Blog

Practice at COREDO confirms: the question “who is responsible for AI errors” is no longer an academic discussion. This is a daily management task related to liability for AI, compliance, contracts and insurance, which determines the cost of capital, time-to-market and strategic resilience.

Why is the board of directors responsible for AI?

Our experience at COREDO has shown that even “moderate” incidents, such as erroneous AI recommendations in sales, lead to costly process reworks and the revision of contractual obligations. Add to that the jurisdictional issues in cross-border AI errors, and you’ll understand why companies with operations in Europe, Asia and the Middle East are building a unified accountability architecture for autonomous systems and their suppliers.

Regulatory framework of Europe, Asia and the CIS

In the EU the AI Act has been adopted, which establishes a risk-oriented approach and introduces specific roles of responsible persons for high-risk systems (EU AI Act requirements for responsible persons). AI regulation in the EU is closely linked to the GDPR and liability for automated decisions, including the right to an explanation and administrative rights of data subjects. AI regulators in Europe rely on coordination with the EDPB and ENISA, and national agencies issue sectoral guides and create regulatory sandboxes for AI.

In Asia the regulatory landscape is fragmented, but requirements for algorithmic transparency, bias control and data security are being strengthened across the board. Countries where the COREDO team is actively working, for example, Singapore, promote soft-regulation models with strict standards for privacy by design and audits. In the CIS we see a move toward harmonization with international ISO standards and the OECD AI Principles and UNESCO recommendations on AI ethics.

Strict liability vs negligence: manufacturer and supplier liability

Lawyers are familiar with two main constructs: strict liability vs liability for negligence in AI. Under strict (product) liability for model defects the question is the existence of a defect and causation; under negligence – the proof of a breach of the standard of due care. In the European approach product liability for model defects and the legal foundations of strict product liability can affect both the AI manufacturer and the integrator if the defect arose as a result of modification or incorrect integration.

Liability of model providers and the responsibility frameworks for platforms as service providers become more acute when open source models are used. licensing terms of open source models and the legal assessment of open AI APIs and third‑party integrations require careful certification of the supply chain: provenance control, model cards, datasheets for datasets and security audits of code and model provenance analysis.

Risks in contracts: indemnity and SLA/SLO

The solution developed at COREDO always begins with mapping risks to contractual AI risk management mechanisms. Contractual unloading of AI liability requires multi-level clauses: indemnification for IP infringements and privacy breaches, clauses on non-use of data for re-training, warranties of compliance with standards and security, clear limitation of liability with carve-outs for intent and gross negligence.

• Indemnities and clauses in contracts with AI vendors set out coverage for claims related to bias, security, leaks and defects. It is important to determine who is responsible for harm caused by AI to the client when the model operates as part of a complex solution.
• Model SLAs and SLOs for business applications define target levels of accuracy, latency, availability and data quality metrics. Vendor due diligence and security SLAs include requirements for encryption, access management, logging and incident response times.
• How to allocate responsibility between the customer and the AI vendor? Through a matrix of “who manages data/training/deployment/monitoring” and tying risks to control domains. For generative models add risk management practices when using generative AI: content filters, watermarking, a deepfake policy and human-in-the-loop for sensitive decisions.
• Best practices contract templates for procuring AI solutions include provisions on regulatory changes (change-in-law), obligations to maintain an audit trail, provide evidence packages and cooperate during audits.

How to embed control into engineering

Compliance and Due Diligence for AI‑providers starts with assessing the provider against AI standards and certification (ISO/IEC 23894, ISO/IEC 27001 and national standards), as well as GDPR compliance. Regulatory requirements for model audits, algorithm audits and proof of due diligence require documentation across the whole chain: from data to deployment.

COREDO’s practice confirms: legal risk decreases when technical processes are transparent. To this end we implement:

• Algorithmic transparency and explainability: model cards, datasheets for datasets, explainability metrics (SHAP, LIME, counterfactuals) and interpretability and model debugging tools.
• Model version control and provenance: immutable artifact registries, role‑based access and model change audit, strict tagging policies for data and features.
• Decision logging and audit trail for AI plus forensic logging for investigating causes of errors; this is the basis for defence in disputes and for regulatory reporting.
• Algorithmic bias and fairness metrics, regular robustness testing and adversarial testing, as well as red teaming and stress testing of models.
• Model drift control and performance monitoring, KRI and SLO, external validation and model benchmarking, peer review of models and independent technical audit.
• MLOps practices for controlled risk and comparison of DevOps vs MLOps for model stability: reproducibility pipelines, data control, pre-release testing.
• Data quality control tools and data validation, data quality control during cross-border transfer and data governance.
• Compliance by design and documenting AI decisions, privacy by design and privacy impact assessment, as well as algorithmic impact assessment (AIA) for high-risk systems.

Where AI errors in AML/KYC are particularly costly

In payment and credit services, the question “who is responsible for erroneous algorithmic decisions in finance” is resolved at the intersection of banking supervision, the AI Act and the GDPR. regulatory requirements to explain lending decisions force operators to demonstrate explainability, traceability and the absence of discrimination.

Liability for AI errors in AML and KYC systems also concerns errors such as false positives/false negatives. Managing incidents of false positives and false negatives requires human oversight and human-in-the-loop, clear escalation and logging playbooks. AML automation, errors and regulatory liability entail fines and enforcement orders if the operator cannot demonstrate due diligence and the adequacy of algorithms.

Insurance and preparedness for claims

Who is responsible for harm caused to a client by AI is often determined by how prepared the company is for an incident. An AI incident response playbook should include model shutdown scenarios, fallbacks to manual procedures, regulator notification, and customer communications. Forensic logging and complete decision logs reduce the cost of investigations and accelerate resolution.

AI risk insurance: another pillar. In practice we structure coverage through:

• Insurance products: cyber for data breaches and security incidents; professional indemnity and tech E&O for professional liability, software defects, and service failures.
• selection criteria for AI insurance coverage: geography of risk, type of solutions (generative/classification), data volumes, presence of human-in-the-loop, incident history, regulatory requirements.
• Pricing of insurance premiums for AI risks depends on MLOps maturity, logging quality, external audits, and available certifications.

The role of the board of directors: strategy

The economics of AI scaling aggravate the consequences of model defects: systemic risk from widespread use of homogeneous models can lead to simultaneous failures for many clients. Model resilience metrics when scaling, management of technical debt and the risk of accumulation during model development, as well as external validation and benchmarking become strategic KPIs.

How COREDO allocates and retains risk

• EU, Licensing of a payment institution. The client implemented scoring using AI. We built explainability based on SHAP and counterfactuals, conducted a privacy impact assessment and an algorithmic impact assessment (AIA), and prepared model cards and datasheets for datasets. We contractually established indemnification for discrimination and limited the client’s liability provided compliance with SLA/SLO and human‑in‑the‑loop procedures. The regulator approved the model within a regulatory sandbox, and the subsequent registration and notifications to regulators about high‑risk systems were completed without comments.
• Singapore, fintech provider AML/KYC. The system produced a high level of false positives. The COREDO team implemented incident management for false positives and false negatives, strengthened drift monitoring and adversarial testing. We documented a vendor warranty on model quality and quick version downgrade procedures in the contracts. Result — reduced operational costs and confirmation of compliance with the national agency’s requirements.
• Dubai, recommendation and advertising platform. The task was to control compliance of advertising recommendations and manipulations and to regulate deepfakes. Our solution included watermarking, a content policy, and clauses on the provider’s right to disable generative content in case of compliance risks. This allowed the platform to avoid consumer claims and ensure the right to an explanation during moderation.
• United Kingdom, HR automation using open‑source models. We conducted a legal review of open‑source model license terms and third‑party integrations, implemented fairness metrics and an independent peer review. We contractually established a division of responsibility between the client and the AI vendor, including warranties and limitation of liability, as well as a due diligence checklist for AI vendors with requirements for audit trails and data governance.

Due diligence checklist: implementation steps

Чтобы минимизировать юридический риск ИИ и ускорить интеграцию, рекомендую последовательность, которую команда COREDO отточила на разных рынках:

1. Risk classification and regulatory pathway
   • Identify the risk category under the AI Act and the relevant guidance from regulators (EDPB, ENISA, national agencies).
   • Check the need for registration/notification and participation in regulatory sandboxes.
2. Data and IP
   • Conduct data mapping, manage third‑party rights in training data, protect IP, and assess trade‑secret disclosure risks.
   • Limit cross‑border transfers, implement privacy‑by‑design and DPIA, and control the vendor’s data usage terms.
3. Model and engineering
   • Implement MLOps: versioning, KRI, drift monitoring, robustness tests and adversarial testing, red teaming, interpretability.
   • Prepare model cards, datasheets, audit trail, forensic logging, access control tools and role‑based access.
4. People and processes
   • Implement human‑in‑the‑loop where decisions affect the rights of data subjects.
   • Train staff, introduce competency certificates and an incident playbook.
5. Contracts and insurance
   • Set up indemnification, warranties, limitation of liability, SLA/SLO and change‑in‑law clauses.
   • Select insurance products (cyber, professional indemnity, tech E&O) and calculate premiums taking control maturity into account.
6. Reporting and audit
   • Prepare requirements for test documentation and reporting to regulators.
   • Appoint regular peer reviews and independent technical audits, and arrange external validation and benchmarking.
7. Disputes and reserves
   • Assess compensation models for affected parties, methodologies for calculating financial risk, and reserves for claims.
   • Plan resources for legal disputes and a communications strategy.

COREDO accelerates and safeguards innovation

Our experience at COREDO has shown: businesses need a partner who combines licensing, international registration and AI compliance into a single roadmap. For companies entering the EU, the Czech Republic, Slovakia, Cyprus, Estonia, the United Kingdom, Singapore and Dubai, we build infrastructure that withstands audits and scaling.

• Registration and licensing. We support licenses for payments, forex and crypto services, taking into account best practices for implementing AI in financial services and local regulators’ expectations.
• Contractual architecture. We develop legal mechanisms for allocating risk across the AI ecosystem, including best practices contract templates, indemnities, warranties and SLA/SLO.
• Technical compliance. We implement compliance by design: audit trail, explainability, data governance, AIA/DPIA, provenance control, regulatory monitoring tools and compliance automation.
• Insurance and financial planning. We set up insurance coverage and help assess the cost of an AI error, systemic risk and ROI taking control measures into account.
• Corporate oversight. We help boards of directors build a generative AI policy, ethical standards and training programs, including the role of committees and model resilience KPIs.
• Regulatory engagement. We support projects in sandboxes, arrange registrations and notifications, and prepare reporting and communications with regulators.

Conclusions

responsibility for errors of AI: it is not a show-stopper, but a manageable factor. When you have a clear allocation of roles between the AI manufacturer, the model provider, the integrator and the client, when contracts cover key risks, and the engineering environment provides explainability, an audit trail and resilience, you reduce the likelihood of disputes and accelerate innovation.

Since 2016 I have been developing COREDO as a partner for entrepreneurs for whom technology, finance and law form a single growth ecosystem. During this time the COREDO team has implemented dozens of projects in the EU, the UK, Singapore, Dubai, the Czech Republic, Slovakia, Cyprus and Estonia, registering legal entities, obtaining financial licences and building AML frameworks. Today I see a key challenge for those implementing algorithmic recommendations: legal liability for AI errors in finance is distributed among several participants and jurisdictions, and the rules are changing faster than IT teams’ roadmaps.

Regulatory map: what’s changing

AI regulation‑advisors in the EU has become systemic: The European AI Act, MiFID II, DORA and ESMA/EBA guidance letters shape requirements for explainability, operational resilience and model risk management. In practice this means: any platform with automated investment recommendations falls under the “high‑risk” test; it needs model documentation, decision logs, model validation procedures and human‑in‑the‑loop for critical actions. COREDO’s practice confirms: where a client has implemented explainability and logging in advance, the risk of regulatory claims is significantly lower.

United Kingdom follows the principle «same risk, same regulation» through the FCA, emphasizing conflict of interest management, bias tests and documentation of model assumptions. In Estonia and Cyprus regulators apply MiFID II and, in places, local clarifications for robo‑advice. In the Czech Republic and Slovakia central banks focus on operational risk and DORA approaches. COREDO’s team adapts licensing packages and internal policies taking these nuances into account so that the registration of AI financial advisors proceeds without legal gaps.

Who is responsible for the AI advisor’s decision

The commercial liability of the AI solution provider is contract‑based: warranties of operability, caps on losses, exclusion of indirect damages and indemnity for IP claims and data breach. Product liability (product liability), however, can arise outside the contract if a software defect is proven. In contracts we record the allocation: manufacturer’s fault vs user’s fault in an AI error linked to zones of control, data, parameters, environment, updates.

The human‑in‑the‑loop (human‑in‑the‑loop) and the legal consequences come down to the question: whose action triggered the loss. If the interface explicitly required a human to confirm the investment advice, and the confirmation was given without verification, liability shifts to the person who made the decision. Where the system executes the advice automatically, the regulator expects enhanced measures of explainability, alerting and risk limits.

The rights and duties of depositaries regarding AI advice in funds (UCITS/AIFMD) remain classic: safekeeping of assets and oversight of compliance with the investment mandate. If AI leads to deviations from limits, the depositary must signal and block the breach, otherwise joint liability with the manager arises.

Contractual architecture: risks upfront

Contractual liability when implementing an AI adviser is not a single clause, but a system. I consider four blocks to be fundamental: limitation of liability and contract disclaimers for AI (liability cap, exclusion of indirect/ consequential damages, warranty disclaimers), a contract for AI customization and risk allocation (transfer of liability for changes), vendor management and legal liability of contractors (flow‑down of obligations), as well as SLAs and KPIs for AI services.

In SLAs we include metrics not only for uptime but also model performance: tracking error, drawdown thresholds, training details (data freshness SLAs), explainability latency and time for human review. COREDO’s practice confirms: such KPIs help demonstrate Due Diligence to the regulator and structure incident-response procedures.

Contracts for AI customization and risk allocation take into account the use of open‑source and pretrained models (transfer learning). If an open‑source component causes a licensing conflict or a vulnerability, the vendor must provide indemnity and an obligation for prompt remediation. For clients with an international footprint we add a prohibition on unauthorized transfer learning on client data and specify rights to model artifacts.

Automation of AML and compliance

Liability for AML violations in AI recommendations most often arises in automated KYC, transaction monitoring and sanctions screening workflows. EU regulators rely on AMLD frameworks, in Asia: on comparable acts and central bank guidance; in some African markets, less formalized, but local risks are high due to poor-quality lists and limited data sources. The COREDO team builds data quality controls and escalation processes so that garbage-in garbage-out does not become the cause of a fine.

Model risk management: documentation

Model validation (model validation) and related legal protection go hand in hand. We build three lines of defense: development with unit‑ and integration‑tests, independent validation (backtesting, stress, calibration) and a model committee audit. Model risk metrics include VAR tests, evaluation of performance drift and probability calibration for credit and market models. Such a framework provides causation (causation) in your favor when forensic ML is required.

regulatory requirements for AI explainability (explainability) vary, but the trend is fixed: document features, limitations, applicability and counterfactual explanations (counterfactual analysis). In investment recommendations local regulators require a clear rationale, even if the internal model is a complex ensemble. A solution developed at COREDO records the decision path and confidence score, which reduces disputes about foreseeability and the limits of liability for unforeseen advice.

Technical auditability: logging, an audit trail and decision replication are part of our mandatory setup. We recommend immutable logs, versioning of models and datasets, artifact hashing and time-stamping. This creates evidentiary proof of actions during an incident and helps distinguish a software defect from incorrect data interpretation.

Testing for adversarial attacks and legal security obligations come to the forefront: data poisoning, prompt injection in generative components and bypasses of restrictions. We combine ISO 27001 requirements, role‑based access control, separation of duties (Dev/ML/SOC) and signed approvals for deployment. Our experience at COREDO has shown: formal change‑management logs often resolve a dispute about blame long before court.

Data governance covers provenance, lineage, consent and retention, including confidentiality and cross-border transfer of personal data (GDPR‑like regimes). For open banking and API connections to AI advisors, PSD2/OB framework restrictions apply: customer consent, channel security and clear allocation of responsibility between the TPP, the bank and the platform.

Legal consequences of incidents

Direct damage and lost profits from errors of an AI adviser are assessed using damages methodologies that take into account VAR, drawdown, tracking error and the market environment. The rigor of the evidentiary base requires establishing causation: without forensic ML and counterfactual analysis, showing that the algorithm specifically caused the loss is difficult. We prepare clients for this in advance: model cards, data versions and replication of experiments.

Public reporting and disclosure of AI use to investors are gradually becoming a market standard. In several COREDO projects we prepared sections of AI ethics policy where we documented good faith, absence of discrimination and explainability — this reduced reputational risk in incidents.

Insurance and financial guarantees

risk insurance of AI errors (AI liability insurance) complements professional indemnity and cyber insurance (cyber). Insurers look at the maturity of model risk governance, the presence of human‑in‑the‑loop, logs and regular validations. I advise drafting insurance clauses with requirements for notification, the right of recourse and coordination of dispute resolution.

Allocation of responsibility in COREDO cases

Practical case: liability in the event of an incorrect liquidity forecast. A platform in the EU issued a rebalancing recommendation without taking local clearing windows into account; a temporary liquidity shortfall occurred. The COREDO team conducted forensic ML, proved model drift due to an outdated feed and initiated a review of the SLA with the data provider. Responsibility was split: the feed provider compensated direct losses up to the cap, the asset manager assumed operational costs and revised the human override.

AML case: an automated KYC missed a client’s sanctions indicator in Asia. During the root cause analysis we identified data poisoning; an external database had applied the wrong tag. The solution developed at COREDO included immutable logs and alert corridors, so the regulator assessed the due diligence positively. Compensation was limited to administrative measures, and the data vendor accepted indemnity for the error.

Model drift in a new market: scaling to Dubai led to an increase in suitability errors. We insisted on a staged rollout, a control period with human-in-the-loop and limits on automatic execution. After three weeks the metrics stabilized; this illustrates the cost-benefit analysis of implementing human-in-the-loop to reduce liability.

Registration of an AI advisor and Licensing: in Singapore the client obtained a license with COREDO’s support, embedding algorithm transparency rules, vendor audits and explainability procedures. In the EU a similar service is structured under MiFID II with a focus on suitability and DORA controls; for Estonia we prepared local policies and reports for the FSA.

From idea to sustainable practice

Due diligence when implementing AI:

• Regulatory map: AI Act, MiFID II, DORA, GDPR‑like regimes, MAS, SFC.
• Assessment of legal risks of using AI for asset management: licenses, limits of automation, open banking/APIs.
• Vendor due diligence: certificates, SOC reports, incident history, bias policy.
• Contractual architecture: caps, indemnities, warranty disclaimers, arbitration clauses, choice of law.

Design of corporate AI governance:

• Model committee, independent validation, periodic review, model cards.
• Logging, versioning, immutable audit trail, blockchain‑stamps.
• Access control: RBAC, segregation of duties, role of SOC/DevOps.
• AI ethics policies, conflict of interest management and public disclosure.

Contract templates and negotiation position:

• SLA and KPIs: uptime, drift, explainability, latency, human review.
• Contractual mechanisms: transfer of liability and vendor indemnification, flow‑down to subcontractors.
• Limitation of liability: caps, exclusion of lost profits, carve‑outs for intent and data breaches.
• International agreements and choice of jurisdiction; arbitration clauses and force majeure in case of AI service failures.

ROI and reducing litigation risks:

• Metrics of error impact: VAR, drawdown, tracking error in risk team’s KPIs.
• Continuous validation, drift monitoring and explainability as savings on future claims.
• Human‑in‑the‑loop at critical thresholds: cost‑benefit compared to liability exposure.
• Insurance solutions: proper alignment of professional indemnity, cyber and AI liability.

Specific issues people forget

Responsibility for bias and discrimination in AI advice is not only an ethical concern but also a legal risk. Regulators expect bias tests, data adjustments and documentation of fairness metrics. In one project the COREDO team implemented regular bias audits as part of the SLA with the vendor.

Liability when using open models (open‑source) in an advisor: a high‑risk area. The legal frameworks of product liability applicable to AI-powered financial software are increasingly debated in the EU; a prudent strategy is to clearly separate “as-is” components and your integration guarantee.

The impact of local Asian legislation on cross-border AI solutions manifests in data localization requirements, periodic audits, and additional consents. Here COREDO helps choose a group policy structure that withstands both GDPR-like regimes and Asian rules.

The role of the corporate lawyer

Technical auditability and tools for Forensic ML constitute a pre‑prepared platform for defense. We recommend assembling a set of assumptions, versions, test cases, and counterfactual scenarios suitable for legally admissible examinations of models. This approach makes it possible not only to win disputes, but also to learn from incidents.

What to do today: checklist

• Conduct a gap‑analysis against the AI Act, MiFID II, DORA, MAS/SFC and local AML acts.
• Formalize model risk governance: committee, validation, drift monitoring, explainability.
• Re-check contracts: caps, indemnities, warranty disclaimers, SLAs for model metrics, arbitration and choice of law.
• Configure immutable logs, role‑based access control, segregation of duties and incident-response procedures with notifications.
• Review insurance coverage: AI liability insurance, professional indemnity and cyber with coordinated terms.
• Update public disclosures on AI use so customer expectations align with reality.

Conclusions

Intelligent advisors are transforming the financial industry, but with opportunities come legal and operational obligations. Platform liability for algorithmic recommendations, the management company’s liability for automated advice, and contractual liability when implementing an AI consultant are manageable categories of risk if the process and contract architecture are set up correctly.

If you are preparing to enter new markets in the EU, the UK, Singapore, Dubai, Cyprus, Estonia, the Czech Republic or Slovakia, or building a financial AI service with international liability: let’s discuss a practical roadmap. I am responsible for ensuring that every line of code and every contract clause work towards your resilience and predictability of outcomes, and COREDO’s practice confirms: it is achievable.

Since 2016 I have been developing COREDO as a partner for entrepreneurs and investors who value accuracy, speed and predictability when entering international markets. Over that time the COREDO team has executed hundreds of projects in Europe, Asia and the CIS countries: from company registrations in the EU, the Czech Republic, Slovakia, Cyprus and Estonia to launching structures in the United Kingdom, Singapore and Dubai. We have completed the full cycle of deal support: investments and M&A, obtaining financial licenses (crypto, forex, payment services and e‑money), setting up AML/KYC, as well as investment and technical due diligence of an IT startup.

In this article I have collected the pre-investment due diligence practices that we embed into comprehensive client support. My goal: to give you a methodology that saves months, reduces uncertainty and strengthens the negotiating position. Examples and tools are based on real COREDO projects: no unnecessary theory, with a focus on actionable results.

Does an IT startup need due diligence?

I follow the principle “measure twice, cut once”. That means, before signing an SPA/SSA or SAFE you need to check IP, the cap table, regulatory constraints, ARR/MRR and technological risk at the level of architecture, DevOps and data security. This creates confidence that integration will proceed without shock to the team and clients, and that jurisdictional and tax aspects will not put you at risk.

COREDO verification model: 6 contours

The COREDO verification model provides six assessment contours that comprehensively cover both the business and the project’s risks. One of the key contours, legal due diligence and IP matters, focuses on agreements, technology rights and potential risks that can significantly affect the startup’s fate.

Startup legal due diligence and IP

I start with IP due diligence, because rights to the source code and the brand are what protect the core value of the deal. I request an inventory of assets: code, libraries, patents, trademarks and domains, as well as assignment agreements with all employees and contractors. It’s important to ensure the founders had the authority, that the chain of title is clean and does not conflict with open source licenses (GPL, MIT, Apache).

I pay special attention to software escrow and source code release conditions: especially when there’s dependence on a key supplier. I review license agreements with clients, exit clauses and non‑compete, as well as dispute jurisdiction, arbitration, force majeure and the dispute resolution mechanism. In industries subject to export control and restrictions on cryptography or dual‑use technologies, compliance issues are included in the mandatory checklist.

Corporate structure and transactions

Regulatory framework for AML/KYC

Financial due diligence for SaaS

Financial KPIs: mirrors of reality. I compare ARR, MRR, churn, gross margin and burn multiple with the monetization model and the contract base. For SaaS, revenue recognition and deferred revenue, the correctness of subscription cycles and discounts are critical. We often perform cohort analysis, check retention and NPS to see the sustainability of the streams.

Unit economics, another marker: CAC, LTV, payback period and contribution margin. If CAC “eats” LTV or the payback period falls outside hypotheses, I propose correction scenarios. Tax compliance and VAT/digital services tax in the EU affect net economics; I check VAT registration, OSS/IOSS and the correctness of invoicing. For recurring payments, PCI DSS, chargeback risks and the choice of payment provider are important.

Customer and contract verification

Technical due diligence

A technological assessment is an “X‑ray” of architecture, DevOps and security. The IT startup review includes an audit of the startup’s source code, checking commit history and the Git repository, analysis of unit tests, coverage and CI/CD processes, code scanning for vulnerabilities and SAST, as well as penetration testing and pentest results. I look at governance: code review practices, branch protection rules, SBOM and management of third‑party dependencies.

Technical due diligence: the COREDO method

For assessing the product and infrastructure we use the COREDO methodology as part of in-depth technical due diligence, which allows us to identify architectural constraints and technical risks in advance. Next we’ll move on to analysis of architecture and scalability: the key aspects that determine a system’s ability to grow and withstand load.

Architecture and scalability

Repository and codebase

Checking a Git repository is not just the commit history. I evaluate the reputation and provenance of the code: signed commits, CLA and contributor license agreements, authorship and involvement of external contributors. To assess technical debt I use metrics: maintainability index, cyclomatic complexity and frequency of changes in hot files.

DevOps infrastructure and CI/CD

Dependency visibility: SBOM and software bill of materials are becoming a standard. This is related to SCA (Software Composition Analysis) and license management, to eliminate legal and vulnerable third‑party dependencies. The risk of supply chain attacks after examples like SolarWinds is not theoretical; I assess the build chain, access controls and environment isolation. Secrets and key management (Vault, KMS, HSM) plus IAM, RBAC, least privilege and MFA are mandatory elements.

Vulnerabilities and application security

Data encryption and compliance

Backups, retention strategy and recovery testing are basic things that are often underestimated. I validate RTO and RPO, as well as the disaster recovery plan (DRP). Without regular recovery testing, backups are just an expensive illusion of security.

Vendors and third-party dependencies

Third‑party vendor risk assessment is not a formality: cloud providers, analytics, PSPs and KYC providers affect availability and compliance. I check DPAs, SLAs, penalties, the right to audit and migration terms. Software supply contracts, service level agreements and penalties must be synchronized with your promises to customers. For critical components we discuss software escrow and the conditions for source release.

COREDO Cases: Typical Scenarios

In COREDO’s practice we systematize typical scenarios and cases to provide practical guidance for complex cross-border operations. The first example — the purchase of a European SaaS from Slovakia by a fund from Singapore — clearly demonstrates the key legal, tax and corporate issues that participants most often face.

Singapore fund to buy a Slovak SaaS

Licensed fintech in Estonia

Integration into a corporate portfolio and M&A

Checklists and questions for founders, CTO

Documents and evidence I am requesting

• IP and legal: IP register, agreements transferring code rights (employees and contractors), patents and trademarks, software escrow and release terms, open source licenses and SCA‑reports.
• Commercial: list of top clients, contracts, SLAs, penalties, exit clauses, non‑compete, references, pilot agreements and PoC.
• Financial: reports on ARR/MRR/churn, revenue recognition and deferred revenue, cohort analysis, unit economics (CAC, LTV, payback), payment reconciliation and chargeback statistics.
• Regulatory: licenses and permits (including PSD2/financial), DPA, DPIA, SCC/BCR, data residency policy, ISO27001/SOC2, PCI DSS.
• Security and engineering: SAST/DAST reports, pentest results, remediation roadmap, SBOM, secret management policy (Vault/KMS/HSM), IAM/RBAC, DRP plans and recovery tests.
• Corporate: cap table, option plans (vesting, cliff), SAFE/convertible notes, liquidation preferences, anti‑dilution provisions, board and shareholder minutes.
• Legal and compliance: current/potential disputes, regulatory correspondence, sanctions and PEP checks of counterparties, tax compliance and VAT in the EU.

CTO questions for the pre-investment audit

• What to check in the source code when investing in a startup: ownership, test coverage, complexity and dependencies.
• How to assess the scalability of a SaaS architecture: target SLOs, current bottlenecks (latency/throughput), sharding/caching plan.
• What the DevOps practices review includes: reproducible and signed builds, IaC and drift control, release policy (canary, blue‑green), post‑mortems.
• How to assess risks of using open source: SBOM/SCA, GPL/MIT/Apache licenses, update process and CVE remediation.
• How to limit risks when integrating a third‑party service: vendor risk assessment, SLA, right to audit, escrow, migration and lock‑in assessment.
• What guarantees to require for backups and RTO/RPO: recovery test procedures, reports, independent verification.
• How to verify GDPR compliance and cross‑border processing: DPA/DPIA, SCC/BCR, data mapping, minimization and logging.

COREDO Support: How to Reduce Risk

I structure the work in phases with clear artifacts. At the start we establish the deal hypothesis, geography and regulatory perimeter: EU, Czechia/Slovakia, Cyprus/Estonia, United Kingdom, Singapore and Dubai — COREDO’s practice is especially strong there. Next we open the virtual data room and launch parallel tracks: legal, regulatory/AML, financial, commercial and technical.

Each track has its deliverables: from a report on the startup’s legal due diligence and an IP map to a technical risk matrix with an assessment of technological risk and a remediation plan. The output is a consolidated investment memorandum where risk items are linked to the economics of the deal: price adjustments, escrow/holdback terms, warranty obligations and KPI blocks. This approach shortens negotiations and simplifies post-closing integration.

A separate vector is licensing and registration. If the model requires a license (crypto, forex, payment services), the COREDO team takes on structuring, preparation of AML/KYC policies, configuration of transaction analytics and engagement with the regulator. For registering legal entities in the EU, United Kingdom, Singapore or Dubai we prepare a set of incorporation documents, a banking package and a tax compliance plan.

How to contractually mitigate red flags

• Unresolved critical CVEs and pentest failure. Solution: remediation roadmap with deadlines, escrow/holdback until closing, reps & warranties and the right to an independent re‑test.
• Lack of agreements assigning code rights from part of the team. Solution: urgent assignment, cap table adjustment, partial price‑adjustment.
• Customer concentration and fragile enterprise‑contracts. Solution: earn‑out, expanded SLAs, liability insurance, pilots with diversification.
• Weak GDPR compliance and absence of SCC/BCR for cross‑border transfers. Solution: DPA/DPIA before closing, controlled regional rollout, architectural segmentation.
• Issues with revenue recognition and deferred revenue. Solution: restatement, valuation adjustment, covenants on financial reporting.
• Tax and VAT risks. Solution: price reserve, voluntary correction, post‑closing support and registration in OSS/IOSS schemes.

Hiring the core team by region

Regional risks in Europe, Asia and Africa differ in localization, licensing and provider stability. I recommend checking local regulation and licensing in countries of presence, export controls and restrictions on cryptography in advance. In some regions data residency is required, which entails infrastructure segmentation and duplication of DR processes.

Conclusions

Investment due diligence for a startup – is not a set of disparate checks, but an interconnected system in which legal, financial, commercial, and technical blocks reinforce one another. When this mechanism operates smoothly, a startup’s pre-investment valuation becomes more accurate and the deal structure safer. In my approach, COREDO acts as an integrator: from company registration and obtaining financial licenses to AML consulting and in-depth technical expertise.

I have been leading COREDO since 2016 and see every day how entrepreneurs in Europe, Asia and the CIS countries balance the need to protect privacy with the duty of full transparency towards banks and regulators. Nominee services for companies are a finely tuned instrument. They work when AML/KYC methodology is observed, powers are properly documented and economic substance is established; and they also carry significant legal, tax and reputational risks if implemented carelessly.

Over the years the COREDO team has delivered projects in the EU, the Czech Republic, Slovakia, Cyprus and Estonia, as well as in the United Kingdom, Singapore and Dubai. We’ve taken clients through the full cycle, from company formation and bank account opening to obtaining financial licenses and an independent AML audit. In this article I combine COREDO’s practice and the regulatory novelties of 2024–2026 to give you a practical roadmap for nominee service taking into account beneficial ownership registers, economic substance requirements and evolving rules on information exchange.

Why do entrepreneurs need nominee service?

Nominee director and nominee shareholder: these are appointed persons, formally holding positions and/or owning shares on behalf of the beneficiary (beneficial owner). Nominee holder services are used for operational flexibility, protection from competitors’ intrusive attention, and structuring corporate governance when operating in multiple jurisdictions. A proper nominee arrangement does not change economic control and does not conceal the UBO; it allocates functions and formalizes agency powers.

Boundary of control, the key criterion. The nominee’s agency powers should not turn into de facto management of the business without oversight by the beneficiary. When a nominee makes strategic decisions and the documents do not record mechanisms for instructions and reporting, there is a risk of requalification of control and of questions regarding substance and tax residency.

Regulatory outlook 2024–2026

The overview of regulatory changes for 2024–2026 reveals key trends toward tighter control and greater transparency requirements for corporate structures. Below we examine in detail what changed in nominee service practice in 2026 and what this means for compliance and operations.

What changed in nominee service in 2026?

By 2026, regulation of nominees in the EU and leading international centers is becoming more detailed. Beneficial ownership registers in the EU are evolving after restrictions on public access: access remains available to obliged entities (banks, corporate service providers) and regulators, and data verification standards are being tightened. COREDO’s practice confirms that even with formally closed registers, requests from banks and FIU (Financial Intelligence Unit) require the same depth of transparency as in 2022–2023.

