages.

• Spain: this is one of the most popular choices for startups. Capital requirements are relatively low (from €50 000 for a payment institution), the licensing process is relatively fast (3–6 months), and taxes are competitive. In addition, Spain has a well-developed ecosystem of payment companies, experienced consultants, and service providers.
• Lithuania: this is another popular choice. The Lithuanian regulator (Bank of Lithuania) is known for its progressive approach to regulation. Capital requirements are low, the licensing process is fast, and taxes are low. Lithuania is also known for its digital infrastructure and support for fintech companies.
• Luxembourg, this is a choice for companies that want to work with high-value assets. Capital requirements are high (from €1 million), but Luxembourg’s reputation as a financial center opens doors to attracting investments. Taxes in Luxembourg are also competitive thanks to tax incentives for financial companies.
• Cyprus: this is a choice for companies that want to work with clients from different regions. Cyprus has low capital requirements, a fast licensing process, and low taxes. In addition, Cyprus has good links with companies from Asia and the Middle East.

Licensing and authorization for card issuance

obtaining a license for card issuance: this is a long and complex process. It includes several stages and requires preparation of a large number of documents.

The first stage is choosing the type of license. In the EU there are two main types of licenses for payment services: Payment Institution License (лицензия платежного учреждения) and Electronic Money Institution License (лицензия учреждения электронных денег).

• Payment Institution License: issued to companies that provide money transfer services, payment processing, and issuance of payment instruments (including cards). This is the most common license for companies that want to issue cards.
• Electronic Money Institution License: issued to companies that issue electronic money (for example, prepaid cards). This license requires higher capital and stricter compliance requirements.

The third stage is submitting the application. The application is submitted through the regulator’s online portal. You need to fill out the form, upload documents, and pay the application fee (usually from €500 to €5 000).

The fourth stage is application review. The regulator checks the documents, may request additional information, and may hold a meeting with the company’s management. This stage can take from 2 to 12 months depending on the jurisdiction and the complexity of the application.

The fifth stage is receiving the license. If the regulator approves the application, the company receives the license. The license is issued for a specific period (usually 5 years) and can be renewed.

COREDO’s practice has shown that companies often underestimate the complexity of the licensing process. They think it’s enough to simply submit documents and wait for approval. In reality, you need to actively interact with the regulator, respond to requests, and provide additional information. We helped one Lithuanian company complete the licensing process in 3 months because we had prepared all documents in advance and actively engaged with the regulator.

Documents and the procedure for registering a legal entity

Before submitting an application for a license, you need to register the company. The registration process depends on the jurisdiction, but in general it looks like this:

In the EU the company registration process usually includes the following steps:

1. Choosing the company name — ensure the name is unique and does not infringe third-party rights.
2. Preparing incorporation documents: prepare the company’s articles of association, the decision to form the company, and information about directors and shareholders.
3. opening a bank account — you need to open a bank account to deposit capital.
4. Submitting documents to the company register — you need to file documents with the local company register (for example, in Spain this is the Registro Mercantil).
5. Receiving the certificate of incorporation — after approval the company receives the certificate of incorporation.

Registration times vary from 3 to 7 days depending on the jurisdiction. After registration the company can apply for a payment institution license.

Technological requirements and safety standards for card issuance

Where technology used to be merely a tool for running a business, in 2025–2026 technology has become the foundation for regulatory compliance. Regulators now require companies to adopt specific technological standards and data protection methods.

Tokenization and contactless payments: what you need to know

Contactless payments are payments made without physical contact between the card and the terminal. This can be a payment via NFC (Near Field Communication), a payment via QR code, or a payment via a mobile app. Regulators require that all companies support contactless payments and that these payments be protected against fraud.

COREDO’s experience has shown that implementing tokenization and contactless payments requires significant investments in technology. Payment processing systems need to be updated, integration with payment networks (Visa, Mastercard) is required, and testing and certification must be carried out. But these are investments that pay off through reduced fraud and improved user experience.