Beneficial ownership registers in 2026 will likely receive improved APIs for inter‑agency exchange, and the obligation to update data within short timeframes will become standard. In the UK Company House is strengthening verification controls, and in a number of EU countries a preliminary KYC‑filter is being implemented when submitting UBO data, which increases the responsibility of the applicant and the provider.

Impact of CRS, FATCA and BEPS on nominee

CRS (Common Reporting Standard) and FATCA continue to act as an “X‑ray” for cross‑border shareholders and accounts. From 2026, active integration of the Crypto‑Asset Reporting Framework (CARF) by a number of jurisdictions is expected, which will erase the illusion of “invisibility” of operations with tokenized shares and corporate wallets. In COREDO projects we are already implementing CARF‑compatible processes in corporate and licensed crypto structures in Cyprus, Estonia and Singapore.

AML and nominee service: a guide

With tightening AML requirements, nominee service providers and their clients are forced to implement robust compliance procedures. This practical guide focuses on KYC/CDD/EDD and UBO identification, explaining the steps necessary to manage risks and meet regulatory requirements.

Know Your Customer / Customer Due Diligence / Enhanced Due Diligence: identification of the Ultimate Beneficial Owner

From the Anti‑Money Laundering (AML) compliance perspective, a nominee is a risk‑enhancing factor, meaning an increased level of scrutiny is required. KYC / CDD procedures for nominees include identity verification, source of funds and source of wealth checks, confirmation of professional background, and independent reference letters. Apply Enhanced Due Diligence (EDD) for nominal holders if there are offshore elements, complex chains or politically exposed persons (PEP screening).

AML requirements for nominee services

To comply with AML for nominee service, formalize: a nominee agreement, a powers matrix, an instructions policy, a reporting regime, and control measures. FIU reporting and SARs (suspicious activity reports) should be integrated into both the provider’s and the company’s procedures, with escalation thresholds and training for responsible staff. The COREDO team implements record‑keeping obligations and statutory registers as living documents: instruction protocols, a powers of attorney issuance log, a shareholder register and a UBO register synchronized with the jurisdiction’s registers.

Reducing false positives in AML software

A modern compliance ecosystem is not a set of disjointed tools. We integrate KYC, sanctions screening and transaction monitoring into a single platform to avoid data fragmentation and interpretation errors. Real‑time monitoring of sanctions and media risks, transaction patterns, alerting and subsequent incident investigations are combined and documented in case management.

False positives are inevitable, but their ratio is an important KPI. Optimizing screening rules, contextual lists and regular scenario calibration help reduce “noise”. COREDO’s practice shows that a risk‑based approach, combined with regular model testing (model validation), shortens the onboarding cycle without compromising control quality.

Tax aspects of economic substance

The concept of Economic substance today serves as a measure of genuine business activity and directly affects the tax aspects of companies operating in international jurisdictions. In the following points we will examine in detail what substance requirements are imposed on companies with nominees and what consequences their non-compliance entails.

Substance for companies with nominees

Tax mobility and the place of tax residency depend on where key decisions are made and where value is created. When a nominee director signs but the real management is abroad, this is a risk of reclassification. Formalize “reasonable measures” to prevent discrepancies: technological meeting logs, geotags, local contracts and evidence of available resources.

Tax risks of using a nominee service

Tax risks of nominee service include requalification of beneficial ownership and disputes over the applicability of double tax treaties. How to prove the absence of control by a nominee shareholder? Through a nominee agreement, custodial holding of share certificates, confirmation of lack of dividend interest and documented instructions from the UBO. The tax consequences of transferring shares to a nominee in EU countries require an assessment of dividend withholding, rules on counterparties with significant participation and anti‑abuse provisions.

Contractual guarantees

Contractual guarantees and legal instruments are necessary to minimize risks when transferring rights and managing corporate assets. Below we will move on to practical schemes and drafting features, including the nominee agreement and best practices within EU law.

Best practices for a nominee agreement in the EU

A nominee agreement template should include an obligation to fully disclose the UBO to regulators and banks if required by law. For the beneficiary it is important to have the right to immediate replacement of the nominee in case of breach of AML‑policies, and for the provider – the right to suspend execution of instructions upon sanctions and AML triggers. Such symmetric mechanisms reduce the systemic risk for both parties.

Escrow and powers of attorney: the digital trail

Blockchain notarization and using blockchain to store records of nominee agreements is a workable option to ensure immutability of records, especially in cross‑border disputes. Smart contracts for automating nominee terms remain a niche tool, but we already see cases where smart escrow records the occurrence of conditions for transfer of control or dividends.

Sanctions and criminal risks

The legal consequences of hiding the UBO in 2026 are only intensifying: regulators actively exchange data, and banks fine for false declarations. At COREDO we include in contracts an obligation of immediate notification of sanctions events and a trigger for restructuring with the involvement of an external sanctions adviser.

Operational scenarios: from account to M&A

Operational scenarios cover a wide range of tasks: from managing a bank account to supporting M&A, and require coordinated processes, automation and strict risk controls. Below we consider bank KYC and cross-border governance as key elements of compliance and operational resilience.

Bank KYC: cross-border governance

Interaction with bank KYC during account opening is the most sensitive stage. The bank will request a full package: nominee agreement, appointment minutes, UBO confirmations, source of funds and substance arguments. Our experience at COREDO has shown that early engagement with the bank and providing a transparent structure map increase the likelihood of opening an account in the Czech Republic, Estonia, the United Kingdom and Singapore.

Cross-border corporate governance and corporate law require consistency: where statutory registers are kept, how nominees are appointed and removed, and which law applies to the shareholders’ agreement. Inconsistency creates delays and red flags with banks and regulators.

M&A, public deals, alternatives to nominee

Legal risks from using a nominee in M&A transactions are related to representations and warranties (W&I), disclosure of the ultimate owner and synchronization of voting and dividend rights. Rules for disclosing the ultimate owner in public transactions are stricter and often incompatible with anonymizing structures. We incorporate into the SPA mechanisms for phased UBO disclosure and escrow unwind upon confirmation of control.

Alternatives to nominee service – trust, corporate secretary, agency agreements with limited functions. Sometimes it is more sensible to split roles: the secretary maintains the registers, the agent: narrow functions, and the director: only operational signatures. Such modularity reduces concentration of risk in a single person.

Digital Identification Technologies

Modern digital identification technologies are reshaping methods of identity verification and access management, combining user convenience with security and compliance requirements. Below we will examine in detail the key elements of this ecosystem – e‑KYC, the eIDAS regulations and remote onboarding practices: to understand their significance for businesses and customers.

eKYC, eIDAS and remote onboarding

Digital identification and e‑KYC capabilities for nominees radically accelerate processes. eIDAS and qualified e‑signatures make it possible to conduct board decisions and sign nominee agreements remotely with strong evidentiary weight. Remote onboarding and biometric verification shorten onboarding timelines while maintaining reliability and creating a clear digital trail.

Contract Storage and Smart Contracts

Using blockchain to store records of nominee agreements provides immutability and verifiability. Smart contracts automate conditions for the transfer of rights, execution of instructions, or payment of fees tied to KPIs. While such solutions do not replace a legal contract, they create a strong audit trail and reduce operational errors.

Data retention policies establish retention periods and access controls. Data governance is not only a matter of security but also evidence of good faith in disputes and FIU audits.

How to choose a nominee service provider

При выборе провайдера nominee service важно сочетать проверку репутации и способность контролировать качество предоставляемых услуг. Раздел о due diligence и лицензировании подскажет, какие документы, проверки и стандарты должны быть на первом месте при сравнении кандидатов.

Provider due diligence

Как выбрать провайдера nominee service с минимальным риском? Проверьте Licensing провайдеров корпоративных услуг в соответствующей юрисдикции, репутацию, наличие PI insurance, независимый аудит AML‑процессов и состав комплаенс‑команды. Контроль качества провайдеров – due diligence checklist: KYC‑процедуры, санкционный скрининг, training‑планы, case management, incident response, GDPR‑политики и отчётность в FIU.

Service economics: fee structure, ROI and TCO

Коммерческая модель nominee: прозрачная fee structure, привязанная к обязанностям и SLA, плюс success‑fees за сложные кейсы (например, лицензирование). Оценивайте TCO (total cost of ownership) nominee решений: базовые гонорары, расходы на AML‑ПО, аудит, юридические апдейты, резерв на кризисное управление. ROI – это не только экономия времени, но и снижение вероятности задержек с банком и штрафов регулятора.

Метрики эффективности: время онбординга, заполненность dossier по UBO, доля отклонённых банковских заявок, время реакции на санкционные алерты. Управление репутационным риском и KPI кризисного менеджмента, подготовленные пресс‑брифы, контактные лица, таймлайн эскалации и сценарии замены номинала.

COREDO Case Studies

In one of the projects in Estonia, the client was launching a licensed virtual assets provider and insisted on a nominee director until the permanent one was approved. We carried out Enhanced Due Diligence (EDD) for the nominee, integrated e‑KYC, prepared a nominee agreement with clear limits and document escrow. The bank in Tallinn requested an additional audit trail: the solution developed at COREDO provided synchronization of instructions with board meetings and AML‑platform logs, and the account was opened without delays.

Third example: a holding in Dubai with operations in the EU and the UK. The sanctions landscape was changing, and the client feared payment blocks. The COREDO team implemented real‑time sanctions monitoring, updated KYC for nominees, implemented conflict of interest rules and approved crisis scenarios. When one of the counterparties was added to extended lists, an alert fired within an hour, and we timely filed the SAR notification and restructured the payment flow.

Scaling nominee services across jurisdictions

Scaling a business using nominee services in multiple jurisdictions requires a compliance matrix: UBO registers in the EU and international registries, local AML rules, substance and banking practices. Management of conflicts of interest between the beneficiary and the nominee is formalized through a code of conduct, independent compliance and regular reports to the board.

Information exchange between jurisdictions and ML/TF risks increase as the network of companies grows. Integrating KYC, sanctions and transaction monitoring into a single platform accelerates data consolidation and provides an end-to-end audit trail. The impact of CRS and FATCA on nominee structures in multi-tiered schemes requires a risk map, which we update in line with OECD and EU releases.

How to safely launch a nominee service

1. Need assessment. Determine whether a nominee is truly necessary, or whether alternatives will suffice: a corporate secretary, an agency agreement, a trust for specific assets.
2. Structuring. Describe the corporate structure, control boundaries, substance and tax residency.
3. Provider selection. Conduct due diligence on the provider, check licenses, AML processes, PI insurance and reporting.
4. Documentation. Prepare a nominee agreement, an authority matrix, POA, escrow mechanics, an instructions policy and a conflicts of interest policy.
5. AML/KYC. Implement CDD/EDD, UBO identification, PEP screening, sanctions compliance, FIU/SAR procedures and record‑keeping obligations.
6. Banks. Agree with the bank in advance the document package, substance arguments and UBO disclosure.
7. Technology. Set up an integrated AML platform, e‑KYC, e‑signatures, case management and performance metrics.
8. Monitoring. Introduce KPIs, regular reviews of UBO registers, contract reviews and updates based on regulator responses in 2024–2026.
9. Crisis plan. Provide for replacement of the nominee, sanctions scenarios, communications and legal support for the nominee service.
10. Audit. Conduct periodic independent audits and forensic accounting where there are signs of irregularities or at the request of the bank/regulator.

Conclusions

Nominee service: it is a corporate governance tool, not a way to hide the beneficial owner. Its effectiveness in 2026 is measured by transparency, the quality of AML/KYC, economic substance and readiness for cross-border data exchange under CRS, FATCA and new digital standards. When nominee services for companies are structured according to best practices, they accelerate scaling, protect operational processes and reduce friction in banking and regulatory interactions.

At COREDO I see the task not as “finding a nominee”, but as building a resilient architecture: legal documents, a verifiable economic reality, a digital footprint and a unified compliance platform. Our experience confirms: thoughtful transparency and discipline in the details are the best strategy against regulatory uncertainty and unexpected inspections. If you are planning a structure involving a nominee director or nominee shareholder in the EU, the United Kingdom, Singapore, Dubai, the Czech Republic, Slovakia, Cyprus or Estonia, incorporate the 2026 requirements today — you will save time, lower TCO and strengthen the trust of banks and partners.

I see that owners from the EU and Asia often postpone closing due to legal uncertainty, fear of tax scrutiny and concerns about reputation. In this article I will systematically lay out how to close a company in Hong Kong without fines or tax claims, what procedures exist, how long they take and how to build an ROI‑oriented exit strategy. The practice of COREDO confirms: proper preparation and disciplined execution save months and tens of thousands of dollars.

Why and when liquidation is the right move: diagnosis and ROI

Owners most often consider liquidating a Hong Kong company when the business model has changed, the project is migrating to another jurisdiction, the bank has tightened compliance, or maintaining a dormant company has become more expensive than closing it. I start with a diagnosis: financial solvency, risk profile, contractual map, assets and liabilities, tax position and compliance history in the Companies Registry and the Inland Revenue Department (IRD). We at COREDO carry out such an examination in 10–15 working days, using a risk-based methodology.

For managers, ROI matters. I suggest calculating:

• TCO of liquidation (government fees + professional fees + liquidator) vs annual maintenance costs (audit, secretarial services, Business Registration, banking compliance).
• Intangible effects: reduced regulatory risk, relieving directors of liability, release of collateral and bank guarantees.
• Alternatives: sale, merger, restructuring, transfer to dormancy. At COREDO we model the NPV of each scenario over a 3–5 year horizon.

Legal framework: who regulates and which rules apply

Hong Kong relies on:

• Companies Ordinance (Cap. 622) – corporate law, including deregistration (strike‑off).
• Companies (Winding Up and Miscellaneous Provisions) Ordinance (Cap. 32), liquidation (winding‑up).
• Competent authorities: Companies Registry (register, publications, registration filings), Inland Revenue Department (taxes, tax clearance), Business Registration Office (business registration certificate), and the Government Gazette (official notices).

Key choice: solvent or insolvent liquidation. This determines the procedure, timelines and requirements for the liquidator.

Three main closure scenarios: from strike-off to compulsory winding-up

Voluntary strike‑off / Deregistration (removal from the register)

Members’ voluntary winding‑up (voluntary solvent liquidation)
Suitable when assets exceed liabilities and the directors sign a Declaration of Solvency. The procedure is transparent and allows distribution of assets to shareholders after debts are paid. Stages include a special resolution of members, appointment of a liquidator, notices to creditors and publication in the Gazette, preparation of final accounts and audit, distribution of funds and de‑registration.

Creditors’ voluntary winding‑up (creditor‑led liquidation)
If the company is insolvent, the directors convene a meeting of creditors. Creditors appoint a liquidator, approve a creditors’ committee and oversee asset realization, including floating charge realization. Notices and the deadline for submitting claims (proof of debt), the order of payment to preferential creditors (preferential creditors), including wage and tax arrears, are especially important here.

Compulsory liquidation (compulsory winding‑up in Hong Kong)

Step-by-step procedure for liquidating a company in Hong Kong: from preparation to publication in the Gazette

Preliminary preparation: audit and clearing “loose ends”

Tax clearance (tax clearance) with IRD

Working with the bank: AML/KYC during closure and account closures

Contracts, leases, IP and data
Contractual unwinding is important to avoid claims:

• Lease termination and break clause handling: agree on early termination and demobilisation of the office, arrange handover of the premises.
• Contract novation and assignment: transfer or terminate obligations without “loose ends”.
• Intellectual property transfer and assignment: transfer rights to software, domains, trademarks; if necessary, to the holding company.
• Data protection: for owners from the EU we take into account the GDPR and local rules on storage of corporate and personal data.

Personnel, salaries and MPF

Communications with creditors
In liquidation we:

• send notices, publish a notice in the Gazette, collect proofs of debt;
• maintain a creditor claims timeline and verify claims;
• conduct negotiations with creditors and settlement strategies, including for secured and unsecured debts;
• observe the payment hierarchy, including preferential creditors, and document all distributions.

Duties and responsibilities of directors and the liquidator

COREDO case studies: how we closed companies in Hong Kong without incurring penalties

Case 1. Voluntary strike‑off for a company with zero activity

Case 2. Step-by-step liquidation of a holding company in Hong Kong

Case 3. Liquidation of an offshore structure in Hong Kong for foreigners with supplier debt

Bank accounts and capital repatriation: how to return funds to investors from the EU and Asia

Timelines, costs and performance metrics

Restoration of a company after strike‑off and reputational risks

Alternatives to liquidation: when to restructure, sell or “put a company to sleep”

Answers to the questions we’re asked most often

• What is the total cost and ROI? Cost is a function of complexity: presence of assets, audit, liquidator. In a simple strike‑off TCO is often less than a year’s company maintenance. ROI shows up in savings of future expenses and reduced risks for directors.
• What risks do owners from Europe and Asia face with improper liquidation? Fines for late filings, creditor claims, difficulties opening accounts in other countries, AML/KYC inquiries from banks and regulators.
• Should one go into compulsory or choose voluntary winding‑up? A voluntary procedure with professional support is almost always better: you control timing, communications and the reputational backdrop.
• How are AML/KYC checks performed during closure and what documents will the bank require? The bank will collect KYC for the director and beneficial owners, confirmations of sources of funds and the distribution plan. We prepare the dossier in advance.
• What notices and clearances does the IRD require? Cessation notice, final tax return, confirmation of settled assessments, and, if necessary, letters regarding withholdings and explanations of transactions.
• Can a company be restored after strike‑off? Yes, through the courts. It’s expensive and time‑consuming; it’s better not to make mistakes during closure.
• What metrics should be evaluated when choosing liquidation vs sale/merger? TCO/ROI, time horizon, legal and tax risks, impact on the group and banking relationships.
• How to protect IP and contractual rights during liquidation? Execute an IP assignment in advance and novate key contracts, secure license agreements and data rights.

Practical checklist for closing operations in Hong Kong

• Strategy and diagnostics: solvent vs insolvent, KPI, ROI, roadmap.
• Corporate actions: special resolution, appointment of liquidator, minutes.
• Regulators: notifications to Companies Registry and Business Registration Office, publications in the Government Gazette.
• Taxes: cessation notice, final tax return, tax clearance certificate, DTA and TP reconciliation.
• Banks: AML/KYC package, bank account closure checklist, confirmations of source of funds.
• Staff: payroll calculations, IR56F/IR56G, MPF closure, letters to employees.
• Contracts and leases: termination/break clause, novation/assignment, handover of office.
• Assets and IP: valuation, disposal, assignment of trademarks/patents/software.
• Creditors: notices, proof of debt, meetings, prioritization and calculations.
• Reporting and audit: final accounts and audit, distribution of assets, final liquidator’s report.
• Archive and records retention: corporate records retention and statutory retention periods.
• Insurance and regulators: cancellation of policies, closure of licences and notifications (Customs/Immigration/Social Security – if applicable).

How COREDO operates on a company closure project in Hong Kong

I believe in a managed, transparent process. At the start we create an engagement plan with milestones and SLAs for communications. The COREDO team implemented a hybrid model: a local licensed liquidator and auditors, international tax and compliance advisers, a project coordinator and a single point of contact for the client. We work in two-week sprints: a progress report, a risk log, the next milestone.

We value a candid tone: if I see a risk of compulsory liquidation or restoration after wrongful strike-off, I flag it immediately and offer options — from negotiations with creditors to an alternative exit through a sale or restructuring. This approach helps owners preserve control of the process and their reputation.

How to close a company in Hong Kong without fines: my short advice

• Don’t delay the diagnosis. Any delay increases project cost.
• Enter the voluntary procedure where possible.
• Prepare the tax clean-up and bank KYC in parallel.
• Document every decision of the directors.
• Maintain transparent communication with creditors and banks.

Conclusion

Liquidating a company in Hong Kong is not just a legal formality. It is a management decision that combines law, taxes, compliance and reputation strategy. My experience and COREDO’s practice confirm: proper preparation, the correct choice of procedure – strike‑off, members’ voluntary or creditors’ voluntary: and careful handling of the IRD, Companies Registry and banks make it possible to conclude the business story neatly and without penalties. If you, as an owner from Europe or Asia, are looking for a way to exit a business in Hong Kong, calculate ROI and minimize risks, rely on a clear plan and professionals who will accompany you through every stage, from the initial diagnosis to the final publication in the Gazette and the closing of accounts. This is exactly the client-side partner role I envision for COREDO, and this is where we are strong.

Since 2016 I have been leading COREDO across dozens of markets in Europe, Asia and the CIS. We have helped clients register legal entities, obtain financial licenses, implement AML‑frameworks and build resilient corporate structures in the EU, the Czech Republic, Slovakia, Cyprus, Estonia, the United Kingdom, Singapore and Dubai. Over the past three years Saudi Arabia has come into focus: requests for joint ventures in Saudi Arabia are growing, and with them – the need for practical and reliable schemes of control, compliance and localization (Saudization). I have compiled COREDO’s working methodology in this article: from partner due diligence and the rules for creating a joint venture in Saudi Arabia to calculating OPEX for mandatory Saudization quotas and protecting minority shareholders.

How to Think Strategically Now

Vision 2030 is transforming the KSA economy on all fronts: diversification away from oil, accelerated industrialization, local industrial clusters and economic zones, and a priority on technology transfer and skilled jobs. Our experience at COREDO has shown that strategic investment planning in Saudi Arabia is justified when you address three tasks at once: market access, localization of production/services, and building compliance to participate in public procurement.

The 2020 Foreign Ownership Law in the KSA and related changes to the investment regime have allowed foreign investors to hold equity participation in Saudi Arabia up to 100% in a number of sectors. At the same time, sectoral restrictions on foreign participation remain (energy, security), and the rules for the oil and gas sector and the local partner require a separate assessment of local content and participation in major client initiatives. Here, a Joint Venture often proves to be the optimal structure – you combine control with local presence, meeting the expectations of regulators and clients.

Market Regulators: How to Engage

COREDO’s practice confirms: the map of regulators determines the project’s roadmap. Licensing of business in the KSA begins with the Ministry of Investment of Saudi Arabia (MISA). Company registration in Saudi Arabia and the commercial register are under the responsibility of the Ministry of Commerce. Financial services are overseen by SAMA (the central bank) and the CMA (Capital Market Authority), while personnel policy and Saudization are controlled by the Ministry of Human Resources and Social Development (HRSD) of the KSA.

Requirements for hiring Saudi citizens and the assessment of an employer’s compliance with Nitaqat are handled through HRSD and automated Saudization monitoring. Payroll payments are processed through the Wage Protection System (WPS); without WPS files the bank blocks payments and HRSD records the violation. In this architecture, the solution developed at COREDO is to build a single compliance calendar and compliance checkpoints for Saudization before operations launch.

Registration and licensing of a JV in KSA

A joint venture in KSA is not a single document but a sequence of coordinated steps. The COREDO team has delivered projects where we, in 8–12 weeks, carried out Due Diligence of a partner in Saudi Arabia, prepared the JV agreement, simultaneously obtained the MISA license and assembled the package for Commercial Registration. At the same time we embedded KYC/AML procedures to meet banking requirements for the joint venture to speed up account opening.

LLC / Branch / Holding: Why WLL Is Not Suitable for Saudi Arabia

Most often an LLC is chosen for a JV — a flexible limited liability form adapted to local realities. A branch is appropriate when direct control by the parent company is required and there is no local shareholder, but then Nitaqat and localization fall on the parent company. In a regional structure you can use a holding to own shares and IP, whereas in KSA it acts as the parent company over the local LLC. The WLL format, typical for a number of Gulf countries, is not the same in Saudi Arabia, where different designations are applied — an important point to consider when preparing documentation.

Company registration and licenses in the Kingdom of Saudi Arabia

• obtaining an investment license MISA, where the type of activity and equity participation are recorded.
• Signing the articles of association and the JV agreement, filing for Commercial Registration with the Ministry of Commerce.
• Registration with ZATCA (taxes/VAT), with the Chamber of Commerce and Industry, obtaining a municipal license.
• Connecting to WPS, setting up the HRSD portal, uploading Nitaqat data.

When to register a branch in Saudi Arabia

A branch is appropriate for companies with project contracts and a limited period of presence. Registration and licensing of a branch in KSA also proceed through MISA and the Ministry of Commerce, but corporate governance is simpler.

How to avoid losing control of shares

Equity participation: not just percentages in CR, but the architecture of control. How to agree participation shares and control mechanisms we record in two documents: shareholders agreement (SHA) and the joint venture agreement (JV agreement). There we also define corporate governance in the JV: composition and quorum of the board, the list of reserved matters, budget limits, banking mandates and KPIs for Saudization and localization.

Key provisions of the SHA and JV agreement

We recommend including: deadlock‑mechanisms, option schemes (call/put), tag‑along and drag‑along, contractual guarantees and sureties for investors, non‑compete agreements and corporate restrictions.

Fix the exit and buy-out before the start

Exit mechanisms from the JV and the buy‑out must be clear from day one: buy triggers, valuation formulas, lock‑up, ROFR/ROFO and the procedure for bringing in a third party. In KSA we often

Protection of minority shareholders and risk management

The minority protection mechanism in a joint venture is not only a veto pool. It is audit, access to information, disclosure requirements to regulators, and automatic triggers to appoint an independent director upon covenant breaches.

Saudization and localization for joint ventures

Requirements for Saudization for JVs are based on the Saudi Nitaqat program: the industry and company size set mandatory Saudization quotas and a category “color” (from red to platinum). Compliance with Saudization is overseen by HRSD through automated Saudization monitoring and WPS.

Quotas and localization without business disruption

Adapting HR policy to Nitaqat starts with a workforce plan: quotas for national staff and training programs, a transition to local management and leadership over a 12–24 month horizon, and a succession matrix for key roles. The COREDO team builds a “local talent pool + expat mentors” model, which accelerates hiring, retention and the transfer of competencies.

Assessing the impact of Saudization on a project’s margin takes into account salaries, HRDF subsidies, training costs, penalties for Saudization violations in KSA and the effect on productivity. Minimizing OPEX while complying with Saudization requirements is achieved through proper job grading, hybrid teams and outsourcing functions with verification of local content.

KPIs and reporting in public procurement

Percentage of Saudis by job category, share of nationals in management, average cost of hire/retention, training hours, time to fill vacancies, and the stability of WPS payments. monitoring systems for localization and Saudization KPIs and real-time compliance monitoring are integrated into HRIS and payroll. How to ensure quota compliance for participation in public procurement: we record it in the “Saudization compliance plan for external audit” with documentary evidence for KSA regulators and procurement platforms.

Compliance, AML/KYC and sanctions risks

Compliance and AML for joint ventures in KSA is a fundamental discipline. Checks KYC and AML in KSA cover partners, beneficial owners and key suppliers: KYC requirements for partners and beneficial owners include UBO declarations, sources of funds, tax status (CRS/FATCA), background checks and proof of address. Banking requirements for a joint venture cover constitutional/incorporation documents, JV agreement, specimen signatures, business plan and WPS connection.

Export and import permits in Saudi Arabia, especially for dual-use equipment, require a separate stream of documentation. AML/CFT reporting in the KSA banking system formalizes cash transactions, cross-border payments and the beneficial ownership structure.

Taxes and the financial model: ROI and compliance

Taxation of a joint venture in KSA combines corporate tax and zakat: the foreign shareholders’ portion is subject to corporate tax (typically 20%), the Saudi/GCC-compatible shareholders’ portion: zakat under local rules. Plus VAT 15%, and possible withholding taxes on royalties, services and interest.

The JV ROI assessment in KSA must take mandatory localization into account. When budgeting and forecasting ROI under localization we build in opex markups for Saudization, local subsidies and loans, CAPEX requirements and the timeline to reach the target Nitaqat category. The cost‑benefit assessment of production localization takes into account the near‑shore effect, logistics and access to government procurement.

Foreign exchange transaction risks and FX position management in KSA are mitigated by the SAR peg to the USD, but supplies and services from third countries create cross‑currency risks; we hedge them through forwards and currency corridors.

Financial reporting, audit and transparency for a JV are not optional but survival requirements. Disclosure requirements to regulators, regular audits and agreed dividend distribution policies in the JV reduce the risk of conflicts and increase creditworthiness.

Operational readiness: visas, HR and IP

Procedures for obtaining investor visas and work visas are tied to the Nitaqat category and WPS compliance. We predefine the pool of positions for work permits and work visas for foreigners, as well as the localization schedule. Integration of HR and payroll systems in KSA provides WPS files, leave tracking, benefits and automation of reporting to HRSD.

We implement an onboarding program, manager training and communications «localization goals = business growth». Technology transfer agreements and IP protection, registration and trademark protection in Saudi Arabia, nondisclosure agreements and protection of trade secrets: this is the framework that safeguards your value during the knowledge transfer process.

Suppliers and Cluster Scaling

The impact of Saudization on supply chains is reflected in SLAs and price, we record KPIs and local content requirements in contracts.

Government localization support programs and subsidies and local industrial clusters and economic zones provide tax incentives, infrastructure and services. Business scaling planning in Saudi Arabia relies on a pilot stage, a risk matrix and a succession plan and a personnel reserve in JV. risk management when scaling in Saudi Arabia includes credit limits, insurance and backup supplies.

COREDO JV: localization and control

Recently the COREDO team implemented a project for a European manufacturer of industrial equipment. The client targeted the B2B segment with high requirements for local content and participation in public procurement. We conducted due diligence of the partner in Saudi Arabia, including sanctions and reputational risk due diligence, and designed the ownership structure in the joint venture: 60% foreign investor, 40% resident partner, with banking and operational control through agreed reserved matters and bank mandates.

The joint venture agreement (JV agreement) and the SHA recorded exit mechanisms: option schemes, tag-along, drag-along, a deadlock procedure and ICC arbitration. We implemented a compliance framework for the international JV: KYC requirements for partners and beneficiaries, AML procedures, reporting on AML/CFT in the KSA banking system and a Saudization compliance plan for external audit. On the HR side we set KPIs for Saudization and localization, adapted HR policy to Nitaqat and established a KPI monitoring system for localization and Saudization with real-time dashboards.

Budgeting and ROI forecasting for localization took into account tax incentives and KSA tax specifics, JV financing models in Saudi Arabia, and the risks of foreign exchange operations and currency position management. As a result the client reached the target Nitaqat category within 8 months, gained access to large tenders, and preserved margin by minimizing OPEX while complying with Saudization requirements.

Checklist for joint venture preparation in Saudi Arabia

• Entry strategy: registering a subsidiary vs a joint venture in KSA; JV models – operational JV versus a holding structure.
• Regulators: engagement with regulators: SAMA, CMA, Ministry of Commerce, MISA; sectoral restrictions on foreign capital and rules for the oil and gas sector and the local partner.
• Law and control: shareholders agreement (SHA) and key provisions; how to structure equity stakes to protect investor control; minority protection mechanisms; arbitration clauses LCIA/ICC/SIAC.
• Compliance: compliance and AML for joint ventures in KSA; KYC and AML checks in KSA; KYC for partners and beneficial owners; compliance calendar and reporting to KSA regulators.
• Banks: which documents are needed to open an account and finance the JV; banking requirements for the joint venture; WPS connection.
• Saudization: assessing Nitaqat compliance for the employer; mandatory Saudization quotas; automated Saudization monitoring; preparing a Saudization compliance plan for external audit.
• HR and visas: procedures for obtaining investor and work visas; managing staffing quotas and localization; adapting HR policy to Nitaqat.
• Suppliers: assessing suppliers’ compliance with localization requirements; how to ensure compliance with quotas for participation in public procurement.
• Taxes and finance: taxation of the joint venture in KSA; tax incentives; ROI assessment for the joint venture in KSA; localization budgeting.
• Operational risks: sanctions and export risks for the JV; export and import permits in Saudi Arabia; administrative actions and penalties in KSA for violations.
• IP and agreements: intellectual property protection in the JV; registration and protection of trademarks in Saudi Arabia; non-compete agreements and corporate restrictions.
• Reputation and market: managing the JV’s reputational risks; analysis of the competitive environment and barriers to entry; impact of the national industrial policy Vision 2030 on the JV.

COREDO addresses overlooked nuances

• Profit sharing and dividend distribution in a JV require alignment with tax rules and bank covenants. We build in DSCR tests and an approval sequence for payments.
• AML/CFT reporting and financial reporting are not reduced to “tick-box exercises”. The COREDO team implements second-line control procedures and an independent internal audit.
• The impact of Saudization on margins is often greater than expected. We adapt the business model to Saudization requirements, including process redesign and moving roles to outsourcing with local content.
• Interaction with local suppliers and subcontractors affects the assessment of localization. We specify local content metrics and SLAs in contracts, as well as reporting requirements.
• Sectoral restrictions on foreign capital in sensitive industries can be removed through smart structuring and partnership with a Saudi resident, but the boundaries of what is permissible are fixed at the MISA level in advance.

Frequently asked questions: short answers

• How quickly can a JV be opened? A realistic timeframe – 8–12 weeks to CR and a bank account, assuming partners and documents are ready.
• Where to keep control? In SHA/JV agreement: reserved matters, option mechanisms and bank mandates.
• What about currency? The SAR is pegged to the USD, but multi-currency procurement chains require hedging.
• How to protect IP? Register trademarks and patents in the KSA, secure rights to improvements and export restrictions in license agreements and NDAs.
• What are the consequences of not complying with quotas?
  Legal consequences of failing to comply with localization quotas: fines, blocking of visas/transfers, downgrading of Nitaqat category, exclusion from government procurement and other administrative measures and sanctions in the KSA.

Role of the local counsel

В COREDO мы совмещаем локальную экспертизу с международным комплаенсом, что помогает увязать санкционные, экспортные и AML‑требования сразу в рамках одного комплаенс‑фреймворка для международного JV.

Клиент получает не набор разрозненных услуг, а сквозную траекторию: от выбора корпоративной формы (корпоративные формы: холдинги, филиалы, дочерние компании) и критериев выбора саудовского партнёра до планирования масштабирования и оценки возврата инвестиций при обязательной локализации. This reduces transaction costs and shortens time to revenue.

Joint venture in Saudi Arabia as a predictable asset

A joint venture in Saudi Arabia is a project at the intersection of law, tax, HR and operational design. If you take Saudization requirements for the JV into account in advance, establish Saudization compliance controls, and design corporate governance and exit mechanisms, you will get a predictable asset with a clear ROI. The solution developed at COREDO combines legal support for JVs in KSA, due diligence, licensing, KYC/AML and an HR model into a single roadmap and enables managing KPIs for Saudization and localization in real time.

I invite you to look at KSA pragmatically: assess the cost of entry, choose the format (a subsidiary or a JV), calculate the effect of Nitaqat on margin and prepare a JV agreement and SHA that will protect capital and control. The COREDO team is ready to become your long-term partner: from the first negotiations with a resident partner to reporting to regulators and scaling. This approach reduces risks, speeds up licensing and turns Vision 2030 into concrete commercial results.

I often hear the same question from founders and CFOs in Europe and Asia: how to preserve Estonia’s flexible and attractive tax model in light of the 2026 reforms. In focus: Estonia’s defense tax and the broad agenda of changes to Estonia’s tax legislation for 2026. Over a decade of COREDO’s work with IT companies, fintechs and global groups COREDO we have learned to quickly clarify the essentials, model the effects and build practical solutions. In this article I have compiled a structured guide with an emphasis on the IT sector, startups and technology groups headquartered in the EU and present in Asia and the CIS.

Defense tax in Estonia from 2026

Estonia is publicly preparing to introduce a defense tax in 2026 as part of strengthening the resilience of public finances and defense spending. At the time of preparing this material the market is discussing several designs, and it is sensible to prepare scenarios in advance. I advise clients to be flexible in calibrations, as final parameters may differ by base and rate.

Rate of the defense levy and its calculation

Under the models discussed, possible options include:

• an add‑on to corporate taxes at a fixed percentage of the tax base;
• a levy on the payroll fund (similar to an add‑on to social contributions);
• a top‑up on distributed profits.

The new defense tax in Estonia

Compliance costs depend on administration. Likely elements: taxpayer registration, reporting frequency (monthly/quarterly), declaration format and control ratios. The solution developed by COREDO includes a process map: who in the company is responsible, which ERP data are needed, which IFRS and local tax accounting views to reconcile, and the SLA for adjustments.

Tax incidence of the defense levy

The question is not only ‘how much to pay’, but ‘who economically pays’. The tax incidence of the defense levy is distributed between the company, employees (through compensation packages) and customers (through pricing changes). I use price elasticity and cost pass‑through as the basis for a negotiation strategy: what we pass on in the price, what we absorb through efficiency gains, and what we offset via fiscal incentives.

Impact on IT and startups

IT business is sensitive to costs for talent, infrastructure and scalability. Taxation of the IT sector Estonia 2026 affects key blocks of product economics and financial metrics.

Defense tax for IT and startups

For product and service teams Estonia’s defense tax can increase OpEx if the base, payroll, and reduce net returns on dividends if the base is distributed profit. Our experience at COREDO has shown: timely adjustment of compensation policy and bonus models softens the hit to the P&L, and smart pricing preserves gross margin.

Taxes and hiring for startups in Estonia

The economic burden on small and medium businesses often appears as an increase in the total cost of hiring. I recommend recalculating the social cost in advance to assess the impact on offers, stock options, ESOP mechanics and retention of IT talent. We compare offer packages in Tallinn, Vilnius and Lisbon by final net compensation, taking into account tax residency and the defense tax.

CapEx vs OpEx: infrastructure/devops

The impact on IT capital expenditures (CapEx) and on IT operating expenses (OpEx) manifests differently. If you build your own data centers or invest in R&D equipment, the defense tax tied to profit hits free cash flow later. If the base is payroll, the burden falls into OpEx immediately. The COREDO team implemented a scenario analysis for a client: migrating part of the infrastructure to cloud services and CDNs reduced CapEx, and revising SLAs with providers kept OpEx in check while maintaining the same level of QoS.

Pricing, SaaS models and unit economics

The impact on digital services and SaaS models is noticeable through unit economics. I look at CAC, LTV, gross margin, NRR and payback period. When tax pressure increases we adjust pricing tiers (tiered pricing), introduce annual prepay discounts, strengthen retention mechanics and use geo-pricing for European and Asian customers. This way SaaS keeps LTV/CAC > 3, and the runway is not critically compressed.

Financial planning: DCF and scenarios

The new tax is about the accuracy of the financial model and treasury discipline. Here IFRS accounting and tax accounting in Estonia matter: they diverge in recognition timing and the calculation base.

Accounting for the defense tax in the DCF

I recommend updating the WACC, reassessing the tax shield, and including the defense levy in the FCF forecast. A DCF financial model with the new tax should cover:

1. three scenarios: base, moderately stressed, stressed;
2. escalation of the tax burden and scenario analysis over 3–5 years;
3. impact on ROI when paying the defense tax for key projects.

Cash flows under the new tax

I break down cash flow management under the new tax into four steps: synchronizing the payment calendar, reserving tax liabilities, automation through ERP systems and integration of tax calculation, and covenant monitoring. This approach supports discipline and reduces the cost of debt.

Cost of compliance and automation

The cost of compliance (compliance cost) for businesses rises not only because of payments but also because of processes. The solution developed at COREDO includes templates of control procedures, integrations with accounting modules, and dashboard configurations for the CFO. It eliminates manual errors and strengthens internal control and the audit of tax risks.

Tax architecture of Pillar Two

Estonia is known for the “tax on distributed profits” model, which helps startups reinvest. The defense levy may introduce new logic into corporate decision‑making.

Tax on distributed profits

If the defense levy is charged on distribution, companies will retain the incentive to reinvest. In that case, a legal structure to minimize the defense tax may include a holding layer to consolidate profits and plan dividends every 12–18 months to smooth tax peaks.

Transfer pricing and tax

Transfer pricing and the defense tax are directly linked: the margin at the Estonian company level determines the base. Transfer pricing documentation, master file and local file, support for benchmarks and a functions‑risks‑assets analysis: this is not a formality but a protection against reassessments and fines. The COREDO team implemented an IP risk rotation for a group SaaS business and updated the TP policy taking BEPS into account.

Anti‑avoidance: BEPS and Pillar Two

Thin capitalization, withholding taxes, VAT

Thin capitalization affects interest deductibility and, consequently, the ETR. Withholding tax on royalties and services should be checked against international double tax treaties. VAT and the defense levy for digital services are a separate block: SaaS providers must correctly determine the place of supply and use MOSS/OSS to avoid double taxation.

Residence and e‑Residency: migration

AML, compliance and reporting 2026

Tax transparency and AML requirements are increasing in parallel with tax reforms. I recommend establishing an overall compliance framework to avoid expanding control functions chaotically.

AML and KYC under new taxes

AML and KYC in the context of new taxes require verified beneficial ownership, source of funds and transparent payment routes. This reduces the risk of freezes and supports interbank limits and payment traffic (EUR) without disruptions. COREDO’s practice confirms: a clear AML profile speeds up onboarding at payment institutions.

Reporting 2026: requirements and disputes

regulatory requirements for 2026 reporting may include new forms and control metrics. I always prepare a «Plan B»: procedures to challenge tax decisions and legal mechanisms for appealing taxes. This is a working tool, not a call to conflict: a proper appeal reduces fines for non-compliance with tax reporting and resolves interpretive disagreements.

Defense contracts, technology export

Investments, M&A and Venture: Keeping the Pace

The tax agenda directly affects the cost of capital, round terms and M&A.

LPs and the macro effect on venture investing

Runway, cost of capital, exit valuation

The impact on the cost of raising capital is measured in the delta to the discount rate and in covenant requirements. Assessment of the risk of a startup’s runway shortening is conducted through a rolling‑12 cash projection taking the defense levy into account. The impact on exit valuation appears through revenue and EBITDA multiples; an optimization plan and proven control of compliance costs are important here.

Due diligence for R&D

C-level roadmap for 90 days

I like a pragmatic approach: rapid diagnostics, priorities, checkpoints. The COREDO team has implemented dozens of launches following these steps.

Tax strategy for European IT startups

• Mapping the legal structure: corporate structure: holdings and branches, substance, nexus.
• Legal structure options for minimizing defensive taxation without aggressive schemes.
• International treaties and avoiding double taxation: verification of treaty benefits.

Optimization in compliance with the law

• Tools for calculating tax burden and automating taxes in ERP.
• Legitimate tax-optimization scenarios: TP‑policies, dividend calendar, CapEx/OpEx mixes.
• risk insurance for fiscal reform and updating the risk‑register.

What an operational contour is

• Price management and passing costs to customers taking into account elasticity and competition.
• development outsourcing vs a local team considering social costs and IP control.
• Structuring employee pay and taxes, social contributions, ESOP, buy‑back rules.

Communication and resilience

• Managing investor relations and communication: a memo on tax strategy and scenarios.
• Supply chain and business resilience: cloud providers, CDN, backup payment channels in EUR.
• Internal control: roles, limits, audit, report to the Board once a quarter.

COREDO case studies: solutions for clients

First case: a European cybersecurity SaaS with its main legal entity in Estonia and customers in the EU and Asia. The COREDO team implemented a TP model rebuild: they redistributed risk functions between the Estonian head office and a service center in Slovakia, updated the master/local file and implemented ERP integration to calculate the defense levy. A DCF model with three scenarios showed that with a 1.5% surcharge to the payroll fund the company maintains LTV/CAC > 3.2 and does not lose runway. Investors confirmed the round with the previous covenants.

Second case: a fintech with licenses for payment services and crypto services in several EU jurisdictions. Our experience at COREDO showed that the regulatory reporting requirements for 2026 and the AML/KYC framework go hand in hand. We strengthened AML procedures, synchronized tax transparency and beneficial ownership, reviewed withholding taxes under international treaties, and integrated a stress test of the defense levy into the treasury policy. The correspondent bank retained the limits, and the funding cost did not increase.

Third case: a product IT core with R&D in Tallinn and commercial operations in the UK and Singapore. The solution developed at COREDO involved shifting part of CapEx to cloud contracts, introducing annual prepay for clients and phased price indexation. We built a potential defense levy into the discount structure, updated the ESOP so that talent retention preserved the target net income. As a result, the EBITDA margin remained within the target range, and the exit valuation in the model did not drop.

Frequently asked questions about complex matters

What to consider right now

• Update the DCF financial model with the new tax, add stress scenarios and covenant testing.
• Recalculate unit economics and pricing: impact on CAC, LTV, gross margin and payback.
• Conduct TP diagnostics and prepare transfer pricing documentation.
• Synchronize IFRS and local tax accounting; set up ERP integration of calculations.
• Strengthen AML/KYC controls and beneficial owner transparency for banks and regulators.
• Review international double taxation treaties and withholding taxes.
• Document procedures for challenging tax decisions and internal tax risk controls.

Strategic flexibility – the main asset of 2026

Estonia retains its strengths: digital infrastructure, clear rules and historically favorable business taxation. The introduction of the 2026 defense tax changes the equation, but does not break it. Timely financial planning, a clear tax strategy and compliance discipline protect margins, capital and investor confidence.

The COREDO team helps entrepreneurs calculate the tax burden taking the defense levy into account, adapt legal structures and build transparent reporting. I base my approach on a simple logic: transparency, legality and business rationality. This approach ensures tax neutrality where possible and supports the long-term competitiveness of the Estonian IT cluster after the reforms.

If you are planning registration, Licensing or AML setup for an international group, factor the defense tax into baseline scenarios today. This will strengthen management confidence, lower the cost of capital and create a foundation for growth that investors and banks view with interest and trust.

In recent years Vietnam has become one of the most pragmatic entry points for technology businesses: registering a company in Vietnam provides access to a strong talent pool, a competitive cost base and a growing ecosystem of high-tech parks. The team COREDO has implemented dozens of projects to launch development centers, structure IP, obtain financial licenses and build AML compliance. In this article I have compiled practical guidance that will save you months, and sometimes years.

Why choose Vietnam for software development outsourcing and R&D?

Presence models: branch, representative office, subsidiary, EOR/PEO

I start with a precise definition of the model. Branch vs subsidiary in Vietnam: a choice between the foreign company’s direct presence and a standalone legal entity.

• Registering a branch in Vietnam is suitable for companies already conducting regulated activities and planning to provide services directly. A branch simplifies control but increases the risks of a permanent establishment (PE) under international tax rules.
• Registering a representative office in Vietnam provides a platform for marketing and market research without the right to conduct commercial activities. It’s a convenient preliminary step if you are just exploring the country and building a pipeline.
• Foreign company in Vietnam: registering a subsidiary is the standard practice for IT. A subsidiary protects the head office, optimizes taxation, and simplifies local operations.
• EOR/PEO: the pros and cons of using an Employer of Record are obvious at early stages. You quickly hire developers, avoid creating a legal entity, and test demand. The downsides are limited control and provider fees. COREDO’s experience shows: transitioning from an EOR to your own legal entity after 6–12 months delivers the best economics.

Legal forms and investment certificates: IRC/ERC and IC

For IT and fintech, two forms are preferred:

• Công ty TNHH (a limited liability company in Vietnam, a Vietnamese LLC). Flexible capital structure, transparent corporate hierarchy, simple corporate reporting. Công ty TNHH (Vietnamese LLC) registration: the basic scenario for development centers.
• Công ty cổ phần (a joint-stock company in Vietnam). This is an option for scalable projects with subsequent involvement of external investors and option programs.

Foreign investors go through two stages: Investment Registration Certificate (IRC) and Enterprise Registration Certificate (ERC). IRC — the investment certificate (IC) in Vietnam — records the investment project and the approvals for types of activities. ERC creates the company as a legal entity and appoints the directors. The solution developed by COREDO arranges the schedule of steps so that IT company registration in Vietnam proceeds without gaps between the IRC and ERC.

Requirements for foreign investors and charter capital

How to open a company in Vietnam: timelines, cost, banking compliance

Step-by-step plan includes:

• Preliminary Due Diligence and assessment of risks and compliance during registration in Vietnam. We check the permissibility of business activities, the need for additional licenses and KYC/AML requirements and reporting.
• Obtaining an IRC: 15–30 working days depending on the province and industry.
• Obtaining an ERC: 3–5 working days after the IRC.
• opening a bank account for a company in Vietnam: 2–4 weeks, including banking compliance, beneficiary verification and business model review. Opening a corporate account and banking compliance will be facilitated by a detailed business plan, an office lease agreement and a draft staffing schedule.
• Registration of a tax number and e-invoice system: 1–2 weeks with connection to an electronic reporting provider.
• Hiring and payroll/EOR/PEO: start in parallel with ERC.

Taxes in Vietnam for IT companies and incentives

In tax planning I base my approach on three levels: general rates, sector incentives, and double taxation treaties (DTT).

• Corporate income tax (CIT) and incentives: the corporate tax in Vietnam has a default rate of 20%. For priority projects in high-tech and R&D preferential rates are available for IT and R&D, including a 10% rate for 15 years, tax holidays (often a model of 4 years exemption + 9 years at a reduced rate of 50%). The specific package depends on the location and project criteria.
• value-added tax (VAT) in Vietnam: standard 10%. Special regimes apply to software: certain types of software and export services may be taxed at 0% or exempted if the documentary and substantive export conditions are met.
• Registration in free economic zones and IT parks: registration in high-tech parks and the advantages include land on preferential terms, customs preferences, accelerated procedures and access to centralized infrastructure.

Transfer pricing, BEPS and DTT

При внутригрупповых потоках важно соблюсти трансферное ценообразование во Вьетнаме. Требуется локальная документация по TP, master file и country-by-country reporting при достижении порогов. BEPS recommendations and the impact of OECD guidance on Vietnam structures are felt through substance requirements, beneficial owner tests and controls against the risks of artificial fragmentation of functions.

Foreign exchange control and profit repatriation

The foreign exchange control rules of the State Bank of Vietnam distinguish between settlement (current) and investment (capital) accounts. Replenishment of the charter capital is done through the capital account; operational activities: through the settlement account. Mechanisms for repatriation of dividends and currency conversion operate after the annual audit and payment of taxes, through licensed banks and at the market exchange rate. I recommend building into the project schedule in advance quarterly interim payments to management companies under a market SLA to avoid cash shortfalls.

Personnel: work permits, TRC and labor law

For a quick launch I sometimes use company registration to hire developers in Vietnam in a lean-staff format: key roles, a director, a chief accountant (in-house or outsourced), HR and an office manager. The rest is covered by outsourced accounting, payroll and a legal retainer.

IP and contracts: code protection, NDA, SLA and escrow

Cybersecurity and personal data

Fintech and crypto: licensing and AML practice

Licensing of fintech and payment services in Vietnam is overseen by the State Bank. Payment intermediaries and e-wallet providers must demonstrate capital, IT security, risk management, and compliance with KYC/AML. Regulation of crypto assets and blockchain projects is evolving: token projects structure themselves as technology platforms, carry out legal analysis of asset functionality and accounting regimes, and particular attention is paid to the payment function of crypto assets in light of local restrictions.

Financial reporting, publications and tax discipline

Office, equipment import and customs

Disputes, arbitration and M&A

Evaluation of ROI, TCO and offshoring unit economics

Incubators, accelerators, grants and R&D structures

Personnel model: staff vs freelancers, nominees and insurance

FinOps and banking requirements

Opening a bank account is accompanied by KYC, verification of the source of funds, and analysis of the business model. Banks assess the due diligence of the provider of development services in Vietnam, check key contracts and the existence of internal policies on AML and sanctions. For foreign currency payments, it is useful to agree with the bank in advance on invoice formats and confirmation of service export in order to apply VAT and DTT benefits.

COREDO Case Studies: How We Launch and Scale

• Registration of an IT company in Vietnam for a European SaaS. The COREDO team registered IRC/ERC, chose Công ty TNHH, connected e-invoice, and built payroll. We structured transfer pricing, formalized DTT agreements and set up dividend repatriation mechanisms. Result: office payback in 14 months and a 28% reduction in TCO.
• Opening a development office using an EOR transition. We started with an EOR service in Vietnam for a pilot team of 12 engineers, then carried out company formation in Vietnam, migrated employees and integrated PEO services and payroll in Vietnam. SLA, KPI and penalty clauses in IT contracts, NDA and escrow for source code provided manageable delivery quality.
• Fintech and payment services. The solution developed at COREDO combined a licensing track with KYC/AML, monitoring and cybersecurity models, and aligned personal data handling with GDPR and local regulations. We built a cross-border data flow architecture, arranged a VIAC arbitration clause and ensured resilience to PE risks outside Vietnam.

Practical answers to frequently asked questions

• Cost of opening a company in Vietnam: legal and administrative setup: 12 000–25 000 USD depending on complexity and industry. Set aside 2–3 months’ salaries of key positions for initial liquidity.
• Timeline for company registration in Vietnam: 6–10 weeks to operational start, including accounts, e-invoice and office.
• Transfer pricing and documentation: prepare a local file and justify at the level of functions, assets and risks, synchronizing with the master file.
• BEPS and PE: differentiate product/engineering roles, take into account agency powers and physical presence abroad.
• Trademark and IP: register the brand and key IP assets, use escrow and assignment clauses.
• Process of liquidating a company in Vietnam: plan for audit, tax closure, settlements with employees, license revocation, then account closure. This takes 2–4 months in standard scenarios.
• Subcontracting contracts and SLAs: define metrics, penalties, rights to source code, non-solicitation clauses and the chain of IP transfer.

How COREDO reduces project risk

The benefit of my approach is its comprehensiveness. I combine legal engineering with operational practice, including:

• Assessment of TCO, LTV and project financial metrics so that unit economics work on a quarterly horizon.
• Due diligence of the development services provider in Vietnam and vetting of subcontractors, including sanctions risks and cyber profile.
• Data architecture for cybersecurity law compliance, localization, and GDPR mapping.
• bank onboarding with a KYC/AML package, UBO disclosure and profit repatriation models.
• Structuring holding and operating companies in ASEAN, optimizing for DTT and BIT.
• Setting up Agile and managing distributed development teams with mandatory code review and security testing so that code quality remains predictable.

Conclusion: How to move forward

I founded COREDO in 2016, and since then the COREDO team has carried out dozens of projects for company registration abroad, payment service licensing and setting up AML controls. Over that time I developed a simple rule: any integration of a crypto-fiat gateway is not about “quickly connecting an API”, but about the strategic architecture of the business, jurisdictions and processes. When an entrepreneur sees the on‑ramp/off‑ramp only as a “buy crypto for EUR/USD” button, they underestimate compliance, liquidity and the economics of conversions.

In this article I will lay out the regulatory requirements (MiCA, PSD2, AMLD5/6, Travel Rule), the architecture of a crypto-fiat gateway from the mobile app to the back office, KYC/KYT practice, integration of cards and banking rails (SEPA, SWIFT, ACH), project economics and the roadmap. I draw on concrete project experience in the EU, the Czech Republic, Slovakia, Cyprus, Estonia, the United Kingdom, Singapore and Dubai, and I will explain where real bottlenecks occur and how to work around them without losing transparency and SLA.

Why businesses need a crypto-fiat gateway

Customers expect a simple fiat on‑ramp and fiat off‑ramp: top up the balance by card or SEPA, buy an asset, lock in profits, withdraw to a bank account. Behind that simplicity is a complex chain of PSPs/EMIs, liquidity providers, blockchain analytics and AML transaction monitoring. If one link falters, you see increased declines, chargebacks and a drop in LTV.

In COREDO projects crypto‑fiat gateways often become the core of the product: thanks to a SEPA fiat gateway for cryptocurrencies, USD/EUR fiat exchange in the app and proper payment routing via PSD2 open banking API. It’s important to decide where to hold funds (custodial storage vs non‑custodial solution), how to manage liquidity between exchanges and payment providers, and how to maintain conversion without compromising AML.

MiCA, PSD2, AMLD5/6 and the Travel Rule

In the EU the approach is shaped by MiCA, PSD2 and the AML directives (AMLD5/AMLD6) together with the recommendations of the FATF. MiCA outlines the contours for VASP and stablecoins, PSD2: for payment rails and AISP/PISP integrations, AMLD: for KYC/CDD, sanctions screening and governance procedures. In practice this means: KYC for crypto-fiat gateways is mandatory, KYT (Know Your Transaction) in real time is the standard, the Travel Rule is part of the operational framework.

Licensing and corporate structure

Where to obtain permissions and how to organize the corporate structure is the first strategic choice. A mistake here means months of downtime and frozen accounts. I always start by mapping target markets, payment rails, operating currencies (EUR/USD/GBP/SGD), the custody model and the required margin.

EU: VASP registration and EMI/PI

In the EU two paths are popular: an EMI or PI license (e‑money/payment institution) for fiat rails and registration/authorization for virtual asset providers. Lithuania has become an EMI hub thanks to clear requirements and work with SEPA/SEPA Instant; Cyprus is actively advancing CASP registration and payment licenses, providing a bridge between the EU and the Middle East.

COREDO’s practice confirms: if the product targets a broad on‑ramp in EUR, a combination of an EMI in the EU + VASP registration and PSD2 integration for crypto payments provides flexibility, but requires a mature AML function. Timeframes: from 6 to 12 months for the full stack, including policy audits and beneficial owner checks.

Enhanced requirements for VASP in Estonia

Estonia has retained its status as a mature jurisdiction for VASP, but after reforms requirements have increased: capital, real presence, a qualified MLRO and detailed KYT procedures. The COREDO team implemented a project in Tallinn with on‑ramp/off‑ramp, where we aligned local AML policies with a Travel Rule router and an external sanctions screening provider. The result – seamless checks for both fiat and on‑chain routes.

Czech Republic and Slovakia: base and payments

The Czech Republic and Slovakia are convenient for corporate structure, back offices and hiring compliance teams. For “heavy” payment licenses these jurisdictions are not the first line, but they integrate well with an operational center in the EU and connection to local PSPs. Our experience at COREDO has shown that such a configuration speeds up Opening bank accounts and reduces administrative burden.

FCA: UK crypto registration

The UK requires crypto providers to register with the FCA, and for fiat — EMI/PI licenses. The regulator takes a strict approach to source-of-funds controls, governance and reporting. One COREDO client moved the custody function to a regulated custodian in the UK while keeping the non‑custodial logic of user wallets in the app: such a hybrid reduced regulatory burden and preserved UX.

PSA (MPI/SPI) and Singapore AML supervision

MAS is building a strict and predictable system under the PSA (Payment Services Act). For on‑ramp with cards and bank payments, the choice between Standard Payment Institution and Major Payment Institution affects limits and capital requirements. We helped a startup in Singapore implement a fiat‑collateralized stablecoin as an internal settlement layer for instant settlement inside the app – MAS accepted the model provided there was clear segregation of client funds and market risk.

VARA and DIFC/ADGM in Dubai

Dubai is shaping clear rules via VARA for VASP and separate regimes in DIFC/ADGM. The COREDO team set up offboarding through local PSPs and integrations with international exchanges under Travel Rule control and transaction reporting. The regulator requires real risk‑scoring systems and incident management procedures: we integrated monitoring and alerting (Prometheus, Grafana) and documented an SLA 99.9% with an escalation plan.

Architecture of a crypto-fiat gateway

I recommend viewing the architecture as a set of domains: payment rails (fiat rails), crypto operations, AML/anti-fraud, liquidity, accounting and reporting, security and data privacy. At the interface level, gateway APIs for crypto-fiat operations are critical, supporting REST/Webhook/WS, webhook retry logic, idempotency and API rate limiting and throttling.

For custody, choice matters: a custodial wallet with multisig and cold storage under key management or a non-custodial wallet where the user controls the keys. Custody affects Licensing and operational risks. I often recommend a hybrid: a hot wallet for on-ramp instant issuance, cold storage with multi-level approval, hardware wallet for offline keys and a clear settlement finality policy.

Integration of SEPA, SWIFT, ACH and cards

Step-by-step integration of SWIFT/SEPA/ACH into a crypto gateway starts with choosing a PSP/EMI and an open banking API. SEPA Instant speeds up EUR settlements, SWIFT gpi improves tracking of international transfers, ACH covers the US. For cards: acquiring with 3-D Secure, PCI DSS compliance, issuer processor and, if necessary, BIN sponsorship.

In COREDO projects we combine PSD2 AISP/PISP to reduce settlement costs and increase authorization. Reliable fiat on a crypto gateway is built on transaction routing: if a card is declined, offer SEPA or open banking; if ACH is slow, provide an instant on-ramp using PSP credit under risk limits.

Liquidity and market infrastructure

Liquidity providers for gateways, OTC desks and market makers provide access to tight spreads. Currency risk management and hedging for crypto-fiat transactions reduce margin volatility: use FX spread control, forward contracts, and for intra-system transfers, use stablecoins as internal fiat for instant liquidity.

Cross-chain bridges and atomic swaps are complex mechanisms that require smart contract audits and a risk acceptance policy. In most on-ramp cases, liquidity on major exchanges and pools, agreed settlement and counterparty limits with daily reconciliation are sufficient.

Anti-fraud and real-time AML

AML checks for onramp/offramp are built on three layers: KYC/CDD, behavioral scoring and KYT. Implementing KYT (Know Your Transaction) in real time includes rules on amount, geography, source of funds, blockchain address risk metrics and sanctions lists. monitoring tools for risk and transaction scoring for the business should provide interpretable reasons for rejection and feedback to the product.

Integration of UX into product development

Integration of fiat payments into a crypto app begins with mapping the user journey. Best practices for UX for fiat on‑ramp, early notification of KYC steps, visibility of the final fee and spread, choice of payment method and a transparent ETA for crediting. In the background — idempotency for payments and webhooks, a retry mechanism and handling of status collisions.

How to connect a crypto-fiat gateway

How to connect a crypto‑fiat gateway in a mobile app is a common question. I recommend provider SDK/JS bridges, card tokenization, strict key isolation, and biometrics on critical steps (withdrawal/changing details). The API interface for fiat and cryptocurrency exchange (REST/Webhook/WS) should support statuses, idempotent keys, webhook signatures and a time‑based nonce.

The UX flow accounts for 3‑D Secure, fallback to open banking and pre-filling of details for SEPA. For KYT the logic shows the user the reason for a delay and requests documents specifically, avoiding frustration. This approach supports the conversion rate without neglecting AML.

Project economics: ROI

The cost of integrating fiat gateways and calculating ROI rely on two axes: fixed costs (licenses, audits, development, PCI DSS/infrastructure) and variable costs (interchange fees, acquiring, network, KYC/KYT providers, blockchain fees, liquidity providers). How to assess ROI from integrating a crypto‑fiat gateway? Model the unit economics fiat‑fiat‑crypto for each payment rail taking into account cancellations, chargebacks, AML rejections and the FX spread.

Chargeback risk management and handling dispute management in fiat‑crypto exchanges require clear documentation, transparent terms, 3‑D Secure logs and instant responses to bank requests. How to organize automated matching and reconciliation? Use a sub‑ledger, pending statuses, counterparty mapping and daily reports. This eliminates “leakage” and reduces manual work.

How to operate and scale?

Plan B in case of sanctions/license revocation and scenarios of liquidity collapse include alternative PSPs/EMIs, backup exchanges, emergency limits, a playbook for counterparty failure and a client communication procedure. The COREDO team helped a client in the EU survive the sudden stoppage of one PSP: within 48 hours we switched the on-ramp to a backup provider, preserving the SLA and cash-out via SEPA.

Taxes and compliance in the EU and Asia

Taxation of crypto-fiat transactions in the EU/Asia depends on the jurisdiction, the status of the tokens, and the place where services are provided. Most often, income from fees and spreads is subject to corporate tax, while VAT requires analysis of specific operations. Taxation of cross-border transactions and profit repatriation is a separate area of tax planning that I raise at the start of a project.

Data privacy and the GDPR dictate the storage and processing of personal data, including KYC dossiers, transaction logs, and biometric templates. Data residency and localization in certain countries require segmenting infrastructure and encryption keys. Encryption and key management are part of the security architecture, with key rotation, HSMs, and access auditing.

COREDO: Case studies from practice

• EU, crypto‑application with SEPA on‑ramp. The COREDO team implemented PSD2‑integration and SEPA Instant, integrated Trulioo and Chainalysis, established KYT‑rules and automatic reconciliation. Onboarding conversion increased by 9%, time to first deposit decreased from two days to a few minutes.
• Singapore, licensing under PSA and stablecoin‑settlement. The client obtained MPI status, built a fiat on‑ramp through cards and local banking rails. Internal settlement ran through fiat‑collateralized stablecoin, which reduced operational liquidity gaps and allowed maintaining a 99.9% SLA on withdrawals.
• Dubai, VARA and Travel Rule compatibility. We connected Travel Rule providers, configured sanctions screening and behavioral anti‑fraud. Local PSPs integrated with international exchanges via the gateway API for crypto‑fiat operations; a contingency plan for counterparty failure was embedded in operational procedures.
• United Kingdom, hybrid custody‑model. The client moved from full custodial storage to a model delegating to a custodian and non‑custodial user wallets. This eased FCA requirements while preserving the convenience of fiat off‑ramp.

90–180-day launch roadmap

• Weeks 1–4: strategic design. Jurisdictions, corporate structure, selection of PSP/EMI/exchanges, custody and liquidity model, on-ramp/off-ramp strategy. AML/KYC/KYT policies, Travel Rule frameworks, DPIA for GDPR.
• Weeks 5–10: licensing and contracts. Submitting applications (VASP/EMI/PI where required), KYC providers (Jumio/Onfido/Trulioo), Chainalysis, acquiring and BIN sponsorship if necessary. Development of open banking API.
• Weeks 8–14: development and integrations. Gateway API, webhooks, idempotency, PCI DSS controls, 3‑D Secure, reconciliation ledger mapping, monitoring and alerting, CI/CD and test environments.
• Weeks 12–18: pilot and launch. Regulatory sandbox pilot, load testing, AML playbooks, back-office training, production launch, SRE on-call and post-mortems for incidents.

Frequently asked questions for executives

• How to ensure MiCA compliance and AMLD when launching an on‑ramp? Assign MLRO roles, a KYT‑engine with interpretable rules, sanctions screening, Travel Rule integration and a review/escalation process.
• How much time and budget are required for integration and obtaining licenses? For a “minimum viable” configuration in one jurisdiction allow 3–6 months and budget for development, licensing, KYC/KYT and PCI DSS. Full EMI+VASP stack – from 6 to 12 months.
• how to choose the model custody – hold funds or delegate to a provider? Compare regulator requirements, risk appetite, internal competencies and UX. A hybrid is often optimal.
• How to scale the gateway as transactions grow and maintain SLAs? Implement SRE‑processes, horizontal scaling, alerting, API rate limiting and backup providers.
• What liquidity drop scenarios and action plan if a counterparty fails? Contracts with alternative PSPs/exchanges, counterparty limits, rapid rerouting of volumes and a pre-written playbook.
• How to integrate anti-fraud and AML without reducing on‑ramp conversion? Use staged KYC, adaptive checks, behavioral scoring, false positive management and clear UX prompts.
• Is it worth using a stablecoin inside the app to speed up settlement? For internal settlements this often simplifies liquidity and reduces operational delays: provided proper accounting and legal review.
• How to build a revenue model: fees, spread, interchange and FX margin? Test pricing on different rails, account for network and processing fees, optimize margin via liquidity providers and routing.

How COREDO helps

COREDO covers the entire cycle: company registration in the EU, the United Kingdom, the Czech Republic, Slovakia, Cyprus and Estonia; licensing in the EU, Singapore and Dubai; AML/KYC/KYT setup; selection and contracts with PSPs/EMIs, liquidity providers and custodians. The COREDO team develops policies and operational playbooks, builds Travel Rule contours, assists with PCI DSS and 3‑D Secure integrations, and also supports bank account openings and BIN sponsorship.