In 2025 Spain became one of the most attractive markets in Europe for international entrepreneurs: according to EY, more than 38% of foreign investors name the country a priority for expanding business in the EU. Nevertheless, 67% of companies face legal risks already at the registration stage, and more than 80% during scaling and entering new markets. Why does such a high percentage of businesses fail or lose profits due to legal mistakes? How can you avoid common pitfalls and ensure sustainable development?

My experience and the practice of the COREDO team show: legal support is not just a formality, but a strategic asset that allows you to minimize risks, protect capital and ensure compliance at all stages of a company’s development.

Main legal services in Spain

Legal services in Spain cover the entire business life cycle – from company registration to support for complex transactions, tax optimization and protection of intellectual property. Our experience at COREDO has shown: the success of international business is impossible without a comprehensive approach that includes corporate law, tax support, labor law, compliance and litigation representation.

Company registration in Spain: forms, documents, timelines

Starting a business in Spain begins with choosing the optimal legal form. For foreign investors the most in-demand are Sociedad Limitada (SL) and Sociedad Anónima (SA). SL – the European GmbH equivalent, suitable for small and medium businesses, SA – for large projects and public companies.

The COREDO team has implemented dozens of cases of registering SL and SA in Spain for clients from the EU and Asia. Key stages:

• Due Diligence (legal due diligence) of the structure and beneficiaries.
• Preparation of the company’s statutory documents in Spain: articles of association, decision on the appointment of directors, meeting minutes.
• Legal Opinion (legal opinion) on compliance of the business model with the requirements of Spanish legislation.
• Registration of trademarks in Spain to protect the brand.
• Obtaining a tax identification number (NIF), Opening bank accounts, obtaining licenses and permits.

Spanish corporate law: management and transactions

Spanish corporate law is not only registration, but also transaction support, legal audit, corporate restructurings and company liquidations. COREDO’s practice confirms: competent management of legal risks allows avoiding conflicts between shareholders, minimizing tax losses and ensuring protection of business owners’ assets.

Key areas:

• Support for M&A transactions: Legal review of contracts, deal structuring, Due Diligence of the target company.
• Legal audit in Spain: analysis of corporate structure, compliance, identification of risks.
• Corporate restructurings: optimization of group structure, liquidation of inefficient units, protection of shareholders’ interests.
• Legal support for international investments: preparation of legal opinion for investors, support for cross-border transactions.

Tax support in Spain: optimization, reporting, consulting

Tax support in Spain is a key element of a successful business. Spanish tax law is characterized by a complex structure, many local and national taxes, and strict reporting requirements.

The COREDO team carries out projects to optimize taxation in Spain for companies from the EU and the CIS:

• Tax planning and optimization: selection of the tax regime, structuring transactions taking into account international tax law.
• Tax audits and reporting: preparation and submission of declarations, support during tax audits, protection of the client’s interests.
• Optimization of VAT and corporate tax: implementation of VAT refund mechanisms, reduction of the tax burden on profits.
• Tax consulting for foreign entrepreneurs: advice on double taxation issues, structuring international operations.

Spanish labor law: contracts, disputes

Spanish labor law is one of the most regulated in Europe. Errors in drafting employment contracts, HR documentation or failure to meet compliance requirements can lead to serious fines and litigation.

COREDO’s practice includes:

• Drafting employment contracts under Spanish law: preparation of contracts, confidentiality agreements, data protection policies (GDPR).
• Compliance with the Whistleblowing Act: implementation of internal control procedures, protection of employees’ rights.
• Resolution of labor disputes: pre-trial settlement, representation in Spanish courts, protection of employers’ interests.
• Legal support for business processes and HR recordkeeping: audit of HR documents, staff training.

Support for real estate transactions and contracts

Real estate transactions are one of the most complex and risky segments for business in Spain. Legal review of lease and supply contracts, support for the purchase and sale of commercial real estate, asset protection for business owners are key tasks that the COREDO team handles for clients from the EU and the CIS.

Key stages:

• Legal review of lease and supply contracts: analysis of terms, protection of the interests of the tenant and the landlord.
• Legal support for real estate transactions: preparation of documents, title checks, agreement of terms.
• Asset protection for business owners: structuring transactions taking into account tax and legal risks.

Obtaining licenses and permits in Spain

For conductingFor businesses in Spain, in a number of sectors, obtaining licenses and permits is required:financial services, e-commerce, construction, tourism, healthcare.

The COREDO team supports clients at every stage:

• Obtaining licenses and permits: document preparation, interaction with regulators, Legal support for financial institutions.
• Licensing of businesses and permitting documentation: requirements analysis, structuring compliance processes.
• Support in obtaining licenses for crypto, payment, banking and forex companies.

Legal support for startups and IT companies

Startups and IT companies face unique legal challenges: intellectual property protection, cybersecurity, e-commerce regulation, structuring venture investments.

COREDO’s practice includes:

• Legal support for IT companies and startups: registration of trademarks, patents, copyrights.
• Cybersecurity and new technology law: implementation of data protection procedures, compliance with GDPR.
• Legal support for e-commerce in Spain: contract preparation, personal data protection, structuring online business.
• Venture investment support: preparation of investment agreements, legal due diligence of projects.

Litigation support in Spanish courts

Court dispute resolution is an inevitable part of business in Spain. Court representation, pre-trial procedures, and protection of company and shareholder interests are key areas that the COREDO team provides for international clients.

Key services:

• Representation in Spanish courts: protecting interests in commercial, administrative and labor disputes.
• Litigation and pre-trial procedures: mediation, arbitration, negotiations.
• Legal business protection from risks: analysis of litigation prospects, minimizing losses.

Legal support for foreign investors

Doing business in Spain for foreign investors requires a special approach: knowledge of local and international standards, integration into corporate governance, asset protection and compliance with the requirements for obtaining a residence permit and residency.

The COREDO team assists clients from Europe and Asia in the following areas:

• Support for foreign investments in Spain: legal due diligence of investment assets, deal structuring, protection of the investor’s interests.
• Legal support for foreign investors: obtaining a residence permit through business activity, preparation of documents for obtaining residency.
• Legal aspects of doing business for foreign companies: integration into corporate governance, ensuring compliance, protection of intellectual property.

How to choose a law firm in Spain?

Choosing a law firm is a strategic decision for any business. What should you pay attention to?

• Experience working with foreign investors and international projects.
• Comprehensive approach: Legal outsourcing for businesses in Spain, retainer services, consulting on corporate, tax and employment law.
• Deep expertise in transaction support, litigation, licensing and compliance.
• Transparent processes, clear communication, regular reports on results.

Legal support for businesses in Spain

1. Identify your business needs: registration, taxes, labor law, compliance.
2. Choose a law firm with experience working with foreign investors.
3. Arrange a legal audit and company Due Diligence.
4. Set up tax support and optimization.
5. Ensure compliance and adherence to the law.
6. Draw up employment contracts and HR documentation.
7. Obtain the necessary licenses and permits.
8. Arrange litigation support and asset protection.
9. Regularly conduct legal audits and Due Diligence.
10. Use legal outsourcing to save resources.

Minimize risks and scale your business in Spain

legal protection for businesses from risks in Spain, is not a one-time service, but an ongoing process that requires a comprehensive approach, professionalism and strategic vision. Legal business security, management of legal risks, protection of owners’ assets – key elements of long-term success.

COREDO’s solutions allow entrepreneurs, managers and investors:

• To focus on business development without being distracted by legal issues.
• To minimize risks related to taxes, employment law, transactions and litigation.
• To effectively scale the business in Spain using legal outsourcing and consulting for international business.

Legal services in Spain

Practical steps for entrepreneurs

1. Identify business needs: registration, taxes, labor law, compliance.
2. Choose a law firm with experience working with foreign investors.
3. Arrange a legal audit and due diligence of the company.
4. Set up tax support and optimization.
5. Ensure compliance and adherence to legislation.
6. Prepare employment contracts and HR documentation.
7. Obtain the necessary licenses and permits.
8. Arrange litigation support and asset protection.
9. Conduct regular legal audits and due diligence.
10. Use legal outsourcing to save resources.