Conclusions

COREDO has been designing such solutions since 2016 for the EU, Asian and CIS markets. When an entrepreneur receives a roadmap from us, they don’t get a set of pretty words but a proven path: what to do in which sequence, which metrics to control and how to take managed risks. If you are preparing to launch or scale a crypto‑fiat gateway, let’s discuss your target markets, licenses and economics — and assemble a solution that will withstand growth and regulatory scrutiny.

Since 2016 I have been leading COREDO and have personally supported dozens of cross-border projects — from company registrations in the EU and Asia to licensing payment and crypto services and complex M&A. Over the years the LBO transaction — a leveraged buyout (LBO) — has become one of the key topics where entrepreneurs and CFOs simultaneously see potential upside and significant risks. I often hear the same questions: how to structure debt, which covenants to include, how to protect creditors, when mezzanine makes sense, how to minimize tax and comply with AML/FDI. In this article I systematize the best practices used by the COREDO team and share concrete tools that can be implemented already at the planning stage.

LBO Structure: HoldCo, OpCo and Risks

In a client-centric LBO I always start with the target structure. The HoldCo–OpCo model remains the baseline: the holding company (HoldCo) raises financing and acquires the operating companies (OpCo), and then implements a debt push‑down where it is lawful and economically justified. This arrangement simplifies governance, eases the security package and reduces the risk of “cross-contamination” within the group. It also clarifies accounting, which is important for the subsequent exit and W&I insurance.

Finally, the allocation of risks between banks, bondholders and the sponsor. In the intercreditor agreement we fix the waterfall, pari passu/priority of claims and voting protocols so that no decision vacuum arises in stress scenarios. This is not “paper for lawyers” but a working tool that, at a critical moment, determines who and how manages enforcement.

Buyout financing: debt financing

Often clients underestimate the variety of debt instruments in the EU/UK/Singapore/Dubai. It’s not only about term loans and revolvers, but about a set of modular elements that we combine to fit the target’s specific cash‑flow profile.

• Senior secured debt. The base layer secured by shares (share pledge) and assets (asset pledge). It is cheaper but imposes strict financial covenants and requires a well‑thought security package.
• Senior unsecured debt. Used for flexibility and speed; however, it is more expensive and requires careful covenant management so as not to overburden reporting and not to block capex.
• Subordinated debt and mezzanine finance. These instruments increase leverage capacity but carry higher cost and often include PIK interest and options. I use them when the senior layer hits covenant headroom and business growth covers the risk.
• Revolvers and credit lines. They smooth working capital and seasonality. With a proper cash sweep and dividend restrictions (dividend lock‑up), a revolver reduces the risk of default on principal payments.
• Bridge financing and variable lending. Suitable for carve‑out LBOs and a fast transaction pace, when part of the financing is brought in after closing.

Security package: collateral and trustee

A good security package is not “the more collateral the better”, but “exactly as much as will allow quick and lawful enforcement”. I build a multi-level structure: a share pledge on HoldCo/OpCo, asset‑backed security on key assets and security over intellectual property (IP) if IP is a revenue driver. In cross-border deals it is important to ensure that pledges and guarantees are enforceable in each jurisdiction and comply with insolvency laws.

Additionally, I always include a negative pledge, prohibitions on new security and carve-outs for operational needs. Such provisions protect lenders from “dilution” of collateral, but do not strangle the OpCo’s working capital. The balance is achieved through well-drafted incurrence tests and agreed perimeter exclusions.

Intercreditor: priority of creditors

Intercreditor agreement regulates priority, the payment waterfall, the standstill period and the voting procedure for amendments. In multi-layered financing it resolves the conflict between senior and mezzanine creditors, and also eliminates «grey areas» where each creditor expects someone else to act first.

Templates don’t work the same in the EU, UK and Asia, so I adapt the structure of voting protocols and the thresholds for amendments. In some countries certain amendments require the unanimous consent of senior creditors, and it’s better to take that into account upfront.

Covenants: covenant management

The key to a stable LBO is realistic financial covenants and well-considered maintenance vs incurrence covenants. I recommend combining a leverage covenant and an interest coverage ratio with DSCR and the setting of headroom, taking seasonality and the capex‑profile into account. Such a basket reflects the real ability to service the debt, not just a ‘pretty’ EBITDA.

Negotiating a covenant‑lite approach is appropriate when the borrower’s profile is stable and lenders understand the business model. I push for covenant‑lite not for the sake of a ‘tick-box’, but to reduce the likelihood of technical breaches while keeping the lenders’ risk profile unchanged.

Taxes and debt push-down: efficiency

Tax‑efficient holding structures allow you to simultaneously reduce the tax burden and meet economic substance requirements. Together with tax advisers we set up transfer pricing, analyze withholding taxes and apply interest allocation rules to avoid exceeding local thin capitalization limits.

As part of tax planning for an LBO, I build in dividend restrictions (dividend lock‑up) and cash sweep mechanisms. They accelerate deleveraging and improve ROI over a 24–36 month horizon, and are also viewed positively by lenders and W&I insurers.

Due diligence: what I check and prepare

Legal due diligence for an LBO is not a rewrite of corporate history, but a search for points that turn into price, terms and the structure of security. In focus are titles to assets, IP, key contracts with change of control, licenses and permits, employment/compensation agreements and unresolved disputes. The COREDO team persistently checks beneficial ownership (UBO) and sanctions risks, since banks and insurance companies have made this standard.

Separately, I note completion accounts and post‑closing adjustments. For an LBO they are critical, as they change net debt and working capital, and therefore: leverage. I provide for a clear methodology and an independent expert in case of dispute, to avoid protracted proceedings after closing.

antitrust, FDI, AML/KYC and sanctions

Competition/antitrust clearance and foreign direct investment (FDI) screening often determine the timing of the LBO. In the EU and UK I assess thresholds in advance and submit notifications before signing if this affects CP conditions. In Asia and the Middle East we check sectoral restrictions and local ownership requirements to avoid a “surprise” after the financing has been agreed.

AML/KYC for lenders and investors is part of the mandatory track. I conduct independent AML screening, identify beneficial ownership and verify sanctions screening and compliance. These processes are integrated into the CP list and reduce the risk of a tranche being halted due to a non-obvious link to sanctioned persons.

COREDO case studies

• Secondary buyout in Central Europe with a mezzanine component. The COREDO team implemented a HoldCo–OpCo structure with senior secured and mezzanine finance, providing share pledge and IP pledge on the key software. The intercreditor agreement fixed a standstill and waterfall, and covenant‑lite was applied only to incurrence tests, retaining maintenance covenants for leverage and DSCR. As a result the sponsor gained flexibility for growth, and the banks: managed risk.
• Carve‑out LBO of a technology subsidiary in the UK/EU. Our experience at COREDO showed that bridge financing and escrow arrangements allow closing the deal before completion of IT migration and licensing agreements. W&I insurance mitigated the risk of historical tax liabilities, and the dividend lock‑up and cash sweep accelerated de‑leveraging without harming R&D.
• Cross‑border LBO involving Singapore and Dubai. We structured upstream guarantees taking into account restrictions in local law and agreed negative pledge carve‑outs for trade finance. Debt push‑down was implemented in stages after FDI clearance so as not to breach CP conditions and not expose creditors to regulatory risk.

MAC, default and remedial playbook

Risks in an LBO are predictable if you name them and set out the remedies. I build material adverse change (MAC) clauses that realistically reflect the business profile rather than copying generic templates. This reduces the likelihood of disputes and gives the parties a transparent “traffic light.”

Contingency planning covers refinancing, currency risks and supply risks. I use sensitivity analysis and stress tests to check the debt capacity analysis and to ensure that even with a 20% decline in EBITDA the company maintains a DSCR above the agreed threshold.

Debt restructuring after a buyout

Not every restructuring is a failure. Sometimes it is a planned optimization stage after growth, where a pre-pack and a consensual reorganization give the business a second wind. The COREDO team conducts intercreditor negotiations, coordinates DIP financing and interim financing, and reallocates covenants in favor of flexibility without losing creditor control.

I review insolvency laws and priority of claims at early stages. This allows, if necessary, quickly agreeing on enforcement and avoiding loss of asset value due to procedural uncertainty and disputes among creditors.

Management motivation and control

Agreements between shareholders and MIP (management incentive plan), top-5 documents by impact on results. I insist on clear KPI, vesting and clawback so that management has “skin in the game” and shares long-term goals. This reduces the risk of aggressive dividends and incentivizes investments in growth.

Governance changes post‑LBO often include strengthening the roles of audit and risk committees, a schedule of covenant updates and quarterly stress sessions. This regime increases predictability, and lenders appreciate the discipline and respond by improving terms on refinancing.

What to include in a sponsor’s guarantees

Which legal guarantees to require from the sponsor in a buyout is a common question. I set out capital commitments, support in case of a covenant breach, restrictions on additional encumbrances and penalties for unauthorized transactions. These provisions hedge creditors against “dilution” of interests and discipline investment decisions.

In the disclosure schedules I recommend transparently describing all side letters, intercompany loans and obligations to management. Honesty at this stage saves months of disputes and tens of basis points in the cost of financing.

Due diligence and integration checklist

The documentation checklist for the legal team I keep as a “battle map”. It includes draft versions of the purchase agreement, loan agreement, intercreditor agreement, security package, corporate approvals, AML/KYC packages, sanctions certificates, antitrust notifications, FDI files, W&I policy and schedules, escrow instructions and the closing set.

What documents a lawyer prepares at each stage of the LBO is a frequent request from the CFO. I detail it on the project timeline, assign owners and prioritize by criticality so management spends time on decisions, not on correspondence.

Antitrust and FDI control in LBO

In cases where FDI may impose conditions, I ask banks to build flexibility into the CP list and price formulas. This eases tension and leaves room for constructive dialogue with regulators.

Safeguarding the value of cyber and IP assets

How to create a pledge over intangible assets (IP) in an international group: a separate area. I inventory the rights, check registration in key countries, coordinate licensing flows between the OpCo and the IP‑holding and ensure security over IP taking into account local registries. This is important for technology companies where IP is the main collateral asset.

Escrow arrangements and retention mechanisms are useful when some risks are disclosed only post-closing. We use them together with W&I to avoid keeping large contingent liabilities on the buyer’s balance sheet and to avoid provoking a covenant breach.

Questions executives ask when preparing an LBO

• How to assess debt capacity and leverage for an LBO? I conduct a debt capacity analysis based on stress‑testing of cash flow, DSCR and industry shock scenarios. This creates a reliable framework for negotiating price and debt terms.
• Which covenants should be included in a loan agreement to protect creditors? I choose a combination of maintenance and incurrence covenants, tie baskets to metrics, and limit investment activity through tests so as not to strangle growth. Such a set balances interests and reduces the likelihood of default.
• How does the debt structure affect ROI in an LBO? The larger the share of cheap senior secured debt and the more disciplined the cash sweep, the higher the equity IRR, all else equal. Nevertheless, an excess of debt reduces headroom and increases the risk of covenant breaches.
• What legal measures reduce the risk of credit default after an LBO? Clear MACs and default remedies, a clear cure mechanism, a structured intercreditor agreement and an enforceable security package provide time and tools for a managed response.

How the COREDO team builds the process

We start with a strategic session with the owner and the CFO. I clarify goals for ROI and timing, the regulatory map (licenses, FDI, AML/KYC), the presence of carve‑out factors and management’s readiness for MIP. Then I create the roadmap: due diligence, documentation, financing, regulatory matters, closing and a 100‑day plan.

After closing, the COREDO team supports covenant management, prepares reports for creditors, implements tax planning and helps management integrate debt restructuring into the company’s growth and scaling plan. This format reduces «transactional noise» and speeds up progress toward the target deleveraging.

mezzanine instead of senior debt

Mezzanine makes sense when:

• Operational growth and margins cover the higher cost of capital, and senior limits have already been reached. These are common cases in technology and niche services, where the growth rate exceeds banks’ risk appetite.
• Flexibility of covenants is critical for an M&A roll-up strategy. Mezzanine often provides leeway in incurrence tests and permits more aggressive capex without the risk of technical default.

The COREDO team weighs these factors through financial LBO modelling and sensitivity analysis. This approach makes the choice of mezzanine not a dogma, but a deliberate investment in speed and scale.

Enforcement of Cross-border Security by a Lawyer

How does a lawyer ensure enforcement of cross‑border security? The secret is in three steps: the right choice of governing law and jurisdiction, perfecting the security in the required registries, and a contractual enforcement architecture that takes local procedures into account. We use a security trustee and agency agreements, coordinate debtor notices and check priority in local collateral registers.

The role of escrow and retention mechanisms also increases in cross‑border cases. They insure payment of the price during registration and help bridge regulatory gaps without changing leverage.

Exit strategies and reallocation

Exit strategies in LBO: trade sale, IPO and secondary buyout. Each option dictates its own emphasis in governance, reporting and covenants. I prepare the company for refinancing or sale, aligning the capital structure and removing “legacy” restrictions that can reduce the multiple.

Our experience confirms: a proper 100‑day plan after an LBO accelerates reaching the target ROI and increases the likelihood of a favorable exit. This is not a theoretical statement, but the result of dozens of projects in the EU, UK, Singapore and Dubai.

Recommendations for the CFO and owner

• Carry out a debt capacity analysis before engaging with banks. Create stress scenarios for revenue and costs to demonstrate the resilience of DSCR and interest coverage. This will speed up the move to discussing pricing and covenants and increase counterparties’ confidence.
• Set up covenant management as an operational process. Define responsible parties, monitoring frequency and escalation thresholds. This will reduce the likelihood of technical breaches and make communication with lenders predictable and constructive.
• Integrate AML/KYC and sanctions screening into the CP track. Prepare standardized packages for lenders and investors to avoid tranche delays and reputational risks.
• Early dialogue on antitrust/FDI. Determine thresholds, timelines and the risks of conditional measures. Build this into the SPA and LOAN as a managed variable, rather than as a risk to closing and penalties for non‑performance.

Conclusions

LBO is a powerful tool for accelerating growth and increasing equity value, provided it is built on a solid legal and financial architecture. At its core is a rational HoldCo–OpCo structure, an appropriate mix of senior/subordinated/mezzanine debt, an executable security package with a clear priority of creditors, and a transparent system of covenants. Equally important are tax efficiency without loss of substance, properly calibrated due diligence, and regulatory discipline in antitrust/FDI and AML/KYC.

Since 2016 I have been leading international registration and licensing projects, and during that time the COREDO team has turned redomiciliation from the BVI to the UAE into a clear and manageable process. Clients come with the same pains: timelines and requirements vary by zone, banks are tightening KYC, and regulators expect real substance. I see the challenge differently – to turn the change of jurisdiction into a strategic advantage in access to capital, asset protection and tax management.

Redomiciliation: not just a “move”. It is the preservation of legal continuity, contractual force and beneficiary status when transferring registration from the BVI to the UAE. In this article I will lay out the entire process: from preparing the certificate of good standing to opening an account and registering under the Economic Substance Regulations (ESR). COREDO’s practice confirms: when a company acts according to a clear plan, moving its jurisdiction from the BVI to the UAE strengthens the trust of banks and investors rather than raising unnecessary questions.

Why move a BVI jurisdiction to the UAE?

The third reason is operational efficiency and scaling. The UAE simplifies Licensing of fintech, payment services, crypto operations and investment management. In my projects, redomiciliation of a holding company from the BVI often goes hand in hand with obtaining licenses in ADGM, DIFC or DMCC and subsequently setting up banking relationships, which increases the ROI from the move.

Free zone or mainland in the UAE

The choice between a free zone and the mainland depends on the business model, client geography and requirements for substance. In free zones it is easier to manage corporate procedures, register faster and select licenses more precisely, including fintech and virtual assets. The mainland provides flexibility for working with the local market and government contracting, but requires a different level of local involvement.

Our experience at COREDO has shown that holding companies and investment structures feel comfortable in ADGM and DIFC thanks to developed common law and predictable judicial practice. Trading and service companies often choose DMCC because of its flexible range of activities and well-thought-out infrastructure. For manufacturing and logistics projects it is appropriate to consider other free zones with industry specialization.

Licensing in DIFC, ADGM and DMCC

ESR and substance in office and personnel

What to consider in a redomiciliation project

On the BVI side, the BVI Business Companies Act and the registrar’s continuation (redomiciliation out) procedures apply. You need to prepare shareholders’ and directors’ resolutions, a certificate of good standing and a set of constitutional documents to confirm the legal capacity to effect the transfer. It is important to check for the absence of outstanding sectoral licences, encumbrances and court restrictions.

In the UAE, the UAE Commercial Companies Law and the local regimes of the specific zone apply: DIFC Companies Law, ADGM Companies Regulations or DMCC registration rules. Each registrar requests its own forms, but expects the same substance: a clean history, proper corporate governance and a clear UBO structure. It is possible to redomicile a company from the BVI to the UAE with strict compliance with the procedures of both jurisdictions and synchronization of dates.

I pay special attention to the requirements of the beneficial owner (UBO) register in the UAE. A transparent ownership structure and proper nominee agreements reduce the risk of delays and refusals. I discuss disclosure levels with beneficiaries in advance so that banks and regulators see the real picture of ownership and control.

BVI to UAE Redomiciliation Instructions

I start by assessing objectives and constraints. If the goal is to redomicile a holding company from the BVI and subsequently obtain licensing in ADGM, the plan and budget differ from transferring an operating business to DMCC. I record the desired project ROI, preferred timelines and the regulatory route to establish a reliable critical path.

Preparing due diligence and board minutes

• I conduct integrity checks (due diligence) on directors, shareholders and key counterparties. This reduces AML risks and helps prepare for UAE banks’ KYC. In the checklist I include sanctions screening, adverse media and an assessment of the ownership structure.
• I order a BVI certificate of good standing and, if necessary, a certificate of incumbency. These documents confirm the company’s current status. I arrange apostille, notarization and legalization of documents for the UAE taking into account the zone’s requirements.
• I update corporate documentation: meeting minutes, shareholder resolutions and board minutes related to the redomiciliation. I make amendments to the memorandum & articles so that it complies with the rules of the chosen UAE zone. This speeds up the registrar’s approval.

Redomiciliation of a BVI company to the UAE

• I submit the application package to the zone (DIFC/ADGM/DMCC) with a business plan, UBO structure, address proof and substance. The registrar performs KYC and, if necessary, requests additional information. My experience shows that clear answers in the first round save weeks.
• I obtain preliminary approval and synchronize the date of exit from the BVI with the date of entry into the UAE. This preserves legal continuity during the redomiciliation, and the company continues to operate without interruption. I coordinate in advance the wording of the confirmation letters with both registrars.
• I complete the procedure in the BVI and activate the registration in the UAE. At this stage I transfer the share register, approve the directors and record the powers of the resident director. At the same time I initiate processes for bank accounts and licenses.

Registration after redomiciliation in the UAE

• I register the company for ESR and prepare a risk management policy. Internal controls and protocols create “traces” of managerial decisions in the UAE. This is critical for banks and tax authorities.
• I assess tax residency and prepare a tax residency certificate (TRC). This supports the application of double tax treaties and the MLI where appropriate. I document positions on transfer pricing and PE to avoid undesirable implications in countries of presence.
• I prepare the banking dossier and apply to target banks. Taking into account the industry and risk profile, I select financial institutions that are tolerant of the business specifics. A correctly compiled KYC package reduces the time to open an account.

Requirements for constitutional documents

Requirements for charter documents during redomiciliation vary by jurisdiction, but the general logic is the same: adapt the articles of association to UAE regulations and ensure compatibility with corporate procedures. Where necessary, I update provisions on share issuance, minority rights and dispute resolution mechanisms. I prepare notarized powers of attorney and the transfer of authorities to local directors in advance, with apostille and legalization.

I organize the translation of contracts and agreements during redomiciliation on a dual track: legal validity and operational applicability. For cross-border obligations I use coordinated notices so that banks, lessors and key counterparties continue to operate on the new details. This reduces the likelihood of disruptions to payments and deliveries.

How to preserve contracts and IP

IP rights are transferred taking into account local law and the IP registration regime. I conduct a portfolio audit, register the necessary elements in the UAE and synchronize licensing agreements. In projects involving cross-border data transfers, I build in GDPR-like requirements and confidentiality agreements.

I analyze the impact of redomiciliation on contracts with counterparties and licenses in advance. If the business is regulated (financial services, crypto, investments, real estate), I arrange temporary agreements and support letters so the bridge between BVI and the UAE is legally sound. This approach supports credit lines and counterparty authorization.

Bank accounts and KYC during migration

Tax implications in the UAE

Licenses, sectoral crypto regulation

Regulation of digital assets and crypto operations during redomiciliation requires coordination with VARA in Dubai, as well as with the FSRA (ADGM) or DFSA (DIFC) regarding securities and derivatives. The COREDO team implemented cases of configuring crypto operations under VARA and licensing investment services in ADGM, which allowed clients to quickly relaunch their product line.

For payment services, forex and investment management, I separately take into account the capital requirements, the team and IT controls. I align the licensing roadmap with the plan substance and hiring, so that the regulator sees a realistic schedule. This directly affects the timeline for account openings and the start of operations.

Employment law for office staff

Employee transfers and labor law issues during redomiciliation require early communication. I prepare employment contracts under UAE law, plan the visa strategy and HR processes. This creates predictability and reduces staff turnover.

Office lease agreements and substance in the free zone I link to the hiring plan and licensing requirements. To evidence actual management I reserve meeting rooms, maintain a calendar of board meetings and keep minutes. Such a track record simplifies annual ESR reporting.

Insurance and business risks should be updated for the new jurisdiction. I adapt D&O, professional liability and cyber risk policies to meet client and regulator requirements. This strengthens overall resilience.

Timing and cost of redomiciliation from the BVI

The cost of redomiciling a BVI company in the UAE depends on the zone, the complexity of the structure and licensing. The budget covers government fees, legal work, apostille and consular legalization, translations, office and substance, as well as bank setup. For licensed sectors I add the regulator’s capital and operational requirements.

Redomiciliation vs liquidation of BVI

Branch registration vs full redomiciliation, a compromise for a business testing the market. A branch starts faster but has perception limitations with banks and counterparties. For M&A deals and raising capital, full redomiciliation provides greater predictability.

Comparing redomiciliation in the UAE with other jurisdictions (Cyprus, Macau, Singapore) shows that the UAE wins on the combination of infrastructure, licensing and banking capabilities. In some models Singapore is stronger in the fund ecosystem, and Cyprus in certain tax nuances. The final decision depends on the product, client geography and investor requirements.

Minutes of the board of directors

Corporate governance and the requirements for board minutes during redomiciliation are fundamental. I conduct board workshops on redomiciliation to align expectations and outline roles. This speeds up document signing and reduces the risk of conflicts.

UBO disclosure rules in the UAE require accuracy and discipline. I set up disclosure policies and a process for regularly updating information. This aligns with banking practice and simplifies periodic reviews.

Sanctions and antitrust checks

legal risks and antitrust/sanctions checks during redomiciliation I include in early due diligence. Counterparty screening (third‑party due diligence) and compliance procedures after redomiciliation foster a culture of control. This is viewed positively by banks and investors.

COREDO case studies: what works

Case 1: re-domiciliation of a BVI company to the UAE for a holding in ADGM. Client: a group with an IP portfolio and contracts in Europe and Asia. I organized a step-by-step re-domiciliation plan for the BVI, adapted the charter, transferred IP licenses and established ESR. As a result the company obtained a TRC, opened an account with a local bank and secured a funding round from a fund that required substance and a transparent UBO.

Case 2: re-domiciliation of an offshore company to the UAE and licensing of crypto operations. The client moved the company’s registration from the BVI to the UAE, opting for DMCC with subsequent engagement with VARA. The solution developed at COREDO included migration of banking relationships, preparation of AML policies and staff training. The launch went according to schedule; banks approved the accounts after confirming KYC procedures and transaction monitoring.

Checklist for redomiciling a BVI company to the UAE

• Стратегия и ROI: сформулируйте стратегические цели и ожидаемый ROI. Уточните юрисдикцию в ОАЭ, модель лицензирования и substance.
• Юридическая рамка: проверьте соответствие BVI Business Companies Act и требованиям регистратора компаний BVI. Сверьте нормы UAE Commercial Companies Law и правил выбранной зоны.
• Документы: подготовьте certificate of good standing, устав (memorandum & articles), решения акционеров и board minutes. Обеспечьте апостиль, нотариальное заверение и легализацию документов для ОАЭ.
• Структура UBO: соберите полное UBO‑досье и nominee agreements. Согласуйте уровень раскрытия для банков и регуляторов, чтобы ускорить KYC.
• Substance: зарезервируйте офис и определите резидентного директора. Спланируйте персонал и управленческие процессы, чтобы соответствовать ESR.
• Контракты и IP: проработайте правовые механизмы сохранения контрактной силы. Перенесите права на интеллектуальную собственность и согласуйте лицензионные соглашения.
• Банки и KYC: подготовьте пакет для банков с описанием бизнеса и источников дохода. Спланируйте параллельную работу старых и новых счетов для плавного перехода.
• налоги и комплаенс: оцените последствия по CRS, FATCA, CFC, PE и MLI. Настройте transfer pricing и получите TRC при необходимости.
• Лицензии: определите регулятора (DFSA, FSRA, VARA, SCA) и график лицензирования. Впишите требования к капиталу и команде в бюджет проекта.
• Операции и ИТ: адаптируйте ERP, данные и процессы под локальные правила. Установите disclosure policies и процедуру отчетности для совета и инвесторов.

How to avoid mistakes during redomiciliation

How to redomicile a company in the UAE

Strategic aspects

Structuring a restructuring using trusts and funds is possible if it is consistent with UBO disclosure and licensing. In individual projects I set up funds in DIFC/ADGM for wealth management and capital protection purposes. This increases manageability and transparency.

Conclusions

Since 2016 I have been developing COREDO as a partner that takes on complex legal and financial challenges of international business. During this time the COREDO team has executed dozens of company registration projects in the EU, the UK, Singapore and Dubai, obtained licenses for clients in the payments, forex, crypto services and electronic money segments, and also built reliable AML/CFT programs. Today I want to systematically analyze a topic that regularly comes up in strategic sessions with founders and CFOs: how to obtain a Major Payment Institution license in Singapore and turn it into sustainable competitiveness in the Asian and European markets.

Why Singapore: the MPI license

The MPI license in Singapore (often called MPI license Singapore) opens access to key activities: cross-border and domestic money transfer, merchant acquisition, issuance of electronic money (e‑money), as well as integration with local schemes PayNow and FAST through a sponsor bank or an approved operator. In practice this creates a base for remittance lines, aggregator models, wallet products and B2B payments with fast settlement and predictable liquidity.

Our experience at COREDO has shown that a Major Payment Institution license in Singapore is an effective anchor not only for Asian markets but also for international expansion through MPI into Asia and Europe. Payment businesses gain simpler transaction routing and improved access to acquiring banks, especially with properly configured AML/CFT and monitoring technologies.

The boundary between Major PI and Standard PI
The PSA distinguishes two classes of universal payment licenses: Standard Payment Institution (SPI) and Major Payment Institution (MPI). The choice of class is not a formality but a strategic factor for unit economics and scalability.

SPI is suitable for companies with limited volumes. Threshold values for average monthly volumes are set by MAS for each service and for aggregate services, and for electronic money there is a limit on float. As volumes grow, a company will inevitably face the need to upgrade the license.

Requirements for obtaining MPI
MAS uses a risk-based approach and assesses readiness across several areas. Below are the key ones that we cover in client applications.

• Ownership structure and beneficial ownership. MAS expects a transparent structure, documentary evidence of ultimate ownership and the absence of sanctions or legal risks. The compliance document package for an MPI applicant should include the ownership chain, proof of source of funds and declarations of beneficiaries.
• Directors and local presence. Director and local representative requirements for MPI include having at least one director who is a Singapore resident under the Companies Act, as well as competent executive-level personnel able to manage risks. For compliance, local roles are critical: a compliance officer and an AML officer available to MAS for interaction.
• MAS Fit and Proper test. The regulator applies Fit and Proper to directors, key managers and beneficiaries. They assess business reputation, experience, integrity, financial soundness and track record. The COREDO team prepares dossiers according to the MAS Guidelines on Fit and Proper Criteria and organizes a pre‑submission with the regulator to clear questions in advance.
• Capital requirements for MPI and financial resources. For Major PI there is a minimum paid-up capital at a level commensurate with the risk profile of the services, usually not less than SGD 250,000. Additionally MAS may request a security deposit in a range that depends on the class of services and volumes. We model liquidity stress scenarios and capital adequacy in advance.
• AML/CFT requirements for MPI and KYC processes. The applicant must demonstrate a full AML/CFT program: policies, CDD/EDD, sanctions screening, transaction monitoring, SAR, staff training. KYC requirements when obtaining MPI include risk-based approach, procedures for B2B and B2C, a PEPs policy and independent verification.
• Technological and operational readiness. MAS assesses information security, compliance with TRM Guidelines, the presence of an ISO 27001/PCI DSS roadmap, BCP/DRP plans and incident response. We link this to operational SLA, latency, throughput and resilience.

How to obtain a license MPI in Singapore
The action plan used by the COREDO team is based on MAS regulatory practice and the real lifecycle of a payments startup.

1. company registration in Singapore (ACRA) and basic substance. We form the board of directors, appoint a local director, determine the office and key roles. From the very start we plan economic substance: functions, staff, and on-site decision-making.
2. Pre-submission session with MAS (pre‑submission). I initiate meetings with the regulator to align the business model of the MPI payment operator, the scope of services under the PSA, target markets, KYC/KYB processes and the team’s knowledge. This reduces the risk of fundamental pivots at late stages.
3. Preparation of a business plan and financial model for MPI. At COREDO we work out unit economics (MDR, interchange, FX margin), TCO, NPV and payback for the MPI license. The model covers scenarios of volume growth, take‑rate, churn, CAPEX on technology, OPEX on compliance and the staffing structure.
4. Compliance design. We create an AML/CFT program, CDD/EDD procedures, a sanctions screening policy, risk assessment (RBA), a governance matrix and an independent ininternal audit. For crypto‑services we take into account VASP/DPT requirements and legal risks when working with tokenized assets.
5. Technology stack. We design the API gateway and microservices architecture, define latency and throughput targets, plan horizontal scaling and sharding, implement a PCI DSS/ISO 27001 roadmap, and build in fraud detection and transaction monitoring.
6. Application process to MAS for an MPI license. We prepare the full form, attachments on directors and beneficiaries, technological and compliance descriptions, contractual models with outsourcing providers and cloud hosting, and policies on data residency and GDPR.
7. Responses to MAS queries, interviews and fit‑and‑proper checks. We separately work on third‑party risk management, outsourcing compliance and cloud risks. It is important to document control and access to data, and to conduct Due Diligence of suppliers.
8. Setting up banking relationships and integrations. We build relationships with acquiring banks and correspondents, define settlement cycles, liquidity management and schemes for PayNow and FAST (through a sponsor bank or an approved operator), and finalize SLAs.
9. Post‑licensing readiness. We update BCP/DRP, the incident response plan, prepare for an on‑site MAS inspection, launch continuous monitoring and internal audit. We implement KPI dashboards for compliance and operations.

Cost, TCO and ROI
financial transparency begins with a detailed TCO. In our calculations we include government fees (application and annual fees for each type of service), security deposit, capitalization, expenses for the technology stack, PCI DSS/ISO 27001 compliance, salaries of key roles, external audit and internal control.

MPI business model: products and liquidity
An MPI license for a remittance operator opens a solid foundation for cross‑border transfers, wallet top‑ups, payouts to local banks and merchant acquiring. The ability to issue e‑money under MPI adds flexibility in B2C onboarding and building savings products.

In the technology roadmap there is room for merchant onboarding and KYC processes for sellers, transaction risk‑scoring, anti‑fraud and chargeback analytics. COREDO practice confirms that an API‑first approach and clear SLOs for latency reduce operational disruptions and improve merchant conversion.

AML/CFT, KYC/EDD and sanctions screening
MAS expects a comprehensive AML/CFT program for payment providers. I always start with an enterprise‑level risk assessment (RBA), covering geographies, products, channels, abuse typologies and customer profiles, including PEPs and high‑risk.

Next we form CDD processes for B2C and KYB for corporate clients, including beneficial ownership and transparency. Best practices for KYC/EDD in the B2B and B2C segments under MPI include eKYC with biometrics, automated sanctions screening against OFAC/UN/EU, adverse media and monitoring of changes in customer status in near real‑time.

PCI DSS technologies and BCP/DRP

Information security requirements for MPI, ISO 27001 as a management system, PCI DSS for card processing, and, where appropriate, SOC 2 for partner trust. Preparing the technology stack and APIs for PCI/PSA compatibility increases the chances of quick approval.

The incident response and business process recovery plan for MPI is formalized as a BCP/DRP with testing. I specifically insist on regular chaos tests, RTO/RPO metrics and an inventory of critical dependencies. This ensures real, not declarative resilience.

Local economic substance of outsourcing
How to ensure economic substance for MPI in Singapore: a real question for MAS. The solution lies in a combination of an office, management functions, local compliance and operations that take place on the territory of the country. The COREDO team helps determine the set of functions that truly create value and embed them in the organizational structure.

Outsourcing and risk management of third parties for MPI require contractual KPIs, audit rights, exit‑strategies and data governance. We align cloud hosting with MAS outsourcing and TRM requirements, considering data residency, cross‑border access and GDPR for EU customer personal data.

Reporting and internal audit requirements for MPI imply an independent assessment of the effectiveness of AML/CFT, information security and operational controls. For mature teams I recommend an annual independent review, which MAS views positively.

MAS: from sandbox to on‑site inspections
Regulatory interaction is better built proactively. Pre‑submission meetings with MAS help clarify PSA interpretations and the scope of services, and the MAS regulatory sandbox is a useful track for innovations if a product requires a testing period.