Legal business support in Spain – is a strategic tool for minimizing risks, ensuring compliance with legislation and effective scaling. Solutions developed by COREDO enable entrepreneurs and investors to build a sustainable business, protect capital and implement international projects with confidence in legal security.

Why do even experienced executives waste time and resources trying to figure out the nuances of Polish corporate and labor law? How can you avoid legal pitfalls and ensure process transparency when entering the EU market through Poland?

If you are looking not for abstract advice but for concrete solutions, read the article to the end. Here you will find practical recommendations, case studies and tools that will help minimize risks, save time, and build effective legal support for your business in Poland.

Main areas of legal support in Poland

Company registration in Poland: basics

The solution developed at COREDO includes a detailed analysis of the client’s objectives, selection of the ownership form taking into account tax planning and corporate governance requirements. For example, for tech startups and companies focused on international investments, Sp. z o.o. provides flexibility, minimal share capital and ease of attracting new partners. For large holding structures, S.A. opens access to the stock market and corporate governance instruments.

Special attention is paid to issues of legalizing foreign business and corporate governance. It is important not only to correctly draft meeting resolutions and the articles of association, but also to build an internal control system that complies with the requirements of Polish law and EU standards.

Corporate law and contract support

Within contract law and contract drafting, special importance is given to adapting documents to international standards (for example, ICC, UNIDROIT), as well as considering the specifics of Polish and European legislation. For COREDO’s clients we develop comprehensive contract packages that include not only the main terms but also dispute resolution mechanisms, intellectual property protection, confidentiality and compliance provisions.

Legal consultations and business support

The COREDO team supports clients at all stages: from pre-trial dispute resolution to representation in arbitration and administrative proceedings. Special attention is paid to legal due diligence of counterparties and risk audits – these tools allow identification of potential threats even before concluding a transaction and minimize the likelihood of financial and reputational losses.

Legal audit and risk assessment are not one-time procedures but systemic tools of business management that include analysis of corporate structure, compliance procedures, tax obligations and employment relations.

Employment law and taxes in Poland

At COREDO we develop bespoke employment contracts and internal regulations that take into account the specifics of the industry, the scale of the business and GDPR requirements for the protection of employees’ personal data. Preparing employment contracts and regulations in Poland includes agreeing on pay terms, work schedules, incentive systems and procedures for resolving labor conflicts.

Legal assistance during tax audits in Poland includes document preparation, support for communication with tax authorities, appealing decisions and defending the company’s interests in court.

AML services and compliance for businesses in Poland

legal services for startups and innovative companies include not only basic compliance procedures, but also the development of tailored solutions for working with new financial instruments, digital assets, and cross-border operations.

Legal support for real estate and intellectual property

Intellectual property protection in Poland is another important aspect for companies operating in the innovation and IT sectors. trademark registration and patents, as well as legal support for licensing and certification, provide not only asset protection but also competitive advantages in the market.

The COREDO team supports clients at all stages: from filing an application with the UPRP (Polish Patent Office) to defending rights in case of infringement and appealing decisions of government authorities.

Legalization and immigration law for entrepreneurs

The solution implemented by the COREDO team includes analysis of the client’s individual situation, preparation and support for submitting documents, and interaction with voivodeship authorities and migration services. Particular attention is paid to issues of legalizing foreign businesses, verifying sources of investments and ensuring transparency of the ownership structure.

Legal assistance in resolving immigration issues allows clients not only to obtain a residence permit but also to build a long-term strategy for staying and developing a business in Poland.

Practical tips for entrepreneurs

Choosing a reliable legal partner in Poland: a strategically important decision for any business focused on long-term development and risk minimization. COREDO’s experience shows: the key mistakes in legal support of business are related to underestimating compliance procedures, a formal approach to document execution, and the lack of systematic risk audits.

I recommend paying attention to the following aspects:

• Check the team’s experience and expertise in supporting international projects.
• Assess the transparency of processes, the presence of clear regulations and internal control systems.
• Use legal audits and counterparty due diligence as regular risk management tools.
• Implement modern compliance procedures that meet EU standards and the requirements of Polish law.
• Evaluate the effectiveness of legal support through ROI metrics: reduction in the number of disputes, acceleration of transactions, minimization of fines and delays.

Table of legal services and benefits

Conclusion

Poland remains one of the most attractive markets for entrepreneurs entering the European Union. But along with open opportunities come concrete legal requirements, ignoring which turns a strategic move into an expensive risk. COREDO’s experience shows: companies that build a sound legal architecture from the earliest stages — from registering the structure to implementing compliance and tax planning — not only avoid difficulties but also gain a real competitive advantage.

Properly prepared corporate documents, a transparent contractual framework, an internal control system, legal cleanliness of transactions and compliance with labor, tax and AML legislation — all of this forms the foundation on which a business can be safely scaled. In the context of strict European regulation, those who act based on data, expertise and a strategic approach win.

Success in the European market begins with the right legal decisions.

Why, despite the apparent simplicity, are many applications rejected or delayed for months? How can you avoid common mistakes, ensure full compliance with ACRA requirements, and obtain not just a certificate but real access to global opportunities?

I, Nikita Veremeev, founder of COREDO, face the questions daily: “How long does company registration in Singapore actually take? What documents are needed? What are the risks and hidden costs?” Over the years, the COREDO team has implemented dozens of successful projects to launch businesses in Singapore: from fintech startups to international holdings. In this article I will not only explain the step-by-step registration procedure in detail, but also share strategic advice that will help you not just open a company, but build a transparent, sustainable and scalable structure for entering the markets of Asia and the world. If you want not a theoretical instruction but a practical guide that takes into account the latest changes in legislation, read the article to the end: you will find answers to key questions and be able to avoid common mistakes.

Company registration in Singapore for business

company registration in Singapore: this is far more than a formal procedure — it opens access to a powerful international infrastructure, a favorable tax system and one of the most stable financial centres in the world. That is why this step is critical for international business: effective entry into global markets and sustainable development largely depend on choosing the right jurisdiction and understanding Singapore’s regulatory environment.

The role of ACRA in regulating business in Singapore

Benefits of registering a company in Singapore

• Legal operation in a global hub: Singapore ranks among the top 3 jurisdictions worldwide for ease of doing business and provides direct access to Southeast Asian markets and the rest of the world.
• Transparency and speed: The process is fully digitized, and most applications are approved within 1–3 days.
• Unified regulatory standards: Compliance with international AML/CTF standards, which facilitates opening accounts and working with investors.
• Trust of partners and clients: The reputation of the Singapore jurisdiction facilitates attracting investment and entering into partnership agreements.
• Flexibility to scale: The ability to quickly expand operations, open branches and obtain licenses for specific types of business.

Types of businesses requiring registration in Singapore

• Financial services: Fintech, payment systems, cryptocurrency platforms, investment funds.
• Technology startups: AI, SaaS, blockchain, cybersecurity.
• International trade and holdings: Companies operating in foreign markets.

Types of legal entities and business licenses

Types of legal entities and licenses are key parameters that determine the strategy and success of your business on the international market. The right choice of company form and required license defines not only the legal structure, but also the level of protection, management flexibility and tax advantages for your project. Below we will review the main options and features to consider when launching a business abroad.

Private Limited Company (Pte Ltd): what is it?

Licenses for specialized activities

• financial licenses (EMI, payment, cryptocurrency): Required for companies issuing electronic money, providing payment services or working with crypto assets. The licensing procedure is regulated by the Monetary Authority of Singapore (MAS) and requires a separate set of documents, a business plan, an AML/CTF system and internal controls.
• Technology licenses: For IT companies working with personal data, registration with the PDPC is required and compliance with cybersecurity standards must be ensured.

Step-by-step company registration in Singapore

The step-by-step procedure for company registration in Singapore allows you to structure the process from analyzing the business idea to obtaining the legal status of a new enterprise. Let’s review the key stages to organize preparation and avoid common mistakes when starting a business in one of the world’s most attractive jurisdictions.