The procedure for changing license conditions and expanding activities requires separate approvals. The solution developed at COREDO includes a governance process for change management so that any new product is brought into the scope of regulatory analysis in advance.

European regulation and expansion

The impact of PSD2 and European regulation on MPI models for expansion is expressed in requirements for open APIs, SCA and third‑party management. The COREDO team aligns security and compliance standards to avoid duplication of costs and speed up time‑to‑market.

Managing currency risks and FX‑hedging for multicurrency settlements is important when launching cross‑border produktov. We use a combination of NDF/forwards and internal exposure limits to maintain margin and the SLA for execution.COREDO Case Studies: How It Works

Another project was a payments aggregator for marketplaces, where the business model required merchant acquiring and issuing e‑money balances for sellers. The solution developed at COREDO combined a PCI DSS‑compliant architecture, KYB onboarding with eKYC and sanctions screening, as well as a roadmap for ISO 27001. MAS approved the model on the condition of an independent internal audit after 12 months, for which we prepared the client.

KPIs for Scaling

The term and renewal conditions of an MPI license depend on compliance with reporting and inspection outcomes. Post‑licensing MAS reviews focus on incidents, outsourcing and changes to the business model. COREDO’s practice confirms that regular training and a compliance culture reduce operational risks and speed up the approval of new initiatives.

Exit scenarios from the MPI business and portfolio transfer require pre‑defined options: portfolio sale, merger, license surrender. We work through legal and operational steps to protect clients and partners for any strategic decision.

Pre‑submission Checklist
Before clicking “submit” to MAS, I go through an internal checklist. This approach saves weeks of back-and‑forth and prevents critical failures.

• Business model: PSA services are clearly described, target markets and FX risks are justified, the financial model confirms sustainability.
• Ownership and Fit and Proper: the structure is transparent, sources of funds are verified, directors’ and beneficiaries’ dossiers are complete.
• AML/CFT: the RBA is complete, CDD/EDD procedures are ready, sanctions screening is configured, SAR processes are tested.
• Technology: architecture is documented, PCI DSS/ISO 27001 roadmap in progress, TRM controls mapped, BCP/DRP tested.
• Outsourcing: contracts include audit rights, SLAs and exit clauses, supplier due diligence completed.
• Banking relationships: draft agreements with acquirers/correspondents are agreed, settlement and liquidity calculated.
• Documents for MAS: forms, attachments, policies and reports are up to date, answers to expected queries are ready.

How COREDO Strengthens the Project
I structure support so that the client sees a clear trajectory. First, the strategic choice between Standard PI and MPI, assessment of the time horizon, costs and risks. Then, creating substance and organizational design, preparing the business plan and financial model, the compliance program and the technology project.

The COREDO team integrates regulatory experience, product analytics and security engineering practices. We engage vetted CaaS providers, regtech platforms, auditors and payment infrastructure. At the final stage we support the dialogue with MAS, prepare for on‑site inspections and help launch operational reporting.

MPI in Singapore: a Strategic Asset

The COREDO team has guided clients through the full cycle: from ACRA registration and pre‑submission with MAS to integration with PayNow/FAST and on‑site inspections. We see how a Payment Services Act (PSA) Singapore license turns into sustainable volume growth, predictable margins and partner trust across Asia and Europe. If you are considering the MPI path, embed risk management, economics and technology from day one, and licensing will become a catalyst for scaling rather than a brake.

I’m ready to discuss your business model, align it with MAS requirements and assemble a roadmap — from application to first transactions. At COREDO we value entrepreneurs’ time and focus, so every decision is tied to metrics and every document serves a real purpose: to accelerate the product’s route to market and maintain quality at international standards.

I have been leading COREDO since 2016 and often see strong products stall in Latin America because of two factors: choosing the wrong acquiring model and underestimating local regulatory and technical nuances. The COREDO team has implemented dozens of projects in the EU, the UK, Singapore and Dubai, and in recent years: in Brazil and Mexico. This has allowed us to develop tools that shorten time-to-market, lower MDR and increase authorization rate without compromises on compliance.

In this article I have compiled operational best practices for e‑commerce, marketplaces, fintech companies and subscription services. The text is both strategic and applied: from choosing a model (local vs international acquiring) to specific KPIs, fraud rules, onboarding checklists and our migration practice from foreign PSPs to local acquirers.

Local acquiring in Latin America

Latin America: one of the fastest-growing online payments markets, and acquiring in Latin America requires local thinking. Card acquiring in Brazil and card acquiring in Mexico work differently than in Europe or Asia: a strong role of local schemes (ELO, Hipercard), alternative methods (Pix, Boleto, Oxxo Pay) and the specifics of address scoring.

International acquiring Brazil/Mexico is attractive for its ease of getting started, but often loses conversion: issuing banks in LATAM are more likely to decline cross-border transactions. In e-commerce this hits the authorization rate and raises the decline rate without objective reasons. COREDO’s practice confirms: local routing and local payment methods deliver a conversion increase of 10–25% compared with pure cross-border.

Acquiring: local vs international

The choice between local and international acquiring directly affects conversion, MDR level and the risk of encountering hidden fees. Let’s look at the advantages local acquiring provides in Brazil and how that is reflected in the final price and decline rates.

Acquiring in Brazil: advantages

Local acquiring in Brazil provides direct access to ELO and Hipercard, support for installments (parcelado) and precise risk scoring taking into account ZIP codes and device fingerprinting. A solution developed at COREDO for a fashion retailer showed an approval rate increase from 67% to 86% after switching to local processors Cielo and Rede, taking into account EMV 3‑D Secure 2 (3DS2) and tokenization.

Advantages of local acquiring in Mexico

In Mexico, local acquiring increases card approvals by taking into account Banxico rules and local behavioral analytics. Integration with PSPs in Mexico allows adding Oxxo Pay and SPEI/CoDi, which provides a noticeable uplift in conversion for marketplaces and digital services.

MDR and hidden fees: where percentages are lost

MDR fees in Brazil and MDR fees in Mexico depend on MCC, average ticket, chargeback profile and local payment methods. In Brazil, parcelado increases the total cost of ownership of acquiring due to financing of installments. In Mexico, cash via Oxxo Pay adds fixed fees.

Conversion: local/international

The comparison of local and international acquiring by conversion is almost always in favor of local. Authorization rate in Brazil and Mexico increases due to:

• local routing to Cielo, Rede, Getnet, PagSeguro;
• support for local schemes (ELO/Hipercard);
• 3DS2 according to issuers’ regional rules and soft declines retry logic.

Regulation and Licensing

An analysis of the regulatory framework and licensing requirements shows which legal and operational standards govern the work of financial institutions across different jurisdictions. The section sequentially examines practical examples and regulatory reporting, in particular the approach of the Banco Central do Brasil and the specifics of Brazilian supervision.

Central Bank of Brazil Reporting

Acquiring regulator: Banco Central do Brasil. For payment service providers and acquirers a licensing and reporting regime applies, including capital requirements, risk management and information security. A separate layer is LGPD as the basis for data privacy and data localization.

Banxico and CNBV in Mexico

In Mexico supervision is carried out by Banco de México (Banxico) and CNBV (Comisión Nacional Bancaria y de Valores). Regulatory requirements for acquiring in Mexico cover operational risks, PLD/FT (AML/CFT) and transaction reporting rules. For marketplaces it is important to understand the status of split settlements and the procedure for disclosing fees in statements.

Local Registrations and Taxation

To enter the Brazilian market, a foreign seller often needs to open a CNPJ and a local legal entity, especially when using local acquiring and working with Pix/Boleto. Taxation of payments in Brazil for non-residents affects service taxes and possible withholding tax, and this needs to be modeled in advance.

Impact of payment methods on strategy

Payment methods shape a company’s commercial and operational decisions, defining the customer experience, risks and monetization channels. Understanding their impact on strategy is especially important when assessing local innovations, for example how Pix is changing card acquiring in Brazil.

How Pix affects acquiring in Brazil

Pix: Brazil’s instant payments that changed basket composition. In low AOV categories Pix pulls share from cards, lowering the MDR, but changing decline and return behavior. In high‑ticket segments cards and parcelado still dominate, and card acquiring in Brazil remains critical.

Why connect Boleto, Oxxo and CoDi/SPEI?

In Mexico the role of CoDi (Cobro Digital) and SPEI is in instant transfers, and Oxxo Pay covers cash scenarios. Connecting local payment methods (Boleto, Oxxo Pay, Pix) expands the audience, but increases the complexity of reconciliation and risk rules. The solution developed by COREDO for a marketplace in Mexico combined CoDi/SPEI and cards into a single settlement calendar and reduced operational errors in reconciliation statements by 40%.

Processors and local schemes

Support for ELO, Mastercard, Visa, Hipercard in Brazil is mandatory. Among local processors we most often see Cielo, Rede, Getnet and PagSeguro; their behavior in terms of authorization rate differs from MCC to MCC. Correct routing between acquirer processor via ISO 8583 and, where available, ISO 20022, yields an increase in approvals and resilience.

Connection models: Merchant/PayFac/BIN

The choice of connection model — classic merchant, PayFac or BIN sponsorship — is determined by a combination of requirements for control, speed to market and operational responsibility. This determines how quickly and legally a European business can connect acquiring in Brazil, which legal and technical requirements will need to be met, and what costs will arise.

How to connect acquiring in Brazil

For a European merchant, the question “how to connect acquiring in Brazil for a European business” starts with choosing a model: a local company with a CNPJ and a local merchant account, or an international PSP with local routing. The first option takes more time but delivers the best conversion and control over MDR.

Acquisitions in Mexico by a foreign company

In Mexico, “how to connect acquiring in Mexico for a foreign company” depends on having an RFC and a local bank account for settlements in MXN. Without local presence, a hybrid approach is reasonable: an international provider with a local partner and integration with Oxxo/SPEI.

How long does it take to open a merchant account in Mexico? On average 2–5 weeks for standard categories and up to 7–9 weeks for marketplaces with split settlements, when deeper Due Diligence of sub-merchants is required.

PayFac and BIN sponsorship in Latin America

The PayFac model vs a classic merchant account in LatAm is a question of scale and control. PayFac/aggregator simplifies onboarding of sub-merchants, speeds up go-live and provides ready white-label acquiring. A classic merchant account increases margin and flexibility of risk policies, but requires its own license/registration and processes.

Underwriting: reserves and holdbacks

Underwriting and merchant due diligence in LatAm are based on MCC, AOV, CBR and chargeback history. Rolling reserves and acquiring reserves in LatAm are applied more often in high-risk and subscription models. The clearer the KYC package and refund policy, the lower the collateral and the faster the holdbacks are released.

API, PCI, EMV 3-D Secure: security

A reliable technical and security foundation is not a set of abstract requirements but a practical toolkit: APIs, PCI compliance, implementation of EMV 3‑D Secure and tokenization provide security and trust during transactions. When integrating for marketplaces and mobile applications, the correct combination of these components ensures both regulatory compliance and convenience for users.

Marketplace and application integration

Technical integration of acquiring APIs for marketplaces requires support for marketplace payments and split settlements at the acquirer/PSP level. Online for Brazil: online acquiring for marketplaces with support for parcelado, Pix and local schemes; for Mexico: compatibility with Oxxo and SPEI is required.

PCI DSS, EMV and tokenization

PCI DSS and local compatibility for acquiring: the foundation. We determine the SAQ type, deploy P2PE on terminals and encrypt PAN on entry. EMV and contact/contactless payments in Latin America create a liability shift: in the absence of EMV, fraud liability falls on the party without EMV support.

Fraud management: reducing declines

Fraud management and transaction profiling are built on a combination of rules and machine learning for fraud detection. We use fraud indicators: BIN analysis, velocity rules, device fingerprinting and geo-patterns. The balance between protection and conversion is expressed in the false positive rate: reducing it directly increases revenue.

Operational processes: settlements and FX

In operational processes, settlements, FX management, timely reporting and regular reconciliation play a key role – the accuracy and transparency of financial flows depend on them. Particular attention is required for settlement cycles and settlement timelines, since their configuration determines how quickly and correctly positions will be closed and reports generated.

Settlement cycles: settlement timelines

Settlement cycles and settlement timelines in Brazil and Mexico vary by payment methods and providers. Cards are more often T+1/T+2, Pix and SPEI: closer to T+0/T+1, while Boleto and Oxxo have confirmation delays. Settlement lag is critical for cash‑flow: the financial model must account for schedules and possible holds.

Hedging currency settlements

FX and currency conversion in international payouts (BRL, MXN, USD) are a zone of hidden losses. Settlement currency and FX spread affect the final MDR when converted to the base currency. We set control rates, use hedging and verify chains of international transfers and correspondent banks so as not to lose margin in transit.

Reporting, MCC and AML monitoring

Reporting requirements to Banco Central do Brasil and Banxico include operational and statistical data, as well as specific forms on payment flows. MCC and risk categorization affect limits, escalation thresholds and chargeback thresholds. A merchant registry and AML monitoring must be regularly updated: this helps pass independent audits without emergencies.

Chargebacks and disputes: rules and metrics

Managing chargebacks and disputes requires clear rules and precise metrics to effectively reduce losses. Below we will examine key procedures, including representment stages, and practical steps to decrease the number of disputed transactions.

Representment procedures

Chargebacks and disputes in Latin America are subject to card scheme rules, but local issuers add nuances. Chargeback and representment rules require careful documentation: proof of delivery, authorization logs, 3DS results and the history of communication with the customer.

Reducing chargebacks and declines

How to reduce the chargeback rate in Latin America? Combine a clear returns policy, local customer support, correct descriptors and 3DS2 with adaptive friction. For subscriptions: proactive notifications and token updates reduce disputed charges.

Subscriptions and recurring payments

acquiring services for subscriptions and recurring payments in Mexico and Brazil require stable tokenization and card update models. AOV, LTV and CAC are metrics that directly depend on the unit economics of the transaction and the cost of approval. Smart routing and local tokens reduce churn caused by declines.

COREDO case studies: what worked

COREDO case studies show what worked in practice across different markets and challenges. Below: real examples, including cost reductions and ROI growth in Brazil, with an analysis of the approaches used and results achieved.

Cost reduction and ROI growth in Brazil

One of COREDO’s projects, a digital service with international acquiring in Brazil, had a high decline rate and MDR. After migrating to a local acquirer and adding Pix the overall cost per approval fell by 18%, ROI on implementing local acquiring paid back in 4.5 months, and the approval rate increased by 17 percentage points. The ROI estimate when switching to local acquiring was based on real AOV, MDR, chargebacks and settlement lag data.

Checklist for migrating from a foreign PSP

Migration from a foreign PSP to a local acquirer – a checklist that the COREDO team uses regularly:

• audit of MDR and all markups, including FX and early settlement;
• comparison of authorization rates by BIN and MCC;
• verification of 3DS2 flow and tokenization;
• setting up split settlements and marketplace payouts;
• tests of re-processing and retry logic on soft declines;
• legal section: contracts, KYC, rolling reserve, SLA for disputes.

Choosing a partner by region

M&A and due diligence when choosing an acquiring partner include checking licenses, reserves, SLAs and the 3DS/EMV roadmap. White‑label and SaaS acquiring solutions are suitable for fintech companies and marketplaces seeking to control UX without their own acquiring license.

Step-by-step roadmap

Step-by-step recommendations and action plans will help structure entry into the Brazilian market and avoid common mistakes when setting up acquiring. Below is a checklist for European businesses with specific steps on legal requirements, provider selection, and integrating payment solutions in Brazil.

How to set up acquiring in Brazil

• Legal structure: assessing the need to open a CNPJ and a local account.
• Licensing/partnership: choosing a local acquirer/PSP (Cielo, Rede, Getnet, PagSeguro) and setting up a merchant account and merchant ID.
• Payment methods: cards (including ELO/Hipercard), Pix, Boleto; EMV 3DS2.
• Security: PCI DSS (SAQ scope determination), P2PE, tokenization, EMV liability shift control.
• Technology: API/SDK, ISO 8583 compatibility, fallback routing, retry logic.
• Risk: fraud rules, ML model, BIN analysis, velocity rules.
• Operations: settlement cycles (T+1/T+2), rolling reserve, reconciliation and reporting in regulator format.
• Taxes: VAT/IVA impact, withholdings, FX strategy for BRL/USD and hedging.

How to set up acquiring in Mexico

• Registration: assessing the need for an MX RFC and a local bank account.
• Partnership: choosing an acquirer/PSP that supports Oxxo Pay, SPEI/CoDi and 3DS2.
• Model: PayFac/aggregator vs classic merchant with white-label capabilities.
• Technology: marketplace payments, split settlements, webhooks, idempotency.
• Security: PCI DSS, SAQ, EMV contact/contactless, tokenization.
• Risk: chargeback and representment rules, chargeback thresholds, monitoring.
• Operations: settlement currency (MXN/USD), FX conversion, correspondent banks.
• Reporting: Banxico/CNBV requirements, merchant registry, AML monitoring and local suspicious activity notifications.

Acquiring as a growth driver, not a cost

Acquiring for e‑commerce in Latin America: it’s about strategy, architecture and execution discipline. In Brazil and Mexico the advantage comes from local acquiring with support for alternative methods, correct routing, a strong fraud stack and a transparent operating model with control of FX and settlement cycles. When all elements converge, authorization rate grows, MDR decreases relative to revenue, and chargeback risk remains manageable.

I have been leading COREDO since 2016, and during that time the team has guided clients through the entire process, from choosing a jurisdiction and forming a legal entity to obtaining financial licenses, setting up AML/compliance and bringing products to markets in Europe and Asia. In this article I have collected the practices and methodology by which COREDO supports projects on the way to an MNB EMI license in Hungary (Magyar Nemzeti Bank), and I also honestly describe the costs, timelines, risks and requirements. My goal is to give entrepreneurs, CFOs and product managers a clear roadmap that saves time and reduces regulatory uncertainty.

Why Hungary for EMI in 2025–2026

Hungary offers a clear regulatory environment, access to the EU market and a mechanism for passporting an EMI license to EU and EEA countries. The MNB (Magyar Nemzeti Bank) is known for attentive but constructive supervision: the regulator provides direct feedback, values mature models and takes a pragmatic approach to outsourcing and cloud infrastructure with appropriate controls. In practice COREDO confirms: a properly prepared dossier and a well‑calibrated business plan speed up the procedure and reduce the number of clarification requests.

PSD2 and the E-money Directive: MNB supervision

EMIs in Hungary are regulated at the EU level by Directive 2009/110/EC (E‑money Directive) and by PSD2 (Payment Services Directive), transposed into national legislation. These frameworks define the range of services, requirements for safeguarding clients’ funds, capital and organisational structure. COREDO’s practice shows that strict adherence to European terminology and methodologies in documents for the MNB reduces communication “noise” and speeds up approvals.

How EMI differs from a payment license

A comparison between an EMI license and a payment license in the EU should be made first. A payment license (PI) allows providing payment services, but not issuing electronic money. EMI, unlike PI, grants the right to issue e‑money and expands product capabilities (wallets, prepaid cards, stored value). Our experience at COREDO has shown that for models with client balances and multi-currency wallets EMI is the natural choice, whereas pure acquiring or PIS/AIS can be more effective in the PI format.

Requirements for an EMI license in Hungary

Fit and proper test for directors and key personnel requires an impeccable business reputation, relevant experience and genuinely engaged management in Hungary. In most cases hiring a local director for an EMI in Hungary is required; the cost depends on the candidate’s profile and starts at senior-level market rates. Internal control, an independent compliance function and an MLRO (officer for AML/CFT) are the core of the operating model, and COREDO’s practice confirms: a clear allocation of roles and regular reporting to the MNB resolves questions at the review stage.

Documents for an EMI license in Hungary

Preparation of the dossier for the MNB EMI license – a project where completeness, logic and interconnections matter. The basic package usually includes:

• Business model plan (business plan) for an EMI license in Hungary, including financial forecasts, stress scenarios, KPIs and unit economics. The document should speak the language of numbers, not slogans.
• Policies and procedures: AML/CFT program and risk assessment (MLRO), KYC/KYB, transaction monitoring and trigger rules, sanctions checks and screening of lists, procedure for confirming source of funds (source of funds).
• Requirements for internal control and the compliance function, conflict of interest management and corporate governance; provisions on independence and escalation.
• Requirements for safeguarding e-money funds in Hungary: models of fund retention (segregated accounts vs trust accounts), custody agreements with partner banks and external confirmation of safeguarding.
• IT security, ISO 27001 and, for card issuing/acquiring, PCI DSS; architecture, BCP/DR (business recovery and continuity plan), incident management, outsourcing of regulatory-significant functions (cloud, processing).
• GDPR and data protection, including the role of the DPO, DPIA and the access model for personal data.
• Registers of beneficial owners (UBO) and EU requirements, ownership structure and confirmation of transparency.

How to obtain an EMI license in Hungary

The practical instructions begin with establishing a legal entity in Hungary for an EMI. The choice of legal form for financial services depends on ownership structure and board requirements, and at this stage we prepare executive candidates and a competency matrix in advance. It is important to align the office, substance and employment contracts of key personnel, otherwise the timeline will “freeze” on formalities.

The timeframes for obtaining an EMI license in Hungary consist of several phases. The preliminary assessment (pre‑application) may take 1–2 months; the full application review takes 6 to 12 months, and in some cases longer. Processing times for EMI license applications in Hungary in 2025 will depend on MNB’s workload and the completeness of the dossier; factors affecting the processing time include the maturity level of IT and AML, evidence of banking relationships and the quality of the business‑plan. If an EMI license is refused: the reasons and remedies usually relate to an unproven model resilience, insufficient outsourcing controls, or incomplete safeguarding policies; COREDO helps structure corrective measures and a reapplication.

Cost of an EMI license in Hungary

Cost of an EMI license in Hungary: it is not a single figure but a comprehensive budget for launching an EMI company. Components of the EMI license cost (legal, IT, compliance) include:

• Legal block: dossier preparation, corporate formation, policies and procedures, interaction with the MNB; this also includes the MNB fee for reviewing an EMI application (Hungary), the amounts of which the MNB periodically updates in its tariffs.
• IT infrastructure and costs for an EMI in Hungary: architecture, licensing, security, integration with payment gateways and the API stack, testing and audit.
• AML/KYC costs for an EMI in Hungary: verification providers, screening platforms, case management and data storage.
• Hiring a local director for an EMI in Hungary, the cost of a compliance officer and MLRO, and the payroll fund for the operations team.
• Audit and external safeguarding confirmation, annual audit costs and regulatory fees, and annual expenses of an EMI in Hungary.

Safeguarding in banking relationships

Correspondent banking relationships for EMIs require starting negotiations early. Interaction with banking partners when opening accounts is best conducted in parallel with licensing: having a letter‑of‑intent (or a draft agreement) strengthens the dossier. The COREDO team implemented a scheme with virtual IBANs and a split of roles between the custodian bank and the processing partner, which increased the model’s resilience and simplified BCP/DR.

IT infrastructure security

IT security, ISO 27001 and PCI DSS for EMIs are not a formality but an operational necessity. Integration of payment gateways and the API‑stack for scaling must account for rate limiting, anti‑fraud, real‑time monitoring and event logging. When performing card issuing, acquiring and interacting with payment schemes, it is important to plan certifications and release schedules already in the business plan.

Operational model of an e-money business

Profitability forecasts and the unit economics of e‑money businesses include fees for wallet issuance/maintenance, interchange income from card issuing, transaction margin and FX markup. Aligning tariffs and fees to ensure profitability must balance competitiveness and regulatory transparency. Financial resilience and stress tests of the business model help justify to the MNB that even in adverse scenarios capital and reserves cover operational needs.

AML/CFT and compliance in operations

Preparing an AML policy and internal controls for an EMI is a process, not a ‘file in a folder’. KYC / KYB procedures and verification of beneficiaries rely on a risk assessment of jurisdictions and products, while PEP screening and rules for handling politically exposed persons establish enhanced checks and the frequency of reassessment. The process of confirming the source of funds (source of funds), transaction monitoring, and trigger rules must be digitized and testable.

GDPR compliance when processing customers’ personal data inevitably overlaps with AML logging and data storage, so access architecture and pseudonymization are important from day one. Reporting to the MNB and regulatory reports, as well as support for MNB audits and inspections, we plan in advance, including templates, registers, and responsible parties. Administrative fines and the risk of license revocation: a reality, but competent AML risk management, operational and IT risk management keep them at bay.

Passporting to European and Asian markets

The conditions for passporting an EMI license to EU and EEA countries from Hungary involve a notification procedure through the MNB and the host regulators. Timelines are usually predictable if the services, distribution channels and local AML specifics are described. A comparison of the timeframes for obtaining an EMI license in Hungary and in other EU jurisdictions shows similar ranges, but Hungary often has the edge in interaction logic and the quality of feedback.

Taxes and corporate structure for IP

Tax aspects of the EMI business model in Hungary depend on the nature of the services, the locations where they are provided and the contractual arrangements with partners. We analyze the VAT position of payment services, transfer pricing and the impact of macroeconomics and currency risks on the payments business. We choose legal forms of companies in Hungary for financial services taking into account corporate governance and protection of minority shareholders.

Legal intellectual property protection of the payment platform is important for assessment by investors and banks. Trademark registration, licensing agreements and vendor code development policies address vulnerabilities. The COREDO solution links the IP strategy with a licensing roadmap to prevent software rights conflicts at the time of inspection.

How to obtain an EMI license in Hungary

1. Diagnostics of the model and selection of the service perimeter: we determine whether an EMI license for Hungary is required or a PI is sufficient, and where the boundaries of e‑money issuance lie. This saves months.
2. Financial model and ROI‑hypotheses: we build scenarios, unit economics, stress‑tests and regulatory capitalization. This is the basis of MNB’s trust.
3. Ownership structure and UBO: we simplify the chain, prepare confirmations, register the UBO. Transparency accelerates Due Diligence.
4. Formation of the legal entity in Hungary for an EMI: we register the company, approve the articles of association, substance and office. This is the basis for hiring and contracts.
5. Personnel framework: directors, MLRO, compliance, risk‑management; we prepare fit and proper‑packages. People are the key to authorization.
6. Safeguarding‑architecture: bank letters of intent, account models, daily reconciliations. This reduces MNB queries.
7. IT‑landscape: architecture, security, BCP/DR, ISO 27001/PCI DSS‑plan; integration prototype. The technical specification must be verifiable.
8. AML/CFT: risk‑assessment, policies, monitoring scenarios, screening‑providers, reporting. This is assessed separately by the regulator.
9. Correspondent relationships and virtual IBANs: preliminary agreements and test configurations. Banks need to see maturity.
10. Preparation of the dossier and submission to the MNB: a single narrative, cross‑references, version control. Consistency saves rounds of questions.
11. Communication with the regulator: prompt responses, system demonstrations, adjustments. We build the dialogue on facts.
12. Test operation and go‑live: pilots with a limited sample, reports to the MNB, expansion of services and geographies. Quality over speed.

COREDO cases: launch scenarios

In one project the COREDO team implemented an EMI for a European fintech with multi-currency wallets and card issuing. We designed safeguarding with two custodian banks, deployed ISO 27001 and prepared for a PCI DSS audit. The timeframe for obtaining an EMI license in Hungary was 9 months thanks to a pre-approved business plan and IT readiness for demonstration.

In the second case the company built an on/off-ramp for digital assets within European regulations and required a combination of VASP registration in one EU country and an EMI in Hungary. We separated product perimeters, described an AML bridge between services and implemented sanctions screening at the level of a unified customer profile. The MNB valued the separate risk accounting and transparency of processes.

Third scenario: a rapid market entry with white-label and partner solutions for a fast EMI launch. At the start we used outsourced transactional processing and a ready virtual IBAN module, while planning our own microservices in parallel. This approach reduced the company’s overall EMI launch budget and provided predictable ROI metrics.

How to reduce the risk of refusal

Factors affecting the processing time of an EMI application are the same: maturity of IT/AML, agreements with banks, and a transparent ownership structure. Our experience at COREDO has shown that a preventive “dry” inspection — rehearsing answers to typical MNB questions — reduces the volume of subsequent requests.

Licensing KPIs and support

Frequently Asked Questions

Timelines and benchmarks for the EU

Comparison of timelines for obtaining an EMI license in Hungary and other EU jurisdictions shows a similar range to countries with comparable supervision: preliminary assessment — from a few weeks, full review — most cases are completed within 9–12 months. Hungary stands out for close feedback from the MNB and the possibility of early technical demonstrations, which helps reduce residual uncertainty. The same principles are critical in any EU country: financial soundness, effective risk management, ownership transparency and technological readiness.

About figures, fees and reporting

How to prove the robustness of the MNB model

The COREDO team is preparing a supporting evidence package: scenario P&L and cash‑flow, sensitivity analysis of transaction margins to tariffs and interchange, a customer acquisition and retention plan tied to LTV/CAC, a reserves policy and regulatory capitalization. Financial stability is confirmed not only by the numbers but also by risk management – credit (for deferred settlements), operational, AML and IT. Such a package demonstrates that the company can manage uncertainty and maintain profitability.

Conclusions

COREDO: a team that speaks the language of regulators and business alike. We support projects from company registration and building compliance to entry into the markets of Europe and Asia, relying on practices and a methodology proven by dozens of licenses. If you need a concrete roadmap — from the dossier to go-live — I am ready to discuss the details and propose a project structure that will deliver results and withstand the test of time and inspections by the MNB.

I have been leading COREDO since 2016 and see every day how Open Banking is changing the rules of the game for banks, fintechs and customers. Open banking APIs have moved from an idea to the infrastructure on which payment services, account aggregators, BaaS platforms and embedded finance are built. By 2026 the sector will enter a new phase, with the transition from PSD2 to PSD3, a review of payment services licensing, strengthened AML/CFT and unified API security standards. In this article I will share COREDO’s practice: how to prepare architecture, licenses and processes to not only comply with the changes but also build a sustainable business model.

The COREDO team has implemented dozens of projects to register legal entities in the EU, the UK, Singapore and Dubai, obtained licenses for PISP and AIS, helped launch e-money and payment institutions, and set up AML, SCA and GDPR. Our experience at COREDO has shown: success is formed at the intersection of licensing, technology and operational control. Below: a practical roadmap I use myself when evaluating projects.

How to prepare for Open Banking 2026

From PSD2 to PSD3: Open Banking changes

Licensing PISP, AIS, e-money

Requirements for Open Banking APIs

Data privacy and GDPR

AML/CFT and risk management for TPP 2026

Contracts and liability insurance

Monetization and scaling

International markets and sandboxes

COREDO Case Studies

Case 1: license for PISP and AIS in the EU. Client: a fintech focused on multibanking and real-time payments. The COREDO team handled payment institution registration, assembled the SCA and API security package, implemented FAPI, OAuth 2.0 and mTLS, configured a Berlin Group profile and ISO 20022 payments. In agreements with banks we secured allocation of liability, agreed API SLA and versioning. Result: license and connection to 30+ banks within 9 months.

Case 2: e-money + BaaS in the UK and EU after Brexit. The client required two licenses and separation of data flows. The solution developed at COREDO separated legal entities, standardized SOC 2/ISO 27001, implemented DPIA and privacy by design, and set up vendor oversight for KYC providers. Result – rapid rollout of embedded finance B2B2C products with a transparent revenue share model.

Case 3: Singapore and digital identification. For a local AIS/TPP we integrated eKYC, eID and W3C Verifiable Credentials, connected MAS APIX sandbox and completed sandbox licensing for Open Banking. After meeting KPIs the client moved to a full license, retaining all policies for BCM, incident response and regulatory reporting.

Case 4: M&A and due diligence checklist for Open Banking assets. An investor was considering the purchase of a provider with an AIS license. COREDO’s practice included verification of the license, capital requirements, API security posture, logs and audit trails, GDPR/DPIA, AML/CFT scenarios, insurance coverage, contracts with banks and allocation of liability. The buyer received a risk map and a 180-day integration plan.

Cost, timelines and compliance plan 2026

Frequently Asked Questions from Clients

XS2A and API Security Checklist 2026

BaaS and embedded finance: risks and growth

Bank and TPP agreements: changes to the rules

Summary for executives and directors

Since 2016 I’ve been leading COREDO through dozens of licensing processes, hundreds of registrations and thousands of pages of contracts. The greatest value for clients is not the mere fact of obtaining a license, but a stable contractual framework that lays out the rules of the game: it is the payment system’s public offer that determines user trust, the reliability of settlements and the protection of funds. Europe is now moving to a new regulatory architecture: PSD3 and PSR, and the public offer is becoming a critical document that affects the business model no less than code and processing.

Update of the public offer for PSD3/PSR

PSD3 and the PSR (Payment Services Regulation) reallocate requirements between the directive and the regulation: some rules will become directly applicable, others will be harmonised through national competent authorities. This concerns client funds protection (safeguarding), strong customer authentication (SCA), open APIs for TPPs and operational resilience. The PSR public offer becomes the visible bearer of these requirements, and regulators view it not as a formality but as a reflection of risk management.

Public offer for PSP, EMI, e-money

I start the project by mapping risks and business processes. The solution developed at COREDO links each product feature to specific sections of the contract and internal policies. For EMI and e-money the offer must explicitly describe the funds protection regime, wallet types, limits and withdrawal operations, and the “e-money public offer and PSD3” must align with safeguarding accounts and insurance coverage.

Key blocks of the offer:

• user consent and acceptance mechanics (click-wrap, eIDAS electronic signature where high legal enforceability is needed);
• tariff transparency and the fee pricing model, including transaction margin and surcharges for cross-border payments;
• SLA metrics: authorization time, settlement time, service availability, incident priority;
• provisions on refunds and chargebacks, allocation of responsibility between PSP and merchant;
• public offer and protection of client funds: segregation, insurance, annual safeguarding audits;
• public offer and KYC/AML requirements: client’s obligations to provide data, blocking triggers, RBA;
• privacy: processing of personal data and GDPR, cross-border data transfers and localization requirements.

PSD3 Offer: PSR Requirements

• user rights and user protection in the PSD3 offer: clear information on risks, fees, limits, reimbursement rights;
• SCA and exemptions: biometrics, trusted beneficiaries, low-risk transactions;
• operational resilience and incident reporting: timeframes for notifying customers and the regulator, communication channels;
• third-party outsourcing: SLAs and supplier liability, right to audit, critical dependencies;
• independent audits, reviews and internal control: frequency, scope, remediation;
• capital requirements for PSPs and requirements for electronic money issuers (EMIs): methodology, stress tests, buffer maintenance.

PSR requirements also strengthen disclosures on payment routing, multilateral correspondent models and access-to-account obligations under open banking. This should be reflected formally and operationally.

PISP/AISP/marketplace/white-label PSP

For PISP and AISP the “public offer for PISP and AISP” must disclose third-party API access (TPP), the procedure for delegated consent, as well as the public offer in open banking conditions – who, when and how stores tokens, event logs and how to ensure users’ consent during API delegation. Our experience at COREDO has shown that unnecessary ambiguity here leads to complaints and loss of passporting.

For a payments marketplace, it is important to choose a model: custodian vs escrow. The public offer for a payments marketplace should explain segregation of sub-merchants’ funds, the settlement schedule and the terms for termination of service/transition of clients without the risk of funds “getting stuck”. In a white-label PSP we record the allocation of responsibilities between the licensed back-end provider and the brand, including Due Diligence when partnering with a PSP and the right to modernize the API without degrading the SLA.

AML/KYC and the risk-based approach in the offer

I set out risk-based approach (RBA): risk segments, CDD levels, triggers for enhanced due diligence, sanctions control and screening technologies. For transaction monitoring and SAR reporting, the offer establishes the right to suspend an operation, request documents, notify the FIU and national regulators.

Security and technical requirements for the text

Public offer and API security: mandatory section. I recommend formalizing requirements for OAuth2, JWT, key management and HSM, as well as the minimum compliance requirements in the public offer for PCI-DSS (network perimeter, PAN data encryption, card tokenization). At the protocol level it is worth mentioning the migration to ISO 20022 and its impact on consent schemes and the format of payment details.

Incidents should be described clearly: priorities, RTO/RPO, business continuity and disaster recovery in the offer, escalation procedures. For instant payments (TIPS, RTP, FastPay) we define specific SLAs and the risks of irrevocability, as well as mechanisms for post-authorization review and anti-fraud filters. The solution developed by COREDO combines these technical standards with legal obligations without conflicts.

User Consent and Notices

User consent: the foundation. In the offer I describe the mechanics of notification and obtaining users’ consent, including logs, IP addresses, timestamps, and, where necessary: eIDAS and electronic signatures in user agreements. For TPP processes I separately define how to secure users’ consent during API delegation, token validity periods and revocation.

A notice of changes to the offer terms must include the channels (e-mail, in-app), minimum timeframes, the client’s right to terminate the agreement without penalties before the changes take effect, and the rules for handling “silent consent” where permitted. Such a design prevents disputes and increases resilience to audits.

SLA and operational metrics in the offer

SLA is the language of trust for the merchant. We establish:

• authorization and confirmation times, the share of operations requiring re-authentication;
• settlement time (D+0/D+1), cut-off, deduplication;
• service availability (for example, 99.9%), maintenance window and the order of function degradation;
• dispute management and customer support in case of chargeback: TAT, channels, escalations.

For instant-pay services it is useful to include separate SLAs: the share of payments <10 seconds, average finalization time, and fallback routes in case individual schemes are unavailable. Agreements with merchants and settlement SLAs are reasonable to place in an appendix so that metrics can be updated promptly without changing the base text.

Safeguarding and capital in the offer

The public offer, safeguarding and segregation of client funds (safeguarding) are areas of close attention. Models for safeguarding: bank accounts vs insurance, their combinations and reconciliation timelines. I specify the frequency of reconciliation, the client’s right to information about custodial banks and independent auditor confirmations.

Cross-border operations, passporting, banks

In the offer we specify the geography of services, service currencies, country restrictions and the use of partner PSPs. Integration with correspondent banks and fees must be transparent: where correspondent banking fees may arise and who covers them.

The public offer for cross-border payments should take tax aspects into account: the public offer and taxation of payment services – who withholds taxes, how fees are treated for B2B and B2C. When operating in the EU, it is beneficial to reflect passporting and conditions for servicing non-residents; in Asia, the linkage to licenses by MAS, HKMA or DIFC/FSRA.

Disputes, refunds and chargebacks

Refund procedures and chargeback mechanics – not just links to a card scheme. I break it down step by step: timelines, required evidence, merchant’s role, allocation of PSP responsibility for infrastructure and routing errors. For A2A payments we set out separate error-resolution mechanisms, refunds at the initiative of the PISP and intervention by the account-holding bank.

Dispute resolution and an arbitration clause help avoid jurisdictional traps. Legal stipulations: applicable law and jurisdiction are chosen taking into account the license and domicile of safeguarded accounts. In the offer it is advisable to describe liability limits and indemnities: reasonable caps, exclusions for gross negligence and intent, and disclaimer in the public offer to the extent permitted by law.

Securing control in outsourcing

The public offer and the terms of subcontracting/outsourcing must specify that critical functions are transferred only to approved providers, with audit rights and security requirements. We specify third-party outsourcing: SLAs and provider liability, business continuity plans, compatible RTO/RPO. Clients must know that outsourcing does not diminish their rights, and the provider retains control.

For white-label and agency schemes and partnership models, we describe the separation between the storefront and the licensed entity, brand/license disclosure, passporting and the right to migrate to the ‘base’ provider upon termination.

Risks, TCO/ROI and compliance under PSD3

TCO and ROI assessment when adapting the offer for PSD3 is a mandatory management task. We calculate CAPEX/OPEX for API updates, legal reviews, resilience tests and independent audits. Potential fines and regulatory risks are correlated with incident probabilities and the impact on GMV and transaction margin.

Which offer terms increase merchants’ trust? Transparent SLAs, a clear responsibility matrix, flexible payment routing and clear chargeback rules. Which metrics should be tracked after updating the offer? CAC, LTV, GMV, share of successful authorizations, settlement speed, incident rate, merchants’ NPS, size of reserves and refunds.

PSD3 Roadmap: stages and timelines

1. Gap analysis: differences from the current offer affecting PSR requirements, EBA recommendations.
2. Structure redesign: PSP public offer template, linkage to SCA, AML/KYC, BCP/DR policies.
3. Tech and risk review: API security, PCI-DSS, OAuth2/JWT/HSM, ISO 20022, instant payments.
4. Legal components: applicable law, jurisdiction, limits and indemnities, outsourcing, safeguarding.
5. Communication testing: consent mechanics, notice of changes to the offer terms, UX screenshots.
6. Internal training: operational runbooks and KRIs, compliance project KPIs and execution control.
7. Pilot and release: independent audits, establishing SLAs, metric monitoring, adjustments.

Timelines depend on scope, but on average we typically complete within 8–16 weeks if backend policies are ready and security is confirmed.

Implementation case studies in Europe and Asia

In the EU the COREDO team adapted the public offer for PSPs in Central Europe with the move to instant payments and the launch of marketplace scenarios. We defined an SLA for TIPS, set escrow reserves, and delineated responsibilities between the platform and sub-merchants. After the release, GMV grew due to the trust of large merchants, and the incident rate dropped by one third thanks to clear procedures.

Public Offer Template for PSP

Example of a public offer for PSP as a “skeleton” of sections:

• Terms and roles: PSP, merchant, user, TPP, PISP/AISP, marketplace and sub-merchants.
• Scope of services and geography: channel/schemes, instant payments, limited jurisdictions.
• Fees and commission model: transparent consumer information and disclosure, taxes.
• User consent and eIDAS: acceptance mechanism, delegation via API.
• SCA and risk management (PSD3): factors, exceptions, anti-fraud, KRI.
• Safeguarding: bank accounts vs insurance, reconciliation, audits.
• SLA for payment execution and settlement: metrics, service windows, degradation.
• Refunds and chargebacks: timelines, evidence, allocation of PSP liability.
• AML/KYC/CDD and sanctions: RBA, SAR, interaction with FIU.
• Privacy and GDPR: cross-border data transfer and localization requirements.
• Outsourcing and subcontracting: right to audit, security, reserves.
• Operational resilience: incident reporting, business continuity and disaster recovery.
• Payment routing and correspondents: fees, fallback channels.
• Restrictions and limits: transactions, currencies, merchant categories.
• Liability limits and indemnities, disclaimers in the public offer (within the law).
• Termination and transition: key termination and client transition points, data export.
• Applicable law, jurisdiction, dispute resolution and arbitration clause.
• Mechanism for notifying changes to the terms of the offer.

PSD3 Offer Verification Checklist

Checklist for PSD3 offer compliance:

• All roles, channels and schemes are specified, including PISP/AISP and open banking.
• SCA and exemptions are aligned with policies and UX flows.
• Safeguarding is transparent: banks/insurance, reconciliations, independent audits.
• SLAs are defined, KPIs are measurable, incidents are described.
• Refunds/chargebacks are detailed by scheme.
• AML/KYC/CDD RBA is clearly articulated, SAR and sanctions controls are reflected.
• GDPR and cross-border data transfers are validated by the DPO.
• Outsourcing: right to audit, API security, PCI-DSS.
• Legal provisions: limits, applicable law, spoliation-safe logging of consents.
• Notification and consent mechanisms are tested and logged.
• Integration of ISO 20022/instant-pay is reflected in terms and SLAs.
• National NCA requirements are considered, passporting is correctly described.

Assess ROI and reduce sanctions risks

Impact of PSD3: tokenization of crypto services

The impact of PSD3 on crypto services and tokenization is reflected in requirements for KYC/AML, SCA, storage and transfer of value through the payment infrastructure. A public offer and PCI-DSS requirements are important for card tokenization and on/off-ramp scenarios. For card tokenization and payment data security, we establish the merchant’s PCI obligations and the role of the tokenization provider, as well as cybersecurity obligations for APIs, OAuth2, JWT, and HSM.

API access for third parties and the terms of the offer must eliminate ambiguities regarding data rights and revocation of access. Open banking affects contractual relationships, and the offer must be aligned with the agreement with merchants and the SLA for settlements.

Regulatory practice and sandboxes

A regulatory sandbox for payment services in individual countries helps test a public offer for payment infrastructure with a limited set of customers. In our projects we often pilot the dispute resolution process, SLAs and safeguarding specifically in the sandbox to speed up subsequent certification.

The role of national competent authorities in supervising PSPs is strengthening, and the PSR public offer is the first point of contact for supervision with your «tone of compliance». The more precise the document, the easier it is to pass off-site and on-site inspections.

Practical wording: what merchants value

Which offer terms increase merchants’ trust? I clearly define responsibility for delays in settlements, a transparent discount matrix as turnover grows, and describe fallback routing of payments. Agreements with merchants often include KPIs for authorization, refund timeframes and support quality, as well as the right to early exit in case of SLA degradation. Such a balance of interests stabilizes GMV and reduces churn.

Work on COREDO projects

When a client prepares «public offer for a white-label PSP», we check the partner’s due diligence, its backup capacity, routing, as well as subcontracting terms. As a result the offer reflects the real risk landscape and withstands reviews by both EBA-guidelines and local NCAs.

The offer as a strategic asset

COREDO prepares «PSD3 payment provider offer» quickly and consistently, relying on audit practices and case studies across different jurisdictions. If your product needs «public offer for a PSP in the EU», «public offer when implementing instant payments» or «public offer template for PSP» for white-label and marketplace, the COREDO team will align the document with EBA requirements, the EU PSD3/PSR regulation draft and merchants’ expectations. I believe in a simple formula: a strong offer – fewer incidents, higher conversion, more sustainable growth.

Since 2016 I have been leading COREDO through dozens of projects to register fund structures in the EU, Asia and the CIS, and during this time Ireland has consistently remained at the top for the combination of regulatory predictability, tax benefits for funds and high-quality provider infrastructure. When I receive a request for an international fund registration with subsequent licensing and comprehensive AML support, I first assess the applicability of the ICAV (Irish Collective Asset-management Vehicle) regime. This form was created specifically for investment funds and hedge funds and provides precise answers to founders’ pain points: speed of launch, the tax neutrality of ICAV for investment funds, flexibility of structuring and effective cross-border distribution.

How an ICAV differs from a Ltd company and a PLC

ICAV: it is a separate legal regime for collective asset management in Ireland, designed for investment purposes and compliant with AIFMD and UCITS. Unlike Ltd and PLC, it is not a corporate “universal” form, but a specialised fund vehicle operating as an investment undertaking with specific tax consequences and reporting. This positioning allows ICAV to obtain exemption from corporate tax at the fund level provided the legal requirements are met.

ICAV tax architecture

My main guideline is to minimize the fund’s tax burden through an ICAV without resorting to aggressive structures. Ireland allows a fund to be exempt from corporate tax when it has investment undertaking status and is correctly registered, and it also provides mechanisms for exemption from Irish withholding tax on payments to non‑residents from the “white list” of jurisdictions when supporting documentation is available. Taxation of gains from the sale of assets in an ICAV generally does not arise at the fund level; capitalization of gains is passed through to the investor taking into account their domestic tax regime and DTT.

An ICAV should take into account the impact of BEPS and ATAD: interest limitation rules, CFC rules at the investor level, anti‑hybrid rules and substance over form — this is the baseline. Anti‑hybrid rules are important for debt strategies and structures with SPVs across multiple countries: mismatches in the tax characterization of instruments in different jurisdictions can lead to denial of deductions or double inclusion of income. We apply transfer pricing for groups of fund‑servicing entities and prepare transfer pricing documentation requirements for fund groups to demonstrate the arm’s‑length nature of fees charged by the ManCo, the administrator and advisors.

The introduced Pillar Two (global minimum tax) is formally aimed at large groups. Nevertheless, funds with controlled holdings and service hubs must check the per‑jurisdiction effective tax rate and exemptions. The solution developed at COREDO models ETR by jurisdiction and carve‑out scenarios; this is especially relevant when using portfolio SPVs for transactions in Europe, Asia and Africa. Additionally, we assess GAAR, general anti‑avoidance rules — in Ireland and in investors’ countries — to confirm business purpose and real economic substance.

What Revenue and the regulator see

The tax residency test for a fund in Ireland is built around the place of effective management and management and control (management and control). Economic substance for an ICAV: it’s not just an office and a nameplate on the door, but a set of corporate governance practices: directors’ meetings in Ireland, independent non‑executive directors with relevant expertise, a local secretary, a record of resolutions, contracts with Irish counterparties and risk controls at the depositary and ManCo level. I always emphasize: it is demonstrable management and control at the ICAV that addresses CFC issues and confirms tax neutrality.

• A calendar of board meetings held with an Irish quorum and minutes.
• Real‑time access for directors to portfolio information and risk reports.
• Local agreements with the ManCo, the administrator, the depositary, and auditors.
• Policies and procedures: asset valuation, conflicts of interest, valuation challenge.
• A dossier on the place of effective management: business trips, minutes, working correspondence.

The role of the manager (ManCo) and tax obligations is a separate topic. Licensing and registration of a ManCo for an ICAV is carried out at the Central Bank of Ireland, and the quality of the ManCo affects not only AIFMD/UCITS supervision but also the perception of substance by regulators. In several projects the COREDO team conducted ManCo vendor selection and built an advance pricing agreement (APA) as a tool for legal certainty on intra-group pricing for the service companies supporting the fund.

Registration of CRO, Central Bank, Revenue

A step-by-step guide to opening an ICAV for non-residents includes three tracks: legal (Companies Registration Office, CRO), regulatory (Central Bank of Ireland) and tax (Revenue).

• CRO: preparation of the ICAV constitution, information on directors, the company secretary and the RBO. The Companies Registration Office (CRO) registration procedure for an ICAV usually takes 5–10 business days with a complete submission.
• Central Bank of Ireland: submission of documents for ICAV approval and, where necessary, a UCITS prospectus or AIF rules. Timelines depend on the fund category: there are fast routes for QIAIF; for UCITS, 6–8 weeks with quality preparation.
• Irish Revenue Commissioners: registration of the tax status as an investment undertaking and obtaining an Irish tax clearance certificate for certain operations (for example, on distributions).

Choosing a depositary, administrator and custodian: the foundation. The depositary controls ownership of assets and compliance with investment restrictions, and depositary liability: practical cases and risk management show that proper allocation of functions between the depositary and the administrator reduces operational risks. When structuring SPVs and ICAVs for private credit and securitisation SPVs we take into account asset segregation and tax asset protection mechanisms so that cash flows and payment priorities are resilient to stress scenarios.

Compliance and reporting: AML, DAC6, AEOI

Anti-corruption KYC/AML for funds in Ireland is a set of policies, procedures and technologies. We build KYC/AML procedures when onboarding institutional investors, including sanctions screening and counterparty checks, identification of PEPs, adverse media and transaction monitoring. When suspicious transactions are detected there is an obligation to file SARs and reporting requirements for suspicious activity in accordance with Irish AML legislation.

Choosing an auditor and audit requirements is not a formality. The auditor must understand valuation of Level 3 assets, NAV error escalation rules and the specifics of side pockets, otherwise the audit will be prolonged. The solution developed at COREDO provides an RfP process and a scorecard for auditors, administrators and depositaries taking into account the fund’s strategy, asset geography and investor requirements.

Redomiciliation of a fund to Ireland

Transferring a fund to Ireland: tax and operational steps begin with tax due diligence when entering an ICAV structure, analysis of BEPS issues during the reorganisation of international funds and review of CFC rules in investor jurisdictions. For assets we model transfer of assets in kind: tax consequences, possible stamp duties and capital gains recognition. Restructuring costs: how to account for expenses during a reorganisation – we record them in the fund’s accounting policy and with providers to avoid disputes over deductions.

ROI when moving the structure to ICAV mode is calculated through a set of KPIs: net return after withholding optimisations, savings on VAT and administration fees, speed of capital raising through passporting, reduction in compliance costs compared with offshore schemes. Key KPIs for managers when assessing ROI from redomiciliation include time-to-first-close, delta TER, % of investors from the EU, and the “cost of risk” from regulator audits. In practice, relocating to Ireland increases trust from LPs in Europe and Asia and simplifies cross-border distribution: tax barriers and solutions here are standardised.

Private strategies: PE/VC, hedge funds

ICAV for investment funds and hedge funds allows fine‑tuning of subscription/exit rules, hedge structures vs fund solutions and tax differences when using derivatives. For private equity we have embedded waterfall and carried interest within PE/VC fund structuring under ICAV: best practices suggest using separate sub‑funds for individual vintages and geographies to segregate risks and reporting. Tax aspects of private equity and ICAV often come down to managing capital gains treatment for non‑residents and investor‑level exemptions.

Investor lifecycle: onboarding/holding/exit

At investor onboarding we set up KYC, the collection of self‑certifications for FATCA/CRS, tax residency checks and determine the applicability of withholding tax relief procedures and documentation. For US investors in an ICAV timely FATCA registration and the correct fund status for PFIC purposes at the investor level are critical; our experience at COREDO has shown that early engagement with their tax advisers reduces the risk of reporting surprises.

Scalability, expenses and providers

Operating expenses of establishing an ICAV: forecasts and cost items include ManCo services, the administrator, depositary/custodian, auditor, legal support, listing (if required), directors’ insurance (D&O), IT infrastructure and KYC platforms. The cost of establishing and maintaining an ICAV depends on the strategy, liquidity and number of sub-funds; for an umbrella with two sub-funds and a professional ManCo we target a reasonable mid-market budget, which is detailed at the RfP stage.

COREDO cases: EU, redomiciliation and taxes

Recently the COREDO team completed international fund redomiciliation cases to Ireland from offshore jurisdictions while retaining the investor base. We rolled out an umbrella ICAV with three sub-funds (public equities, private credit, Africa infrastructure), secured AIFMD passporting into key EU countries and coordinated cross-border distribution together with local counsel in Asia and Africa. Practical steps to demonstrate substance to Revenue and supporting evidence were incorporated into the corporate governance policy, and the Central Bank of Ireland approved the structure on schedule.

Audit risks and their mitigation

Substance over form: the practice of tax audits in Ireland and the EU shows that formal indicia without real management in the country of residence no longer work. We help set meeting agendas, directors’ roles and ManCo control mechanisms to demonstrate the place of effective management. GAAR and anti‑hybrid rules are checked first; therefore profit allocation scenarios, SPV debt load and payment chains are documented in a memorandum before launch.

Why Ireland and ICAV now?

Conclusions

ICAV is not just an “Irish form”, but a full-fledged operating platform: tax neutrality, the flexibility of umbrellas and sub-funds, oversight by the Central Bank of Ireland, passporting under AIFMD/UCITS, and predictable rules from the Irish Revenue Commissioners.

The COREDO team has gone through this process with clients from the EU, Singapore, the UK, Cyprus, Estonia, the Czech Republic, Slovakia and Dubai and has built an approach that saves time and reduces risks. If you are considering registering an ICAV in Ireland, relocating a fund or optimizing an existing structure, I recommend starting with a roadmap: objectives, distribution strategy, tax model, providers, timeline, KPI.

I have been leading COREDO since 2016 and every year I see how technological progress changes legal and financial constructs faster than regulators’ manuals can be updated. Tokenized funds are not hype but a practical tool if you approach design as an engineering task: from choosing the legal wrapper and license to smart contracts, custody schemes and marketing restrictions. The COREDO team has implemented a number of projects in the EU, Asia and the CIS, and in this article I have gathered the practical experience that will save you months of searching and hundreds of hours coordinating with providers.

Tokenized funds: why businesses need them

A tokenized fund is a fund on the blockchain where shares/units are represented as security tokens according to the regulator’s classification of the token as a security. This model provides a flexible subscription, redemption and secondary market mechanics for the fund’s tokens, the possibility of trading security tokens on regulated exchanges or OTC alternatives, and also simplifies cross‑border distribution with correct fund passporting.

Our experience at COREDO has shown that tokenized funds increase ROI through fund tokenization due to four factors: reduction of transactional costs, acceleration of investor subscription, expansion of distribution geography and liquidity, and fractionalization of even ‘illiquid’ assets. Benchmarking the ROI of tokenization against traditional funds varies by strategy, but with fair token economics of the fund and competent market making, efficiency gains become measurable.

Legal qualification: EU, Asia, CIS

My approach begins with a map of regulatory regimes. In the EU the basic framework is set by AIFMD and MiFID II, as well as the regulatory requirements of MiCA and tokenized funds for crypto infrastructure. AIFMD and fund tokenization are compatible: the interest is issued as a token while retaining AIF status; for retail offerings it is possible to combine UCITS/AIF and tokenization via an intermediary “wrapper”. MiFID II’s consequences for the sale of fund tokens concern client categorization, suitability/appropriateness and distribution rules through investment firms.

In Asia I more often rely on Singapore and Dubai. Registering a tokenized fund in Asia via a Singapore VCC with an ITO/STO under MAS supervision, provided the manager is licensed, gives a clear roadmap. In the UAE DFSA and VARA offer regulatory sandboxes for tokenized funds and clear guides on security token offering for a fund, including transfer restrictions on security tokens and access to licensed exchanges.

Structure of a tokenized fund

• Structuring a fund as an SPV with tokens is suitable for niche strategies and club deals. The SPV issues tokens instead of units, and the management company enters into an investment management agreement, setting out fees and carry.
• Using a corporate «wrapper» in the EU: commonly applicable fund forms in Cyprus, Estonia or Slovakia; for institutional investors — Luxembourg/Ireland via an AIF, and tokenization occurs at the level of the register of units.
• The combination of UCITS/AIF and tokenization is possible with strict marketing limits. The COREDO team implemented such a hybrid in Cyprus with a white‑label platform for fund tokenization and a partnership with a licensed depositary.

Licenses and offering documents

For the EU we prepare the prospectus filing and the KIID for the tokenized fund, the prospectus approval with the regulator, the white paper and the offering memorandum for the fund. Regulatory qualification determines whether the fund’s initial token issuance (ITO/STO) falls under the prospectus regime, national exemptions, or within an AIF via private placement.

In Asia the document set is similar, but the emphasis is on the offering memorandum and risk disclosures, including law enforcement and the enforceability of smart contracts. Legal support for tokenized funds at COREDO includes regulatory advice and obtaining licenses for investment companies, approval of marketing materials and recording restrictions on the sale of tokens to residents of certain countries.

AML/KYC Compliance and Data Protection

Compliance by design for tokenized funds is not a slogan, but an architecture of processes. Мы строим AML политику и screening санкций для инвесторов, интеграцию KYC провайдеров и санкционных списков, EDD (enhanced Due Diligence) для институциональных инвесторов, а также beneficial owner disclosure для токенизированных фондов. Процессы KYC/AML автоматизации с использованием API сокращают тайм‑ту‑сабскрайб и снижают операционный риск.

Наш опыт в COREDO показал, что the implementation of AML автоматизации в подписи транзакций через политики смарт‑контрактов и адресные списки снижает нарушения трансферных ограничений. Мы также настраиваем AML/KYT‑мониторинг адресов, чтобы оперативно реагировать на риск‑сигналы.

Standards, custody, and stack security

Choosing a token standard determines future compatibility. For utility‑subscription logic ERC‑20 is used, for paper rights: token standards ERC‑1400 and ERC‑3643, which implement transfer restrictions, whitelists and compliance checks. A smart contract for investor subscriptions automates issuance, distribution and the payment of dividends via smart contracts on a schedule or upon occurrence of events.

Custodial solutions for fund tokens require discipline. For custody of private keys for funds we rely on storing private keys in hardware modules (HSM), multisignature (multi‑sig) custodial schemes, segregation of operator rights and an emergency recovery procedure. In some projects clients choose custodian vs qualified custodian for fund tokens, and I help make a balanced decision together with the partner depository.

Operational security matters no less than legal considerations. We assess tokenization technology providers (tokenization platforms) by ISO27001 and SOC 2 criteria, smart contract audits and formal verification are mandatory before ITO/STO. Oracle solutions for external NAV data and asset prices link off‑chain settlement and reconciliation with on‑chain logic, ensuring correct on‑chain NAV calculation for the fund.

Liquidity: from issuance to turnover

Primary issuance of fund tokens (ITO/STO) sets the starting liquidity, but I always design the secondary market in advance. Trading of fund‑tokens on exchanges is possible through regulated security token platforms and OTC alternatives for qualified investors. Market making and liquidity provisioning for fund tokens are arranged contractually, and buyback and burning mechanisms for fund tokens create a “soft” price corridor.

For subscription and redemption settlements I increasingly provision a stablecoin as the fund’s settlement instrument, but I also connect commercial banks and fiat‑on/off ramps for funds, including correspondent bank and fiat payments for subscription and redemption. This duplex reduces dependence on volatility and speeds up clearing.

Taxes for cross-border distribution

Taxation of tokenized funds in the EU and Asia requires early modeling. We calculate tax planning for non‑resident investors, tax withholding (withholding) on payments to investors and the applicability of double taxation treaties. For some clients I recommend corporate structures with ‘pass‑through’ taxation or umbrella funds with subfunds.

ESG‑orientation is growing, and blockchain-based funds demonstrate advantages in the transparency of metrics. Paradoxes of transparency: competitive risks of portfolio disclosure are addressed through reporting to regulators and investors in aggregated form and by using zero‑knowledge proofs for private investments at the level of attesting facts without revealing details.

Insurance and Risk Management

A comprehensive assessment of operational risks of a tokenized fund is included in the initial sprint. I analyze legal disputes and precedents related to security tokens in target jurisdictions, conduct technical due diligence of infrastructure providers, and arrange cyber risk insurance and issuer liability. Loss recovery and insurance for tokenized funds cover key scenarios, from key compromise to operational errors.

The factor of speed and gas cost on Ethereum networks for fund operations has a direct impact on investor UX. To reduce costs we use layer‑2 solutions and sidechains to scale operations while maintaining security and compatibility, and mechanisms to control token price manipulation are embedded in market-making agreements and trade monitoring.

NAV: operations and infrastructure

On‑chain NAV valuation for the fund increases transparency, but it cannot be separated from accounting. We set up off‑chain settlement and reconciliation, and the oracle provides verification of prices and corporate actions. Requirements for the depositary and transfer agent are specified in agreements, including registry reconciliation processes and SLAs.

Balanced through data architecture and access rights. We use allowlists, ZK‑proofs and data segmentation to comply with GDPR and protect the fund’s strategy.

COREDO Case studies: EU, Asia, CIS

В ЕС команда COREDO реализовала AIF на Кипре с токенизацией долей по стандарту ERC‑1400, STO под режим частного размещения и листинг на регулируемой площадке security tokens. Кастодиальные ключи хранились в HSM с multi‑sig, а NAV рассчитывался on‑chain с верификацией через oracle и сверкой у администратора фонда.

В СНГ запустили фонд через AIFC с корпоративной оберткой‑SPV для инвестиций в частные debt instruments. Регистрация tokenized fund в ЕС для кросс‑продаж прошла через партнерский управляющий AIFM, а пасспортирование ограничили несколькими странами. Этот гибрид показал, как legal‑мосты и технологические белые ярлыки (white‑label платформы) ускоряют выход.

Roadmap for a tokenized fund

1. Diagnostics and design: legal choice of jurisdiction, the fund’s token economics, target audience assessment, marketing restrictions.
2. Law and licenses: registration of a tokenized fund in the EU and/or registration of a fund with tokens in Asia, regulatory consultations, obtaining licenses, approval of prospectus, KIID, offering memorandum.
3. Technology: choice of token standard (ERC‑20/1400/3643), smart contracts for distributing the fund’s income, audit and formal verification, oracle, custody with HSM and multi‑sig, ISO27001/SOC 2 compliance of platforms.
4. Operations: depositary and transfer agent, token holder registry and KYC, off‑chain settlement and reconciliation, reporting to regulators and investors.
5. Market and liquidity: ITO/STO, listing of security tokens on regulated exchanges, market making, OTC, DeFi integration and liquidity pools, buyback/burning mechanics.
6. Taxes and risk: tax planning, withholding, cyber risk insurance and issuer liability, incident response procedures and manipulation controls.

COREDO handles coordination of providers, compliance setup and building the “operational rails”. I personally oversee the architecture and key agreements with regulators and banks so that you get predictable timelines and a transparent budget.

Frequently asked client questions and practical answers

The technical part raises concerns because of gas and scaling. I design layer-2 solutions and sidechains where justified by the business, and for subscriptions and redemptions I build in stablecoins and fiat channels. The question of enforceability of smart contracts is resolved by duplicating obligations in contracts and implementing formal guarantees of smart contract execution at the code and procedural levels.

Marketing: another critical area. We set up traffic filtering, geo-restrictions, investor verification and compliance with advertising rules so as not to launch prematurely. Veto limits and the fund’s governance tokens are clearly defined before launch to avoid conflicts of interest.

Tokenization: what it delivers in practice

Tokenization of fund shares reduces barriers to entry and adds flexibility to distribution. Integration with DeFi opens additional liquidity channels, and on‑chain accounting of shares and profit distribution simplifies auditing. When I see a project with a well-founded tokenized fund structure, correct documentation and reliable infrastructure, the result is accelerated AUM growth and reduced operating costs.

The COREDO team takes into account the paradoxes of transparency, the conflict between privacy and regulatory requirements, and builds a balanced system. We also proactively plan legal dispute scenarios and precedents on security tokens so that the fund has a resilient position and a predictable response to force majeure.

Launching a tokenized fund with COREDO

A tokenized fund is a synthesis of law, technology and processes. I am responsible for the integrity of the solution, and COREDO’s experience shows that a consistent architecture works better than a patchwork of disparate contractors. We combine registration procedures in the EU, Asia and the CIS, a security token offering for the fund, custody and exchange infrastructure, AML/KYC and GDPR, as well as tax and marketing frameworks.

If you see potential in tokenized funds, want to accelerate your go-to-market and retain control over risks, let’s discuss your strategy. I will propose a roadmap with clear milestones, costs and timelines, and the COREDO team will take you from the design session to the first dividend payout via smart contracts. This is a calm, transparent and results-oriented path that we have already followed many times with clients from Europe, Asia and the CIS.

Since 2016, my team has been supporting international projects in Europe, Asia and the CIS: from registration of legal entities and obtaining financial licenses to building AML/sanctions compliance systems and providing full operational support. Over that time I have seen how acutely entrepreneurs and managers need clear and fast tools to enter the EU market. In the investment segment, such a tool has become the Luxembourg RAIF: Reserved Alternative Investment Fund. In this article I will lay out why establishing a RAIF in Luxembourg today is one of the most rational ways to launch an alternative fund, how RAIF registration in Luxembourg works in practice, and which solutions COREDO usually builds into the architecture of fund structures to accelerate time-to-market and reduce regulatory and tax risks.

Why choose a RAIF in Luxembourg for funds?

The 2016 law on RAIF in Luxembourg offered a simple yet elegant compromise: the fund does not undergo prior authorization by the regulator, but operates under the supervision of an authorized AIFM and within the AIFMD ecosystem. This model sharply reduces time-to-market when launching a RAIF and makes rapid fund registration in Luxembourg an achievable goal without sacrificing the quality of risk management. In practice we observed first subscriptions already 10–12 weeks after the project start.

RAIF registration: the fastest way to enter the European field of alternative investments if the team is ready to operate under AIFMD rules and maintain a strong compliance framework for AML/KYC, risks and reporting. The regulatory advantages of RAIF include access to AIFMD passporting (through an AIFM), flexibility of investment strategies and the absence of limits typical for retail products.

How to quickly open a RAIF in Luxembourg

Legal support for RAIF registration relies on a clear checklist. I advise starting with the target strategy, investor profile and distribution geography, and then moving on to the vehicle, providers and documents. The COREDO team in a typical project runs all tracks in parallel to shorten calendar timeframes and eliminate bottlenecks before they arise.

Key registration stages and the RAIF checklist under the supervisory Commission CSSF are as follows:

• Preliminary architecture: strategy, mandate, investor profile (qualified/professional), liquidity, leverage, valuation policy.
• Choosing the fund’s legal form: FCP (contractual) or corporate (SICAV in the form of SA/SCA/SARL, as well as SCSp/SCS as flexible structures). For private equity and real assets SCSp most often prevails.
• AIFM authorization and duties: choosing an authorized AIFM in the EU (often Luxembourg-based), agreeing delegation of investment management and risk management, RMP, conflicts of interest policy, AIFMD reporting.
• Depositary and administrator for the RAIF: appointment of a depositary (bank/investment firm in the EU), selection of administrator and NAV calculation agent, transfer agent, registrar, auditor.
• Documents for RAIF registration: investment memorandum/subscription memorandum (PPM), LPA for SCSp, constitutional documents, AML/KYC and sanctions policy, valuation policy, risk management, SLA and service agreements.
• Notarization and Legal review of the constitutional documents, registration in the Luxembourg Trade and Companies Register (RCSL), account opening, subscription organization.
• Setting up distribution: AIFMD passporting and marketing in the EU, distribution channels, placement agent and agency agreements, Reverse Solicitation policy and legal risks.

registration documents RAIF

The PPM is the living DNA of the fund, not a formality. At COREDO we ensure that the investment memorandum and the Limited Partnership Agreement reflect the economics of the deal (management fee, performance fee, carried interest, clawback), liquidity (gates, suspension), the fund’s strategy and risk policy. The subscription memorandum and the LPA for the RAIF form a single framework together with valuation policies and risk management.

Anti-money laundering policy for funds, AML procedures / KYC for institutional investors, sanctions compliance and GDPR: mandatory elements. We build checklists to verify the integrity of RAIF investors, UBO disclosure and data storage in accordance with GDPR. This improves the quality of AML and KYC for RAIF and accelerates onboarding.

Administrator, NAV calculation and depositary

For cross-border placement of RAIF units, payment and transfer agents are often engaged, as well as clearing and settlement system operators when listing certain share classes on LuxSE with settlements through Euroclear/Clearstream. Where listing is not required, settlements are made through custodial banks and administrators with strict AML/KYC and sanctions controls.

RAIF Structure: forms, SPV, substance

SPV structures for RAIF support investments in specific assets and jurisdictions. SOPARFI “holdings” often become intermediate companies for private equity and real estate thanks to the network of double tax treaty agreements and the efficiency of dividend/sale flows. For infrastructure we add project SPVs and contractual covenants with lenders.

Substance in Luxembourg for a RAIF fund: not a checkbox, but a managerial reality. I put in place local directors with the necessary experience, a place to hold documents, local meetings, agreements with key providers, and the economic rationale for expenses. Requirements for economic substance and presence are intensifying against the backdrop of BEPS risks and the practices of EU tax authorities. Additionally we take into account the UBO register and beneficiary disclosure obligations.

Taxation of RAIF and Investors

Income distribution policy, carried interest and tax consequences depend on the jurisdictions of the LP and GP. COREDO configures carried vehicles, waterfall and clawback to minimise ‘surprises’ on exits and ensure transparency for the auditor and investors.

Passporting of RAIF and AIFM under AIFMD

AIFMD and RAIF passporting: a powerful mechanism for the cross-border distribution of RAIF units within the EU. The AIFM sends notifications to the regulators of the host countries, after which marketing to professional investors becomes possible. International distribution of RAIF units in the EU is combined with local rules, so COREDO prepares marketing blue books and checklists for each market.

AIFM authorization and duties include risk management, leverage limits, Annex IV reporting, supervision of the delegation of investment management and control of the valuation function. Delegation of RAIF management and oversight require clear contracts, KPIs and regular monitoring. AIFM conflict of interest management and internal compliance are enshrined in a policy available to investors on request.

Risks, compliance (AML/KYC, sanctions, ESG)

Sanctions compliance and sanctions screenings, AML/KYC procedures for investors and ESG compliance are essential pillars of trust. Integration of ESG criteria and reporting strengthens the commercial appeal of a RAIF to investors, especially in the Netherlands, Scandinavia and Germany. AIFMD supervision and internal compliance are complemented by GDPR and the protection of investors’ personal data.

RAIF for funds and real estate

RAIF for real estate relies on SPVs with limited recourse and bank financing. Liquidity of units, redemption gates and suspension are governed by the mandate; for closed-ended funds, planned distributions and investor exit strategies.

RAIF for a family office is often used as an “umbrella” with several sub-funds for different asset classes. Family office use cases of RAIF allow consolidation of administration, improved risk control and documentation of investment mandates for succession. Restrictions on retail distribution and compliance remain: RAIF is addressed to qualified/professional investors.

Fund economics: fees and expenses

Liquidity management, covenants and covenant breaches: an area of heightened attention for credit and infrastructure RAIFs. The AIFM and the administrator should monitor payment schedules, compliance with leverage limits and timely escalate deviations to the investment committee.

COREDO Cases and Time-to-Market

RAIF Life Cycle

Liquidity of units, redemption gates and suspensions are determined in advance in the PPM and LPA. Investor exit strategies and winding-up procedures include appointing a liquidator, communicating with the depositary and administrator, calculating final distributions and closing entries in the RCSL. Liquidation and exit from the RAIF proceed smoothly if all operational documentation has been kept up to date and SLAs with providers have been observed.

On the secondary market for RAIF interests, transfers of LP interest are possible under the LPA procedures with GP consent and in compliance with AML/KYC. Regulation of private markets and the secondary market for interests impose disclosure requirements and sanctions checks – COREDO runs these processes as separate mini-projects.

RAIF launch checklist and common mistakes

When RAIF is not suitable, pros and cons

How COREDO supports the launch of a RAIF

COREDO handles the structural architecture, legal drafting and coordination of providers. We prepare the PPM, LPA, side letters, AML/KYC and sanctions policies, valuation policy, risk framework and governance documents. We also select the AIFM, depositary, administrator and auditor, agree SLAs, and arrange notarisation and registration with the RCSL.

Conclusions

RAIF is a mature and flexible platform for launching alternative funds in the EU with a unique balance of speed and regulatory quality. When the strategy, documents and providers are aligned, RAIF time-to-market is measured in weeks, not quarters. At the same time the rules of the game are clear: AIFM supervision, robust AML/KYC and sanctions framework, well-considered valuation and risks, and transparent economics for investors.

I have been building COREDO since 2016 with a single goal: to help entrepreneurs and CFOs quickly and safely scale their businesses through international structures, licensing and high-quality compliance. In recent years the European market has given us a new tool that genuinely expands financing for long-term projects and opens private investors’ access to illiquid asset classes. This is about ELTIF 2.0: the updated European form of long-term investment funds with a distribution passport. Below: my perspective as the founder and a practitioner of the COREDO team, so that you can make an informed decision: to launch your own ELTIF, invest in one, or use it as part of your corporate strategy.

Why does business need ELTIF 2.0 today?

ELTIF 2.0: EU rules and opportunities

ELTIF for investors: access and protection

Minimum investments and fees

How to avoid liquidity mismatch

Eligible assets and valuation models

Valuation of illiquid assets and NAV

How to manage risks and hedge?

How to launch ELTIF 2.0

Choice of jurisdiction

Fund: SPV/holding company, capital calls

Depositary and asset custody

Distribution and retail in the EU, Asia and the CIS

Distribution and client tests

Taxation and investor reporting

Liquidity of units on the secondary market

COREDO cases: from idea to first closing

Renewable energy infrastructure and long-term capital

Transitioning the fund to the retail segment

Cross-border distribution and AML for investors from Asia and the CIS

Entrepreneurs’ questions

How COREDO scales the product

Conclusions

I often hear the same request from owners and asset managers: provide a structure that accelerates a fund’s launch, withstands institutional due diligence, and scales without pain. The Variable Capital Company in Singapore (Singapore VCC) addresses exactly these needs. In recent years the COREDO team has completed dozens of VCC design and registration projects for hedge funds, credit strategies, venture and multi-asset platforms, and I see how quickly the VCC is becoming the standard in Asia and a practical alternative to European and UK formats.

The VCC was created as the market’s response to flexibility, technological sophistication, and regulatory predictability. Its structure supports an umbrella VCC with sub-funds, strict asset segregation and unified corporate processes.

VCC architecture and asset segregation

The basic model – an umbrella VCC structure under which one or several sub-funds are created. Each sub-fund has separate assets and liabilities, and the legislation provides for statutory segregation, i.e., legal separation at the level of law rather than only by contract. This is critical for hedge funds with different risk strategies, where the investor mandate and liquidity vary across sub-funds.

Our experience at COREDO has shown that multi-strategy managers find it beneficial to consolidate common functions (directors, administrator, auditor, compliance) at the “umbrella” level and allocate portfolio decisions to the sub-funds. This reduces duplication of costs, simplifies reporting, and transfers of assets between VCC sub-funds during rebalancing proceed through transparent procedures at the level of the board of directors and the administrator.

An additional advantage: the registration of sub-funds and their asset segregation do not require the creation of separate legal entities. This speeds up the launch of new strategy lines, simplifies the closing or reorganization of VCC sub-funds and disciplines corporate governance.

VCC Act 2018 and 2026 Amendments: the Role of MAS

The legal foundation is laid by the VCC Act 2018, and the 2026 amendments strengthen AML/CFT controls, the disclosure of beneficial ownership, and the quality of reporting. The Monetary Authority of Singapore (MAS) coordinates supervision through the requirements of the SFA (Securities and Futures Act) and the rules for Collective Investment Schemes (CIS), and also introduces clarifications to the MAS 2026 reporting requirements, including electronic channels and standardized templates.

In 2026 the emphasis shifted to operational risk management and cybersecurity, so that fund platforms comply with new outsourcing methods and cloud storage.

From a classification standpoint, a VCC can support both closed and open strategies within a CIS, providing flexibility in liquidity and instruments. The COREDO team is accustomed to drafting documents so that a sub‑fund’s investment mandate clearly falls into the appropriate category and internal procedures comply with the SFA.

How to set up a VCC for a hedge fund

I start with a product roadmap: strategy, liquidity, investor geography, institutional requirements. Then we structure the legal shell: VCC registration in Singapore, define the board composition, and choose the corporate secretary and CSP.

Next – Licensing of the fund manager (FMC/CMS). To manage assets registration as a Fund Management Company (FMC) is required: depending on AUM and client type the Registered Fund Management Company (RFMC) scheme or Capital Markets Services (CMS) licence will be suitable.

In parallel we arrange agreements: custodian and depositary functions, fund administrator and transfer agent, independent auditor, provider of independent valuation (for illiquid assets). At the level of investment documentation we set up management fee and performance fee with high-water mark and hurdle rate, waterfall distribution of income and side pockets for illiquid positions. The COREDO team pays attention to both legal logic and operational feasibility so that the administrator correctly calculates NAV and carried interest.

VCC Taxation in Singapore

VCC taxation in Singapore relies on preferential regimes (including the Enhanced Tier Fund), exemptions for investment income when criteria are met and tax residency is confirmed. Economic substance rules and demonstration of activity are important: board meetings in Singapore, qualifying resident directors, local compliance and on-the-ground operational functions.

There is a network of double taxation avoidance agreements with investors from the EU and Asia. We model cash flows and withholding taxes by beneficiary country, and also review transfer pricing and related parties in the VCC structure if the manager’s service company is present. For GST (Goods and Services Tax) special rules apply to funds; properly structured exported services and interactions with non-residents affect the calculation.

COREDO’s practice confirms: clear documentation of the “centre of management and control” and a well-thought currency structure and profit allocation of the VCC help reduce tax risks associated with the VCC and ensure a steady ROI for investors.

AML/CFT, KYC and e-KYC Compliance 2026

AML compliance for VCC is based on a risk-based approach: PEP checks, sanctions screening, sources of funds and the obligation to file SARs for suspicious transactions.

I ensure that the policy reflects actual operations: investor risk profiles are aligned with the sub-fund strategy, and triggers for Enhanced Due Diligence are logical and measurable.

KYC and e-KYC for VCC have become standard. We build a digital investor onboarding workflow: document collection, e-signature, liveness-check, address verification, automatic sanctions screening and UBO mapping. The beneficial ownership register must be up to date and reconciled with the administrator’s and transfer agent’s data. For US clients: FATCA reporting and GIIN settings; for others: Common Reporting Standard (CRS).

Finally, the impact of PDPA (Personal Data Protection Act) and GDPR when working with European investors requires conscious data management: minimization, storage, access and deletion. We document the roles of controller and processor, and define secure channels for exchanges with administrators and distributors.

Operating model: NAV, IFRS, audit

The custodian and depository are anchor partners. In Singaporean practice the custodian provides safekeeping and the processing of corporate actions, and a trustee is appointed for some CIS-structures. We compare servicing by asset classes, cut-offs for settlements, fee models and prime brokerage capabilities. The administrator and transfer agent close the NAV, maintain investor records, calculate fees and produce reporting; the SLA should fix deadlines, responsibilities and the business continuity plan.

NAV valuation practices for complex assets are set by the valuation policy: fair value hierarchy, independent quotes, model prices, role of an independent valuation provider.

Financial reporting under IFRS and external audit requirements are the basis of trust. Auditor independence, the agreed scope of sample testing across sub-funds and the timeline for completion of audits are critical to the marketing cycle.

Liquidity, risks and leverage

Liquidity management and redemption gates in VCC begin with designing terms: redemption periods, notice periods, lock-up periods, suspension of redemptions and side pocket structures. For illiquid assets, side pockets and special purpose vehicles within a VCC help protect investors of the underlying sub-fund. We tie the policy to the actual turnover of assets, stress testing and liquidity ranking.

The use of borrowed leverage and limits for a VCC are linked to prime brokerage agreements and margin financing. The COREDO team sets up collateral agreements, governance for margin calls and limits on leverage. For derivative operations we deploy frameworks for margin requirements, counterparty risk assessment, as well as policies on securities lending and credit risk.

At the core – the risk management framework: VAR, stress testing, scenario analysis, limits by asset classes and concentrations, three lines of defense and regular reports to the board of directors. This approach simplifies discussions with institutional investors and reduces operational risk for both the manager and the investor.

Engaging with Investors in the EU

AIFMD marketing rules require careful thinking. For many strategies, fund marketing in Europe is through a VCC: country-specific NPPR requirements and/or working via Reverse Solicitation. Passporting from Singapore to the EU does not apply, so we develop country-by-country maps: where reverse solicitation is permitted, where a local representative is required and what disclosures are necessary.

Servicing EU investors and GDPR requirements come to the forefront. We formalize subscription channels, KID/KIID materials where necessary, and agree disclosures on remuneration, ESG and risks. Market access strategies to attract institutional investors from the EU, Asia and the CIS include a roadshow schedule, selecting a custodian with a recognised name and audit practices accepted by institutions.

Our document packages help complete KYC quickly, without sacrificing the thoroughness of the checks.

Tokenization without regulatory gaps

Tokenization of fund shares in a VCC and tokenisation of fund shares require careful legal scrutiny. Singapore allows digital solutions subject to compliance with the SFA and rules on digital tokens; smart contracts and automation of distributions (distributions) are possible if the administrator, custodian and audit agree on control points. I insist on an independent reconciliation of the token register with the investor register at the transfer agent.

Crypto hedge funds in a VCC, legal risks around custody, AML and volatility. We set up custodial chains with certified crypto custodians, include additional KYC requirements and valuation methodologies for illiquid/digital positions.

Cybersecurity, a mandatory element: cybersecurity controls, vulnerability log, DLP, access control and cloud storage policy. Such measures are important not only for MAS, but also for due diligence by exchanges and prime brokers.

Cost calculation, ROI and scaling

The cost of launching and maintaining a VCC depends on the number of sub-funds, the manager’s license, the composition of partners and the geography of investors. In a typical configuration CAPEX includes registration, legal documentation, setup of service providers and the IT stack; OPEX includes administration, audit, compliance, custodian fees, directors and D&O insurance. I recommend performing a cost-benefit analysis: OPEX vs CAPEX when choosing a VCC, expected AUM, fee terms and the load on the back-office.

KPIs and ROI metrics for a fund structure: IRR on the manager’s capital, MOIC on platform investments, TER for each sub-fund, investor onboarding speed and NAV close time. Scaling a hedge fund via a VCC relies on modularity: new sub-funds are opened according to a ready checklist with vetted counterparties.

How to organize a hedge fund waterfall in a VCC? We fix the management fee, performance fee, high-water mark and hurdle rate, and set out the clawback mechanics and crystallization dates. For currency structuring and profit calculation the VCC uses the fund’s base currency, an FX hedging policy and a transparent profit calculation per share class. If necessary we include re-domiciliation and cross-border migration of funds to transfer assets into the VCC without tax or operational shocks.

Reorganization and liquidation of VCC sub-funds, as well as liquidation, winding-up procedures and creditor priorities, are described in advance in the constitutional documents and the liquidity management policy. This reduces the risk of disputes and simplifies coordination with investors.

VCC, SICAV and English structures

Jurisdictional comparisons show: VCC wins on speed of launch, sub-fund flexibility and tech-enabled compliance. The Luxembourg SICAV is familiar to European institutional investors and provides a strong “passport” in the EU, but requires more time and budget.

At COREDO I prefer to match the structure to the strategy and the investor. For pan-Asia capital raising and tech funds, VCC often leads; for deep distribution into the EU, SICAV remains a strong option. There is no “one-size-fits-all” here — it’s important to design the architecture, budget and licensing roadmap.

Relocating a management company to Singapore: pros and cons

Relocating a management company to Singapore strengthens the economic presence (substance) of a VCC: resident directors, a local risk-management and compliance team, board meetings, working relationships with MAS. Pros: tax predictability, access to Asian investors, a well-developed infrastructure of custodians and administrators.

Downsides, requirements for staffing and operational discipline: you will need to invest in processes, PDPA procedures, cyber security and regular reporting. If the strategy targets Europe, parallel services in the EU under GDPR and AIFMD distribution will remain relevant. I am considering hybrid models: a manager in Singapore plus a distribution office in key cities in Europe or Asia.

COREDO case studies: how it works in practice

Case 1. Multi-strategy VCC with two sub-funds for public and private assets. We designed the umbrella, organized an RFMC with a scalable roadmap on the CMS, engaged a global custodian and administrator, and set up an independent valuation provider for private positions. Within 12 months AUM surpassed the target, and the transition to the CMS was completed without interrupting marketing. Investors from the EU entered via reverse solicitation under agreed legal opinions.

Case 2. Crypto hedge fund inside a VCC with a pilot for tokenization of shares. We engaged a specialized crypto custodian, strengthened the AML policy with on-chain monitoring, and implemented e-KYC with liveness checks and sanctions screening of addresses. NAV was calculated using an independent valuation model and pricing sources agreed with the auditor. The COREDO team built smart contract checkpoints for distributions and reconciliation with the transfer agent.

Case 3. A family office with an Enhanced Tier Fund and four sub-funds by asset class. We optimized the tax profile, set KPIs for TER and operational SLAs, and appointed independent directors and an audit committee. Within the structure there was a side pocket for illiquid assets and an SPV for securitization transactions. Institutional due diligence was completed without issues, and IFRS reporting was closed in line with the marketing cycle.

ESG maturity for institutional investors

VCC corporate governance and independent directors are not a formality. I implement board charters, committees (audit, risk), a meeting schedule and a policy on conflicts of interest and related party transactions. This minimizes risks and increases the parties’ confidence.

ESG and sustainable investing in the context of VCC manifest in disclosures, due diligence of providers, voting policy and data management. Investors expect consistency: asset selection criteria, metrics, escalation procedures and independent verification where possible.

Founder’s pre-launch checklist

• due diligence of the fund manager and track record, including operational incidents.
• custodian vs trustee role in Singapore practice and compatibility with prime brokerage.
• fund administrator responsibilities and SLAs, experience with the required asset class.
• transfer agency and investor register maintenance, integration with e-KYC.
• independent valuation provider and valuation methodologies for illiquid assets.
• risk management framework: VAR, stress testing, scenario analysis and limits.
• valuation policy, fair value hierarchy and involvement of third parties.
• external audit requirements and auditor independence.
• beneficial ownership register and disclosure requirements.
• FATCA reporting for US investors and the Common Reporting Standard (CRS).
• AIFMD rules, reverse solicitation and local NPPRs in the EU.
• cybersecurity controls and cloud storage for fund administration.
• legal opinions for distributions and reliance letters for key jurisdictions.

Cost and timelines: a realistic benchmark

For a standard VCC with one sub-fund and RFMC, it’s reasonable to plan 3–5 months from the kick-off session to the first close, assuming prompt decisions and ready investment content. Budgets depend on the choice of providers and architecture, but the main share is made up by administration, audit, custodian and independent directors. I always provide two to three scenario budgets to align OPEX with target AUM and the required TER.

This is where the VCC shows its real advantage: rapid launch of new strategies with controlled margins and manageable risks.

VCC and the role of COREDO

VCC is not just a legal form. It is an infrastructure platform for strategy, marketing and compliance that helps accelerate growth, keep risk manageable, and speak to institutional investors in the same language. In light of the 2026 amendments to the VCC Act and tightening AML/CTF standards, funds with strong substance, clear policies and disciplined reporting will gain a strategic advantage.

I build roadmaps tailored to the needs of owners and managers: from a blank slate to first close and scaling.

If you are considering a Singapore VCC as a base for a hedge strategy or multi-asset platform, I invite you to discuss architecture, ROI and the roadmap: pragmatically, step by step, and with accountability for the outcome.

I have been running COREDO across the markets of Europe, Asia and the CIS since 2016 and have seen how **whistleblowing** in fintech has turned from a formality into a pillar for sustainable growth. When early signals from inside reach a competent team, the business wins across the board: compliance quality improves, regulatory risks decrease, and investors see the maturity of corporate governance. COREDO’s practice confirms: a properly configured complaints system in a fintech company speeds up the detection of breaches, improves AML controls and saves remediation budgets.

I regard **whistleblowing** as a business process with a clear architecture, SLA and measurable ROI. It is not only compliance with the EU’s **whistleblowing** requirements, but also an operational protection of informants in financial services, embedded into a compliance framework for fintechs, crypto firms, payment providers and neo-banks. In this article I will compile the strategy, operational practices and lessons from COREDO cases: from channel architecture to performance metrics and scaling across international markets.

Directive (EU) 2019/1937 and standards

The European Directive on the protection of whistleblowers (Whistleblower Directive), Directive (EU) 2019/1937, sets minimum standards for companies, including the financial sector. National implementation of the directive in the EU and the risks of non-compliance vary by country, but the direction is clear: reliable internal channels, protection from retaliation, confidentiality and timely feedback to the whistleblower. In financial services there are also industry frameworks: EBA recommendations and guidance on internal channels and risk management, as well as ESMA expectations for the capital markets and fintech companies working with securities and derivatives.

GDPR underpins any processing of complaints. **Confidentiality and GDPR** in complaints mean clear legal bases, data minimisation, pseudonymisation and clear retention periods. In practice this translates into a DPIA for the complaint system, the assignment of roles and responsibilities to the whistleblower officer, and the regulation of interaction with the DPO: the DPO’s job description and cooperation with the DPO should directly take the whistleblowing processing workflow into account.

Channels and deadlines under the EU directive
The directive requires mandatory channels of communication: an internal reporting channel for whistleblowers and the option of an external reporting channel to the regulator (national contact points and competent authorities). Internal reporting rules provide for acknowledgement of receipt of a complaint within seven days and feedback on the results within three months (with a possible extension up to six months in justified circumstances). Such regulated response times under the directive discipline the process and set SLA standards for compliance teams.

National implementation and sanctions
National implementation of the directive in the EU and the risks of non-compliance include regulatory fines and legal risks for breaching the directive. In EU case law there are examples of sanctions for the absence of internal channels, breaches of whistleblower confidentiality or missed deadlines. The financial consequences of non-compliance (fines, reputational risk) often exceed the costs of implementation. In some jurisdictions administrative and criminal consequences are added for ignoring a complaint, especially where possible economic crimes or money laundering are involved.

privacy by design in the GDPR
The impact of the GDPR on the processing of reports is reflected in details: conditions for anonymity and two-way anonymous communication, pseudonymisation and storage of complaint data, encryption and secure storage of records, cross-border transfer of complaint data and the legal bases for this. **Privacy by design** for reporting systems: not a slogan, but concrete measures: end-to-end encryption for **whistleblowing**, multi-factor authentication for reporting portals, protection of the communication channel from DDoS and leaks, as well as evaluating platform providers against SOC/ISO standards and checking their audit trail. At COREDO we usually build a DPIA for the complaint system at the start of a project; this reduces the likelihood of regulatory ‘surprises’.

Architecture of the complaints system in fintech

The complaints system in a fintech company is not just a ‘mailbox’. It is a set of processes and technologies: whistleblower channels (in-house software vs outsourcing), a secure reporting platform, triage and prioritization procedures, integration with case management systems and interaction with AML/SAR processes. I recommend viewing the architecture as a target operating model with clear interfaces and responsibilities.

Platform selection and security

Integration with case management systems, automation of investigations and workflows, as well as incident visualization tools for the board of directors simplify management of the complaint lifecycle. Compatibility of the complaints system with transaction monitoring systems helps speed up verification of signals related to AML, fraud and conflicts of interest.

Scaling for international fintech
Scaling a complaints system for international fintech relies on international jurisdiction and cross-border complaints. Scaling challenges during international expansion are usually related to local data storage and retention requirements, language localization and cultural specifics. Regional particularities in the EU, Asia and the CIS during implementation may require distributed hosting, mechanisms to restrict cross-border transfer of complaint data and local escalation procedures to national competent authorities.

The crypto sector adds nuances: regulation regarding cryptocurrencies and complaints is actively evolving, so compliance and **whistleblowing** in crypto firms must take into account the Travel Rule, risks of KYC circumvention and interaction with exchanges and custodial providers. The link between **whistleblowing** and AML/SAR is particularly strong here.

Integration of the compliance framework
I recommend tying **whistleblowing** to AML processes, KYC/CDD, IT security and HR. SAR vs internal report, the difference and interaction should be clear to every line of defense: an internal report triggers a corporate investigation, while a SAR to the FIU is a regulatory report of suspicious activity. I consider compatibility with transaction monitoring systems and a unified case management ecosystem mandatory: it reduces the time to gather evidence and improves the quality of legal assessment of reports.

Processes from report to resolution

The heart of the program: investigation management after a report and a well-thought-out triage methodology. The solution developed at COREDO combines risk scoring, automatic checks against registers of breaches and the involvement of subject-matter experts. Signal analysis: how to reduce false positives is not only a matter of algorithms, but also of data-source settings, category clarity, and staff training.

Best practices for triage and prioritization

Investigation management

Escalation and engagement with external authorities

Roles, responsibility and culture

The compliance manager and the board of directors’ responsibility – key to maturity. I expect the board to approve a whistleblower policy, establish safeguards against retaliation and receive regular reports on the program’s status. The roles and responsibilities of the whistleblower officer include receiving reports, communicating with the whistleblower, initiating triage, and monitoring deadlines and anonymity.

Policies and instructions
A whistleblower policy for payment providers, compliance and **whistleblowing** in crypto firms, and implementing a **whistleblowing** program in a neo-bank require nuance. For payment organizations the policy should take into account PSD2/EMI risks; for crypto — risks of AML and sanctions circumvention; for neo-banks: a complex third-party matrix and open banking. I typically propose a whistleblower policy template with an annex: directive requirements on communication channels, internal reporting rules, safeguards against retaliation, escalation procedures, confidentiality and GDPR, data storage and retention periods.

Training and change management

Protection against retaliation and anonymous communication

How to calculate ROI

Maturity indicators: KPI and KRI
I use a three-level system of indicators:

• KPI: time to confirmation, time to triage, time to resolution, share of substantiated cases, reporters’ satisfaction with the quality of feedback.
• KRI for corporate ethics risk: increase in the number of reports in risk areas (without decline in quality), share of severe cases, incident recurrence.
• Maturity indicators of the whistleblower program: presence of a DPIA, integration with AML/SAR, independence of the appointed officer, regular reports to the board, benchmarking of **whistleblowing** programs by industry.

Economic efficiency model

Implementation: plan and COREDO cases

The COREDO team has implemented dozens of deployments, from startups to large groups. Implementing **whistleblowing** in a startup vs a large company differs in process depth and governance frameworks, but the stages are similar.

Project implementation plan

1. Diagnosis and design: maturity assessment, DPIA for the complaints system, compliance gap vs Directive (EU) 2019/1937, EBA/ESMA expectations.
2. Solution selection: reporting channels: software vs outsourcing, choosing a platform for secure messages, assessment by SOC/ISO, privacy by design.
3. Integration: case management system and audit trail, compatibility with transaction monitoring systems, integration with HR processes and disciplinary procedures, linkage with conflict of interest policy.
4. Policies and training: whistleblower policy template, escalation procedures, staff training and change management, communication with personnel.
5. Testing and launch: testing the complaints channel (penetration tests), DDoS protection checks, incident response and trust recovery plan.
6. Operations and measurements: KPIs/KRIs, reporting tools for management and the board, audit of the effectiveness of the whistleblower program.

COREDO cases

• Neo-bank in the EU: implementing a **whistleblowing** program at a neo-bank took 12 weeks. Integration with AML/SAR and transaction monitoring reduced time to triage by 38% and false positives by 22%. National contact points received two external reports with correct notification templates – the regulator accepted the responses without additional requests.
• Payment provider in Central Europe: a whistleblower policy for payment providers and two-channel escalation helped uncover a scheme to bypass limits. Documenting investigations and preserving the chain of evidence ensured successful cooperation with law enforcement and the FIU. The company avoided a fine, receiving only an order to improve third-party controls.
• Crypto firm with a hub in Asia: compliance and **whistleblowing** in crypto firms were integrated into Travel Rule processes. Machine learning for complaint clustering and NLP for automatic categorization of messages reduced the compliance line’s workload by 30%. A regulatory review confirmed compliance with the directive and local data protection rules, and the board approved additional budget to scale in the CIS.

Risks of non-compliance during inspections

Audit and reporting on complaints
Audit and reporting on complaints for the regulator are built on standardized datasets: complaint categories, response times, investigation status, and remedial and preventive measures. Reporting tools for management and the board provide a dashboard with trends, risk heatmaps and KPI/KRI details. Data retention policies and timeframes are aligned with GDPR and local regulations; encryption and secure storage of records are verified by an independent audit.

Preparation for inspections: stress tests

How COREDO Helps

Our experience at COREDO has shown: there is no single “box”, context matters: licenses, jurisdictions, group structure, digital maturity. The COREDO team designs a compliance framework for fintech taking into account Directive (EU) 2019/1937, GDPR and industry guidance, selects and implements platforms, configures two-way anonymous communication, integrates AML/SAR and case management, trains staff and establishes metrics. We treat culture with care: without trust in the channels and protection against reprisals, the system will not work.

COREDO helps conduct a DPIA, build escalation procedures, organize external reporting of violations in the financial sector, prepare notification templates, and, if necessary, outsource investigations to an independent provider. For groups with an international presence we configure cross-border transfer of complaint data in line with local rules, and manage the vendor chain for complaint platforms. As a result, the company gains not just compliance, but a working mechanism for the early detection and remediation of risks.

Conclusions

If you are preparing to launch or upgrade a program, start with a diagnosis: assess channels, roles, integrations and metrics. The COREDO team will gladly share methodologies, case studies and templates, and will also help adapt the solution for the EU, Asia and the CIS. With correct implementation, **whistleblowing** strengthens corporate ethics, accelerates the AML framework and increases business resilience; it is precisely the foundation on which international growth is built.

Since 2016 I have been leading COREDO as a company that turns the complexity of international regulation into a clear system of manageable solutions. During this time we have registered dozens of legal entities in the EU, the Czech Republic, Slovakia, Cyprus and Estonia, supported licensing in the United Kingdom, Singapore and Dubai, and built compliance for clients at the level regulators and banks expect. I am convinced: the foundation of sustainable international growth is a risk-oriented approach (RBA, risk-based approach), embedded in registration, licensing and day-to-day operational processes.

Risk-based approach — a pillar

Regulatory expectations for RBA in the EU, the AMLD5 and AMLD6 requirements, and FATF recommendations explicitly state: you are obliged to know the risk profile of clients, products, channels and geographies. In response we design the company’s risk management based on ISO 31000 and the COSO internal control framework, combining corporate information governance (GRC) with a clear decision-making matrix and an escalation model. This makes dialogue with auditors and banks predictable and substantive.

RBA Framework: from strategy to processes

This order is important, because automating the risk matrix without clear criteria for classifying customers by risk leads to an avalanche of exceptions and manual work. The correct sequence is design first, then control assessment and design testing, and only then launching into production with compliance KPIs and key risk indicators (KRI). The COREDO team implemented such a scheme in projects from the Czech Republic to Dubai, and as a result the risk analysis for audit became transparent, and the review and updating of the risk matrix regular and meaningful.

RBA methodology and the risk matrix

The RBA methodology starts with a taxonomy of risks: customers, products/services, distribution channels, geographies, transactions and counterparties. For each category we assess probability and impact scales (likelihood & impact), assign score weights and obtain a heatmap (risk map), where the high-risk area is immediately visible to the board. This is how we develop a risk matrix for audit that is understandable to the business, internal audit, and the external inspector.

Integration of RBA with KYC/CDD and sanctions

The RBA methodology is meaningless without being embedded into operational processes. We design the integration of RBA with KYC and CDD processes so that a customer’s risk assessment is updated on every material event: change of UBO, expansion of geography, anomalous transactions. For high-risk segments, EDD procedures are triggered automatically, additional documents are collected, sanctions screening against extended lists is activated, and suspicious activity analysis (SAR) is conducted.

Finally, data privacy and GDPR compliance: part of the architecture, not an afterthought. In the retention policy we define archiving of evidence and data storage requirements, set retention periods for cases and structure the case lifecycle (case management). This reduces the burden on the first line and increases readiness for inspections and independent review.

Choosing a Jurisdiction for RBA

The solution developed at COREDO always begins with mapping regulatory expectations and relevant licenses to the client’s business model. In the EU – the requirements of AMLD5/AMLD6, in the United Kingdom: FCA rules, in Estonia: VASP specifics, in Cyprus – the regime for payment and investment firms, in Singapore: MAS, and in Dubai, DFSA/DIFC or VARA for the crypto segment. By aligning them with the client’s risk appetite, we help choose the jurisdiction, the degree of centralization and payment routes.

Implementing RBA in a Financial Organization

My basic roadmap for clients looks like this:

• Strategy: we determine the risk appetite, establish a risk management committee and record the responsibilities of the board and the compliance director under RBA.
• Processes: we conduct process modelling, define control points, align the roles of the lines of defence and prepare a risk register.
• Design of controls: we describe client risk classification criteria, CDD/EDD procedures, sanctions screening and transaction monitoring, and configure the risk matrix and heatmap.
• Technologies: we select the AML/CFT platform architecture, assess the scalability of technical solutions, integration with ERP/CRM and banking systems, and configure thresholds and rules.
• Measurement: we define key risk indicators (KRI), metrics for the ROI of RBA implementation, investigation effectiveness metrics, as well as ROI assessment and the total cost of ownership (TCO) of RBA.
• Verification: we plan internal audit and independent review procedures, sampling methodologies for audit (statistical sampling), and scenario analysis and stress testing of risks.
• Training: we initiate change management and staff training, including for the first line and investigative analysts.

Scaling RBA in a holding company

COREDO Case Studies: crypto licenses and institutions

What is needed for RBA to work daily?

Integration with ERP/CRM and banking systems is a critically important element. Without complete data, scoring models “go blind”, and case management loses context. We often implement a centralized hub for event enrichment, configuring thresholds and triggering rules in one place, and broadcasting configuration to subsidiary entities to maintain metric comparability and manage changes.

Launch RBA: a guide for the director

First step: establish the board’s accountability and appoint a compliance director with veto power over risky launches. The risk management committee should approve the risk appetite, align the KRI and KPI metrics, and define a process map with control points. This turns RBA from an “important topic” into a management routine.

Second step: develop a risk matrix, build a heatmap, and describe the criteria for classifying clients by risk.

Third step – choose a technological solution and assess scalability. Evaluate the scalability of technical solutions, integration with current systems, configuration of rules and thresholds, and ensure change management and staff training.

COREDO: from diagnostics to operations

In projects for company registration and licensing in the Czech Republic, Slovakia, Cyprus, Estonia, the United Kingdom, Singapore and Dubai we take into account local specifics and supervisory expectations. This saves time on approvals, speeds up account openings and reduces the cost of compliance ownership thanks to the right initial architecture.

Frequently Asked Questions from Directors

Conclusions

Since 2016 I have been heading COREDO and am responsible for ensuring that entrepreneurs from Europe, Asia and the CIS launch and scale businesses in international jurisdictions quickly, transparently and with properly configured compliance. During this time the COREDO team has carried out hundreds of projects: from company registrations in the EU, the Czech Republic, Slovakia, Cyprus and Estonia to licensing in the United Kingdom, Singapore and Dubai. I see the main task as bringing together legal architecture, licensing and the AML/sanctions framework into a single operational model that withstands regulator scrutiny and does not stifle operational efficiency.

Registration abroad: sanctions and AML

When we design a group structure in the EU, the United Kingdom, Singapore or Dubai, I immediately build AML and sanctions requirements into the founding documents and processes. The right choice of jurisdiction for a specific business model reduces the burden on sanctions monitoring thanks to quality registers, predictable regulators and clear KYC/KYB practice. Our experience at COREDO has shown: if at the incorporation stage you take into account access to corporate registries, rules on beneficial owners (UBO) and local expectations for a risk-based approach (risk-based approach, RBA), the costs of subsequent sanctions screening and KYC fall dramatically.

Crypto and Payments Licensing

In licensing financial services I always link regulatory expectations with concrete technical solutions. Payment organizations, forex providers and crypto services are required not only to carry out KYC/KYB and PEP and sanctions monitoring, but also to demonstrate the manageability of the process: sanctions screening must be reproducible, explainable and independent of the individual analyst. COREDO’s practice confirms: successfully obtaining a license is accelerated by a clear demonstration of sanctions control systems, configured matching thresholds, procedures for human verification of alerts and a transparent audit trail.

Sanctions screening as a system

I see sanctions screening as a four-layer pipeline: data, matching algorithms, threshold/scoring policy and operational workflow. If each layer has data quality controls, an audit trail and demonstrable decision-making, you both reduce false positive matches and keep the risk of false negatives manageable.

Data quality and watchlist management

The foundation is up-to-date, clean sanctions lists: OFAC, EU, UN and United Kingdom. I insist on watchlist consolidation and deduplication of lists, a clear list refresh cadence and data quality controls: completeness, accuracy, freshness. When the COREDO team implements sanctions list filtering, we remove duplicates, canonicalize names (normalisation), align Unicode normalization (NFC/NFD) and standardize transliteration rules (ISO 9, BGN/PCGN). This reduces false sanctions hits long before fuzzy matching algorithms kick in.

Precise name matching without overreach

Algorithms determine which signals you receive. I usually start with fuzzy matching using Levenshtein distance, the Jaro–Winkler algorithm, n-grams and tokenization. For phonetic robustness we use Soundex and Metaphone, and for multiscript names — multiscript matching (Cyrillic Latin Arabic Chinese) with handling of diacritics and apostrophes. Tuning the name matching model for Asian and European languages is critical: Chinese and Arabic names, as well as Latinization of Slavic surnames, cause a spike in alerts without proper normalization.

Threshold policy and FP/FN calibration

Reducing false positives is not just “raising the match threshold.” I use score management and threshold policy, threshold calibration and A/B testing of thresholds and matching models. Metrics — false positive rate (FPR), precision and recall, F1-score and ROC AUC — show the trade-off between FP and FN and help select a point that matches the risk appetite and regulator expectations.

Processing flows: real-time or batch

Each business process dictates its mode. For incoming payments, real-time sanctions screening with API integration of the screening engine into processes is appropriate. For periodic customer base reviews: batch processing (batch checks) with scheduling and SLA. I build human-in-the-loop workflows and SLAs at every stage: initial automated check, alert triage and prioritization, human verification of alerts and case management for alert investigations.

False positives: rules, ML, graphs

I start with basic settings: reducing false positives by tuning match thresholds, whitelists and exceptions with clear exception management and documentation of whitelists. Then I add filters by country, birth dates, entity types and context, as well as watchlist management with targeted filtering of entities known as “false matches”.

Names, scripts and registries in Europe and Asia

Multilingualism is the main “alert generator.” In Asia we pay special attention to transliteration and name spelling variants, use transliteration tables (ISO 9, BGN/PCGN), configure Unicode normalization and rules for handling diacritics. For Arabic names we apply tokenization, n-grams and canonicalization and normalisation, and for Chinese names — romanization schemes and alternative forms.

SaaS or on‑prem: scale and security

At the architecture stage I assess how ready the business is for SaaS sanctions‑screening providers or whether it needs an on‑premise installation. Key factors: security, latency requirements, multi‑jurisdictional operations and local data laws. For high loads we use Bloom filter to speed up searches in large lists and design CI/CD practices for ML models of sanctions screening to release changes safely and predictably.

Demonstrating compliance to regulators

Sanctions screening without an audit trail does not pass review. I require a continuous audit trail and provable actions, explainability tools for matching models and a clear separation of roles: analysts, compliance managers, the CTO and data owners. Within the FATF recommendations and regulators’ expectations we organize regular audits of sanctions‑screening effectiveness, A/B testing of models, threshold updates and analyst training.

COREDO case studies: reducing false positives and screening

In Estonia we worked with a payments company that faced a flood of false sanctions hits. The COREDO team profiled the data, normalized names and transliteration, introduced watchlist consolidation and retuned fuzzy scoring. We implemented whitelists under strict exception governance and trained a supervised model on labeled alerts. The result, real-world cases reducing the number of alerts by 70% while maintaining recall on critical risks. The regulator accepted our documentation on trade‑offs and methodology with no additional requirements.

How to implement sanctions screening

• Assess compliance maturity. Apply a compliance maturity model and identify gaps in data, algorithms, thresholds, and workflow.
• Organize data. Configure watchlist consolidation, deduplication, unicode normalization, transliteration, and a golden record in MDM.
• Design algorithms. Combine deterministic matching, fuzzy matching (Levenshtein, Jaro–Winkler), phonetics, and a multiscript approach.
• Define a threshold policy. Conduct threshold calibration, A/B testing, establish a risk-based approach, and document FP/FN trade-offs.
• Build the workflow. Include human-in-the-loop, case management, alert triage, SLA, and audit trail. Integrate ERP/CRM and payment processes via API.
• Enable ML and graph. Implement supervised learning to reduce FP, unsupervised clustering for anomalies, and graph analysis of relationships.
• Reinforce controls and training. Organize regular effectiveness audits, analyst training, labeling of training data, and CI/CD for rules and models.

Answers to questions: economics and ROI

Risk management: FN under control

Reducing FP must not be done at the cost of an explosive rise in false negatives. I set threshold policies with a “safety” level of review for high‑risk segments and recommend regular retrospectives on closed cases. Exception management goes through the compliance committee, and any whitelisting and greylisting are documented and reviewed at predefined intervals. This regime keeps FN under control and shows the regulator a mature, risk‑oriented system.

COREDO: diagnostics and project support

I build the project in three steps. First, diagnostics and audit: maturity assessment, data profiling, rules inventory, measurement of FPR/precision/recall, evaluation of infrastructure and security. Then architecture and implementation: data and watchlists, algorithms and threshold policy, integrations, case management, explainability, analyst training and CI/CD deployment. And finally – support and development: regular calibration, A/B tests, expansion of jurisdictions, team training and preparation for inspections.

Conclusions

Sanctions screening and anti-sanctions compliance have stopped being a “checkbox” for regulators. It is a managed system with clear data, transparent algorithms, calibrated thresholds and a disciplined workflow that protects the business and accelerates it. When sanctions control is embedded in a company’s architecture, from registration and licensing to AML-processes and payment integrations – you gain predictability, optimal KPIs and confidence in international scaling.

I often start a conversation with entrepreneurs with a simple question: *what is your goal in choosing a new jurisdiction for an investment business*? The answer almost always comes down to a combination of three factors: regulatory predictability, access to capital, and operational efficiency. In recent years Astana International Financial Centre (AIFC) has become one of the few hubs where the balance of these factors works to the benefit of both international and regional players. During this time the COREDO team has carried out dozens of projects for legal entity registration, obtaining investment licenses, building an AML function, and launching funds within the AIFC.

AIFC legal framework: the role of AFSA

The AIFC uses a separate “AIFC legal framework” based on common law principles, with its own court, the AIFC Court, and an independent regulator, the Astana Financial Services Authority (AFSA). This provides predictability and dispute-resolution principles close to the English tradition, which is important for high-stakes and cross-border transactions. In my practice, this often reduces legal frictions between investors and managers, especially when structures from the EU and the United Kingdom are involved.

COREDO’s practice confirms that when preparing for licensing in the AIFC a “European” approach helps: product regulations, clear client categorization, documented suitability/appropriateness and transparent fees. At the same time AFSA expects all of this to be implemented into the actual operational environment – a single paper policy is not enough.

Which licenses are in the AIFC?

Investment licenses in Kazakhstan through the AIFC cover a wide range of activities, and correctly mapping a business model to the permitted types of activity saves months at the approval stage. Within the AIFC, available in particular are AIFC broker license (broker/dealer), the AIFC asset manager license (portfolio manager/asset manager), the investment adviser license, as well as the AIFC depository and custodian license. For fund activity, collective investment schemes (CIS) are provided, including closed structures for private equity and an investment fund license in the AIFC.

Over the past two years we have observed strong demand for the AIFC private equity license and the AIFC venture fund license. Such structures are convenient for cross-border capital raising, and for working with investors familiar with common law. A separate vector is the AIFC license for digital asset operations: under it custody solutions, crypto exchanges and tokenization services develop while complying with requirements for storage technologies and cybersecurity.

For non-residents, the AIFC provides an investment license, and this is a real tool for accessing regional markets while minimizing legal conflicts. Our experience at COREDO has shown that a well-designed combination of an SPV in the AIFC and an operational core in another jurisdiction helps to flexibly allocate functions while maintaining compliance with AFSA regulatory standards.

Capital, substance and fit and proper

Capital requirements for an AIFC license depend on the type of activity and the risk profile. By the typical ranges we encounter in projects, broker-dealer licenses sit at the top of the scale, while advisory and non-custodial management are lower. Capital adequacy for asset managers includes a fixed base amount and add-ons for operational risk and assets under management. I always recommend planning a “buffer” above the minimum level to smooth seasonal fluctuations and growth-related costs.

Fit and proper test for directors and senior managers at the AIFC covers experience, qualifications, reputation and compliance history. Background checks include certificates of no criminal record, verification of education, previous roles and references. I honestly warn clients: it’s better to identify and work through “grey areas” in advance than to explain them to AFSA at a late stage.

AML and KYC in the AIFC: technologies and control

AML and KYC requirements of the AIFC are based on the recommendations of FATF and integrate a risk-based approach. In practice this means an individual AML risk assessment for investment firms, client segmentation by geography and profile, as well as documentation of sources of funds. The solution developed at COREDO typically includes a risk matrix, playbooks for onboarding and instructions on procedures for detecting suspicious transactions (STR).

Modern KYC/eKYC technologies for the AIFC simplify remote onboarding, but AFSA pays attention to the quality of PEP and sanctions screening and to periodic review. We implement a transaction monitoring and AML screening system taking into account the business model profile, including scenario settings, trigger thresholds and an escalation procedure. A separate register of beneficial owners and beneficial owner verification in the AIFC are developed to resolve questions about ownership structures before submission.

Timelines and steps for registering a legal entity in the AIFC

The registration of a legal entity in the AIFC starts with choosing a form: from ordinary companies to special SPVs. Registration is carried out through the electronic portal, and the basic timeframe with a properly prepared package takes from several working days to a couple of weeks. We agree names, types of activity and constitutional provisions in advance so as not to return to the amendment stage.

In COREDO projects we prepare a corporate governance package: board provisions, audit and risk committees, a senior manager regime with role demarcation. This reduces AFSA queries and facilitates the integration of external and internal audit under IFRS.

Licensing of investment activities, timelines and costs

The timelines and cost of obtaining an AIFC license depend on the complexity of the model and the applicant’s readiness. In our experience, the advisory and regulatory phase takes 8 to 16 weeks for ‘clean’ models, while more complex combinations involving custody and dealing require 4–6 months. The cost consists of AFSA fees, legal and compliance preparation, technological solutions and hiring of key persons, as well as future ongoing compliance costs.

Preparation for an AFSA inspection (AIFC regulator) includes interviews with directors, demonstration of operational systems, testing of compliance controls and a walkthrough of the client journey. I always recommend conducting a pre-inspection simulation – in a risk-free mode we identify ‘bottlenecks’ and fix them before contacting the regulator.

CIS and SPV Fund Structures: Disclosure

For investment funds in the AIFC, open and closed collective investment schemes (CIS) are available; private placements and public offers in the AIFC are subject to different regimes. Preparing a prospectus and disclosure in the AIFC requires a description of the strategy, risks, fees and valuation procedures, as well as prospectus requirements for key metrics. Our clients value structuring SPVs and trust solutions for individual transactions when it is necessary to flexibly separate classes of assets or investors.

For closed funds pursuing private equity and venture strategies the regulatory framework remains pragmatic if governance and risk management correspond to the scale of the portfolio. Investment committees, clear management of conflicts of interest and external audit are not just a checklist but a prerequisite for LPs’ trust.

Taxes in the AIFC: incentives, transfer pricing

Transfer pricing and documentation require attention if you have a cross-border chain of services or IP. The COREDO team develops a transfer pricing policy and a supporting file with functional analysis so that regulatory and tax audits go through without surprises. Reporting under IFRS and external auditors close the loop of trust and transparency.

Digital assets: tokenization and custody

Regulation of digital assets and tokenization in the AIFC is evolving through specialized AFSA regimes and the regulatory sandbox. Licensing of crypto exchanges and custody is built around storage technologies, cybersecurity and resilience to operational disruptions. In COREDO projects we pay particular attention to custody technologies for digital assets, segregation of client funds and access recovery processes.

Smart contracts and the legal status of tokens are analyzed in every case: tokenized fund shares, debt instruments or utility models fall under different parts of the Rulebook. I recommend starting with the legal qualification of the token and only after that choosing the technology stack. The AIFC license for digital asset operations opens doors to new sources of liquidity, but requires mature risk management.

Clearing, custody and partner banks

Capital market infrastructure and clearing at the AIFC are developing in tandem with regional operators and international providers. Partner banks and custodians in Kazakhstan provide access to settlement and safekeeping of assets, and the clearing and settlement infrastructure at the AIFC is integrated with global standards. During the due diligence stage we assess connection architecture, contingency scenarios and software interfaces.

For broker-dealer licenses, issues of secondary market liquidity and market-making are important. We select models in which the risk profile aligns with capital and insurance measures, and a disclosure policy addresses questions from clients and AFSA.

Scaling cross-border capital

Cross-border capital raising through the AIFC relies on clear fund marketing rules and AIFC advertising regulations. Passporting and cross-border services restrictions require separate strategies for the EU, the UK, Singapore, and the Middle East. I recommend building marketing funnels that take local private placement regimes into account and using flexible side-letter structures for institutions.

Marketing without transparency regarding complaints and suitability leads to regulatory and reputational risk at the AIFC. Therefore I insist on balancing growth with quality control, supported by regular reporting to the board and committees.

Risk Management and Compliance System

Due diligence of investors and limited partners, counterparty checks and forensic due diligence, sanction risks and international restrictions, as well as reputational screening and KYP (Know Your Partner) are part of the standard package. For cybersecurity and data protection we build measures with GDPR compatibility in mind, including DLP, IAM, encryption and incident response plans. The senior manager regime and management accountability formalize personal accountability and improve the quality of decisions.

External and internal audit for funds provides an independent view of finances and processes. IFRS reporting and regular compliance reports for AFSA reduce the information gap and enable complex topics to be discussed in the language of facts.

COREDO cases — what worked

Recently the COREDO team supported the licensing of an investment company focused on managing portfolios of debt instruments. The client applied for non-custodial management with advisory rights. We strengthened governance, prepared a capital adequacy model and implemented a transaction monitoring system. AFSA approved the license within the stated window, and subsequent review confirmed the quality of AML controls.

A separate case — a license for a venture fund in the AIFC with a multi-strategy focused on early rounds. We drafted the fund documents, established procedures for valuing illiquid assets, and agreed the private placement memorandum and marketing materials. The solution developed by COREDO enabled the fund to quickly close the first closings from institutional LPs and to build succession planning processes at the management company level.

Finally, for a digital asset custody provider we designed the licensing, storage technology architecture and recovery scenarios. Special attention was paid to PEP and sanctions screening, segregation of funds and contingency procedures. The AIFC license for digital asset operations was approved after demonstrating technological and operational test cases.

Cost of license maintenance

Outsourcing some functions is possible and reasonable if you retain accountability. AFSA is receptive to outsourcing provided there are clear SLAs, regulator access to data, and independent oversight. It is important to conduct vendor risk assessments regularly and incorporate the results into management reporting.

Visas and personnel: how to build a team

Visas and employment of foreign personnel in the AIFC are simplified through the center’s special regimes. We plan in advance the relocation schedule for directors and the key compliance officer, taking into account document timelines and the readiness of the IT infrastructure. This reduces the risk of delays at the launch stage.

Migration of fund management to the AIFC is possible with a well-considered transfer of functions, taking into account regulatory arbitrage and legal risks when changing jurisdiction. We arrange a phased transition while maintaining client service and controls.

Exit strategies and liquidity

Exit strategies for funds registered in the AIFC depend on the asset class and investment horizon. Exit options are available: IPO in Kazakhstan, trade sale and secondary buyout, as well as listing instruments on regional exchanges. I recommend planning secondary market liquidity metrics and market making already at the fund structure stage.

Regulatory arbitrage is useful when you compare the requirements of different centers and build a hybrid structure. The key is not to lose substance and the ability to manage risks, and to properly document the reasons for the choice.

Is the AIFC suitable for your model?

Analyze client jurisdictions to account for cross-border service restrictions and local marketing requirements. Assess ROI: apply NPV and IRR to three scaling scenarios and take into account the payback period for licensing and IT. Do not leave regulatory risks and reputational risk in the AIFC in the shadows: set an acceptance threshold and a response plan.

Why COREDO is a reliable AIFC partner

Over years of working in Europe, Asia and the CIS I have learned that success in the AIFC is built on careful process calibration and attention to detail. The COREDO team is used to being accountable for results: from registering a legal entity in the AIFC and licensing investment activities in the AIFC to deploying AML/KYC and preparing for an AFSA inspection. We do not promise miraculous timelines, but we design realistic roadmaps and ensure transparency at every stage.

The COREDO team has implemented dozens of structures in Luxembourg, the Czech Republic, Cyprus, Estonia, the United Kingdom, Singapore and Dubai. When entrepreneurs and chief financial officers from Europe, Asia and the CIS come to me with the task of quickly and cleanly launching a fund for professional investors, we often choose the Reserved Alternative Investment Fund: RAIF Luxembourg. It is a tool that combines private-market flexibility, AIFMD compliance, tax efficiency and predictable RAIF fund launch timelines.

Why a RAIF in Luxembourg is advantageous

Luxembourg provides a stable legal environment and predictable law and regulation for RAIF. The RAIF was established by Luxembourg’s 2016 RAIF Law; at the same time the fund does not require direct supervision by the CSSF: the CSSF’s role and oversight are exercised through a licensed management company — an AIFM for the RAIF — which significantly speeds up RAIF registration in Luxembourg and the first closing. This structure allows use of the AIFMD passport for cross-border distribution of the RAIF and marketing the RAIF in the EU to professional investors.

In our practice COREDO uses the launch of a Reserved Alternative Investment Fund for private equity deals in Central and Eastern Europe, direct real estate funds (core/core-plus, value-add) and hedge strategies involving derivatives. The flexibility of the investment mandate and the rapid time-to-market save months and directly support raising AUM.

Regulatory framework: what you need to know

RAIF is managed by an external AIFM authorized in the EU; this is the AIFMD compliance “anchor” for the RAIF. The manager assumes risk management and portfolio management, liquidity control, conflicts of interest policy and the RAIF’s ESG and SFDR compliance. The professional investor requirement precludes retail distribution: the RAIF is intended for well-informed and professional investors under MiFID; RAIF minimum investment thresholds typically start at EUR 125,000, and, upon competence certification, at the AIFM’s discretion.

Capitalization — clear and achievable: RAIF capital requirements: reach a minimum of EUR 1,250,000 within 12 months from launch. Implementation deadlines and monitoring are set out in the fund documentation and are overseen by the administrator and the AIFM.

RAIF structure and investment strategies

The choice of legal form depends on strategy and tax objectives. Most often I recommend SCSp (an unincorporated limited partnership) with an LPA agreement and rights of Limited Partners, where the carried interest remuneration structure and the profit distribution waterfall model can be configured flexibly. For hedge strategies corporate forms with a board of directors and independent directors are convenient – RAIF governance and independent directors increase LPs’ confidence and improve audit.

• RAIF for private equity: growth and buyout deals, possibility of a master-feeder RAIF structure for different classes of investors and currencies.
• RAIF for a hedge fund: RAIF pricing and NAV, often monthly, side-pocketing of illiquid assets is allowed for stressed assets, redemption gates and suspension of redemptions for risk management.
• RAIF for real estate: valuation methodologies for real estate and illiquid assets, an independent valuer and a clear valuation policy and frequency of NAV (quarterly/semi-annually).

Providers and contractual architecture

The solution developed by COREDO to speed up the launch is a “block” of contracts and providers with ready-made SLAs. In such a scheme:

• Registration of the AIFM management company: we take an external EU-authorised AIFM or register a new one (longer and more expensive). Delegation of RAIF management is structured through a management agreement and agreements with the investment consultant.
• Depositary and custodian for the RAIF: RAIF depositary duties include cash flow monitoring, safekeeping and oversight. The depositary agreement is agreed together with the administrator.
• RAIF fund administrator services: maintaining the register, NAV calculation, financial reporting, subscription/redemption of shares (RAIF subscription and redemption procedure), KYC/AML operational processes. registration agent RAIF performs transfer agent functions.
• Independent auditor and NAV audit: annual audit of financial statements and valuation procedures.
• Asset valuation — independent valuer: for real assets and complex private debt portfolios.
• corporate governance: governance committee and investment committee with clear mandates; conflict of interest and disclosure policy – a mandatory element of AIFMD.

Operational AML and KYC procedures

AML KYC requirements for RAIF comply with AIFMD standards and Luxembourg rules. We set up AML risk assessment and control policies together with the AIFM and the administrator, including PEP screening and enhanced Due Diligence, sanctions monitoring and EU sanctions, as well as transactional monitoring of suspicious operations. Investor due diligence for RAIF covers KYC/KYB for institutional investors of the RAIF, source of funds analysis and the beneficial owner and UBO of the RAIF.

Taxes, substance and cross-border structuring.

The tax residency status of a RAIF fund depends on its form. In a “SIF-like” regime the fund is usually exempt from corporate tax and does not claim benefits under double tax treaties; to reduce taxes in portfolio jurisdictions we set up an SPV layer and substance requirements and economic substance (substance documents: office lease, employees, local directors). For private equity and real estate, transfer pricing and the RAIF affect loan and service agreements; we check compliance with the “arm’s length” principle and the TP documentation.

Marketing and distribution: compliance

Thanks to the AIFM, RAIF marketing in the EU uses the AIFMD passport for professional investors, and marketing registration in the EEA is carried out centrally. For a number of markets pre-marketing is used, and, for non-EU jurisdictions, private placement is done under local NPPR. We comply with the public advertising restriction and distribution rules: no retail communications, clear legends and geographic filters.

Liquidity and risk management

RAIF risk and liquidity management: the AIFM function and a documented LRM policy. In closed PE/RE structures, liquidity terms and lock-up periods are specified, as well as the schedule of capital calls and distributions. In open strategies, redemption gates and suspension of redemptions are used as a rare-event tool, and the fund’s liquidity stress-testing is performed against market shock and outflow scenarios.

Currency risks and hedging for RAIF are implemented at the share-class or portfolio level: forwards, NDFs, swaps with counterparty limits. The valuation policy takes into account RAIF pricing and NAV, including FX, fair value and methods for illiquid assets; an independent auditor reviews the approach and the frequency of NAV calculation.

Documentation and procedures

Preparing the offering memorandum for the RAIF sets the rules of the game: description of the strategy, limits, valuation, risks, subscription and redemption procedures of the RAIF, fees, ESG, SFDR disclosures. The management agreement clarifies delegation and AIFM oversight; the depositary agreement and the agreements with the administrator and the registrar/transfer agent establish the control points. Side letters and investor preferences are permitted within the bounds of fairness between classes and without breaching the prospectus.

Timelines and costs — guidance

Our experience at COREDO shows that the launch timeline for a RAIF fund with a finalised strategy and an AIFM in place is 8–12 weeks to soft-close. This includes structuring, opening accounts with the depositary, negotiating agreements, registering in the registers and publishing the offering memo. If registration of the AIFM management company from scratch is required, the timeline is extended by 4–6 months.

The cost of launching a RAIF in Luxembourg depends on the mix of providers and the complexity of the structure. In a typical project the setup and first-year budget comprises legal support for the RAIF, fees for the AIFM, the depositary and administrator, an independent auditor, a registration agent, a valuer (if required), D&O insurance and marketing expenses. As a reference, formation and first-year ongoing charges for COREDO clients typically fall within the average range for institutional RAIFs, and the unit burden quickly decreases as AUM grows. I determine specific pricing after receiving a term sheet on the strategy and operating model.

Timeline and project launch checklist

To ensure process transparency and save time, I use a step-by-step checklist:

1. Strategy, RAIF fund structure, choice of form (SCSp/corporate), tax regime.
2. Economic term sheet: classes, fees, carried interest, waterfall and exit waterfall.
3. Providers: AIFM, depositary and custodian, administrator, auditor, registration agent, independent valuer.
4. Fund documentation: offering memorandum, LPA/articles of association, management agreement, depositary agreement, distribution/placement agreements, subscription agreement.
5. Policies: valuation policy and NAV frequency, risk and liquidity management, AML/KYC, sanctions, GDPR and IT security, ESG and SFDR.
6. Marketing and cross-border distribution of the RAIF: registration in the EEA, private placement outside the EU, restriction on public advertising.
7. Substance: office, local directors, meeting calendar, recruitment compliance for the management team.
8. Reporting and audit: annual audit, audit approval and annual general meeting, CSSF notification via the AIFM.
9. Finance: transaction costs and ongoing charges, currency policy, hedging, banking and brokerage agreements.

COREDO case studies: solutions in practice

Recently the COREDO team launched a RAIF for private equity with a focus on buyouts in the EU industrial sector. We selected an SCSp, set out carried interest with a European waterfall, and implemented a master-feeder for multi-currency fundraising. For liquidity management we provided capital calls by deal stages, and for tax purposes – an SPV in contractual jurisdictions with substance and TP documentation. The investors’ committee received independent members, and the AIFM adopted a risk policy and SFDR disclosures under Article 8.

For a hedge strategy with liquid instruments, the solution developed at COREDO included daily pricing of key assets by a price provider, monthly NAV and strict counterparty limits. We built in liquidity stress-testing, FX hedging of classes and a suspension policy for extraordinary conditions. LPs received a transparent reporting pack and a clear fee model.

Secondary sales and investor exit

Exit strategies of RAIF investors depend on the structure. In closed-ended funds this is a waterfall distribution after exit from the portfolio; in open-ended funds: redemptions according to the rules and frequency described in the prospectus. If necessary, a secondary-market sale of a stake is permitted: transfer of an LP’s interest with the consent of the GP and AIFM and updating the registers with the administrator. We add these mechanics in advance to the LPA and subscription agreements so as not to restrict the transferability of interests.

Where difficulties most often arise

Benefits of RAIF for the investor

Benefits of RAIF for investors consist of three components. First, Luxembourg’s legal regime, the stability of the legal environment in Luxembourg, and AIFMD compliance through an AIFM with clear roles for the depositary, auditor and administrator. Second, flexibility of the remuneration structure (carried interest and waterfall), governance and independent directors, committees and clear LP rights (LPA, side letters within the framework of fairness). Third, tax efficiency at the fund and SPV level, well-considered currency hedging and predictable Ongoing charges.

Why I recommend RAIF and COREDO

RAIF is an instrument that combines speed to market, the AIFMD distribution passport, a flexible structure for private equity, hedge funds and real estate, and a transparent compliance regime. In COREDO projects this is expressed in a controlled timeline, a clear budget, predictable regulatory steps and investor trust even before the first closing.

The European ELTIF is precisely such a tool. With the entry into force of ELTIF 2.0 in January 2024, it became closer to retail investors and more convenient for asset managers. Over the past months the COREDO team has carried out several ELTIF launches and restructurings in Luxembourg and Ireland, adapted processes to the requirements of AIFMD, MiFID II, PRIIPs and SFDR, and established transparent AML/KYC procedures for investors from Europe, Asia and the CIS. In this article I summarize our experience and provide a compact yet thorough guide – from fund design to income distribution and liquidity management.

What is ELTIF 2.0 and what has changed for retail investors?

ELTIF – European Long-Term Investment Fund: a regulated EU alternative fund for investments in illiquid assets: infrastructure, the real economy, private equity and private debt. Version 2.0 (Regulation (EU) 2023/606, amendments to 2015/760) removed the main barriers for retail investors: the minimum amount of 10 000 EUR and the “10% test” for portfolios under 500 000 EUR were abolished. Now ELTIF accessibility for retail investors has become a reality, and the requirements for suitability and product governance have moved under the MiFID II framework.

COREDO’s practice confirms: these parameters allow building a realistic ELTIF portfolio structure with a balance of returns and control of illiquidity.

ELTIF vs UCITS: different objectives – different liquidity

Comparing ELTIF vs UCITS is important already at the product positioning stage. UCITS provide predominantly liquid markets, daily valuation and redemption, but rarely open access to infrastructure projects or private equity. ELTIF, by contrast, is built around long-term investments and may have a limited or closed redemption regime. In our experience, for wealth managers and private banks it is rather the strategic core of ‘alternative’ and real assets, while UCITS cover the liquid layer of the portfolio.

Marketing and passport in the EU: how to distribute ELTIF

The European ELTIF passport and passporting across the EU operate through AIFMD mechanisms. Manager: authorised AIFM: submits a notification to the national regulator, and the fund becomes available for cross-border ELTIF distribution in Europe. Consistency of the prospectus, UCITS-style disclosure for retail and compliance with MiFID II requirements on the target market, product governance and the suitability test are important. ESMA recommendations on ELTIF and technical guidance clarify the approach to liquidity, valuation and pre-contractual disclosures, and the European Commission rules on ELTIF set the overall framework of the 2.0 reform.

Access for retail investors: how to invest in ELTIF

Entering ELTIF for retail investors has become easier. The process typically includes onboarding: eKYC, eID and electronic signature, MiFID suitability/appropriateness questionnaires, provision of the PRIIPs KID, and signing subscription agreements. At COREDO we have built a digital route with AML and