Preparation and analysis — Stage 1

• Choosing a name: The name must be unique and comply with ACRA requirements. Checking and reservation are carried out via the BizFile+ online portal.
• Determining the structure: Appointment of at least one resident director (a citizen or resident of Singapore), determination of the composition of shareholders, the company secretary, and the registered address.
• Preparing the document package: Founding documents, the constitution, information about directors and shareholders, proof of address, a business plan, information about beneficiaries and sources of funds.

Submission of the application via BizFile+ and payment of fees

• All documents are submitted through the BizFile+ electronic system. Payment of the government fee is a mandatory step (from 315 SGD).
• After submission, ACRA conducts an automatic check and, if necessary, requests additional information.

Obtaining the registration certificate and UEN

• Upon successful consideration, the company receives a certificate of registration and a Unique Entity Number (UEN), which is required to open bank accounts and conduct business.

Post-registration requirements

• Maintaining registers of controllers and directors: From 2025, a mandatory requirement for all companies to maintain up-to-date registers of controllers and nominee directors.
• Annual reporting: Filing the Annual Return, financial statements, and confirmation of controller details.
• Compliance with AML/CTF requirements: For licensable activities: implementation of KYC, transaction monitoring, and reporting suspicious transactions.

Financial and operational requirements

Financial and operational requirements are the basic conditions that any business must meet at the stage of launch and while operating. Within these requirements it is important to determine the minimum capital, estimate the cost of registration, and properly organize all necessary financial and operational processes.

Minimum capital and registration costs

• Minimum share capital – 1 SGD, but to open an account and obtain licenses it is recommended to have 10,000–100,000 SGD, depending on the field of activity.
• Government fees from 315 SGD for registration; additional expenses for document preparation and legal support – 2,000–10,000 SGD.

Operating costs and compliance

• Annual expenses: bookkeeping, audit (for companies with turnover above 10 mln SGD), legal services, compliance support.
• Penalties for breaching ACRA requirements: up to 600 SGD for late filing, up to 50,000 SGD and criminal liability for violations of the new rules on corporate service providers.

Compliance and Data Protection Requirements

Modern compliance requirements, AML/CTF and data protection are becoming a mandatory part of the operations of all companies involved in finance and the processing of personal information. Adherence to these standards not only helps minimize the risk of legal violations but also ensures the trust of clients, regulators and partners. Below we will examine the specifics of approaches to AML/CTF and KYC, which are key elements of an effective compliance system.

AML/CTF and KYC

• Companies operating in the financial sector are required to implement KYC procedures, transaction monitoring and reporting of suspicious activities in accordance with MAS requirements and the international FATF standards.
• Internal audit, risk management systems and regular reviews are mandatory elements for preventing financial crimes.

Cybersecurity and Data Protection

• For IT companies and fintech, mandatory implementation of cybersecurity standards (ISO 27001 and higher), data encryption, protection of customer information, and uninterrupted platform operation.
• Violation of PDPC data protection requirements may result in fines and restrictions on operations.

Business expansion and additional licenses

Business expansion is often associated with entering new areas or adding additional services, which may require obtaining new permits. In some cases, conducting certain types of activities requires obtaining additional licenses to comply with legal requirements and avoid legal risks.

When an additional license is needed

• When adding new types of activities (for example, launching payment or cryptocurrency services) a sector-specific MAS license is required.
• For crowdfunding platforms – a separate licensing procedure and compliance with investor protection requirements.

Scaling and entering international markets

• Registration in Singapore opens up opportunities for rapid scaling, opening branches in other countries, participating in international accelerators, and attracting investment.
• COREDO solutions allow integrating a Singaporean structure into global holdings taking into account the requirements of the EU, the UK, Dubai and other jurisdictions.

Common mistakes and how to avoid them

Typical registration mistakes and business support errors in Singapore can significantly reduce its efficiency and partners’ trust. To avoid unnecessary problems and losses, it is important to identify the main mistakes in advance and know how to prevent them. In this section we will look at the key groups of mistakes and simple ways to prevent them.

Documentation errors

• Incomplete set of documents, inaccurate information about beneficiaries, weak business plan, lack of a description of the risk management system – the main causes of delays and refusals.
• COREDO practice: double-checking documents and preliminary coordination with ACRA help minimize risks.

Management qualifications

• Lack of a resident director, insufficient management experience, reputational risks – common reasons for rejection.
• Solution: engaging professional directors and corporate secretaries with experience working in Singapore.

Insufficient financial preparation

• Capital below the minimum, lack of reserves, unrealistic financial forecasts.
• Recommendation: maintain capital sufficient to cover 6–12 months of operating activity.

Registration timelines: realistic expectations

Causes of delays: incomplete documentation, complexity of the business model, additional ACRA requests, need for licensing.

Practical Recommendations and Checklist

• Conduct a business model audit: Determine whether a license is required and which type of company suits your business.
• Prepare documents in advance: Use COREDO checklists and coordinate the structure with consultants beforehand.
• Appoint a resident director and a corporate secretary: This is a mandatory requirement for registration.
• Invest in compliance and cybersecurity: This is not only a legal requirement but also helps build trust with partners and clients.
• Plan your budget with a buffer: Account for not only registration costs but also operating expenses for the first year.
• Be prepared for annual audits and reporting: Non-compliance with requirements can result in fines and suspension of operations.

Myth of “zero taxes” in Estonia is actively discussed among entrepreneurs, but behind this loud name lies a feature of the local tax system, not a complete absence of fiscal obligations. To understand what you need to know about the real taxation mechanisms in the country, it’s important to figure out how the deferred taxation system operates and why it creates the myth of zero taxes.

How taxation works in Estonia: deferred taxation

The main misconception: “tax-free company in Estonia“: is based on the unique system of deferred taxation of profits. In reality, an Estonian company without taxes is possible only if certain conditions are met. In Estonia, corporate income tax is not collected until dividends are distributed: as long as profit remains in the company, the tax rate is 0%. This is not an exemption from taxes but a deferral. Only when the company decides to pay dividends does a tax liability arise: a rate of 22/78 of the dividend amount, and from 2025 an additional 2% is added to the security fund.

Conditions under which a company does not pay taxes

For an Estonian company not to pay taxes, several key conditions must be met:

• The share capital is fully paid and registered in the Commercial Register.
• The annual report is prepared, approved and filed on time.
• The financial year ended with a profit or accumulated profits from previous years.
• Dividends are not distributed to shareholders; profit remains in the company’s accounts.
• The company strictly complies with the requirements of Estonian and EU legislation, including AML and tax transparency.

When do tax liabilities on dividends arise?

Tax optimization for business in Estonia requires a clear understanding of events that lead to tax liabilities:

• Distribution of dividends: tax 22/78 of the amount + 2% to the security fund (from 2025). Payment is possible only after approval of the annual report and provided solvency is maintained.
• Salary payment: social tax 33%, income tax 22%, pension tax 2%, insurance contributions — in total the tax burden on salary reaches 59.4% in 2025.
• Representative expenses: the limit has been increased to 50 euros per month from 2025; anything above is taxed at 2% of the amount.
• Cross-border transactions: subject to price control, require special reporting and may entail additional assessments if transfer pricing rules are not followed.

Registration of a company in Estonia: step-by-step guide

Company registration in Estonia: a step-by-step guide for foreign entrepreneurs opens quick access to European markets and allows doing business fully online thanks to the e-Residency program. Before starting the registration, it is important to know the basic requirements for share capital and the set of documents for registering an LLC (OÜ) so that the process goes as transparently and efficiently as possible.

Requirements for share capital and documents for registering an LLC

The minimum share capital in Estonia is symbolic, only €0.01. On the other hand, COREDO’s practice shows: to increase trust from banks and business partners it is optimal to declare capital from €2,500. This reduces the risk of account blocking and makes KYC procedures easier. The capital must be paid before the first dividend distribution and entered in the Commercial Register, and also reflected in the TSD form (tax reporting).

To register a company you will need: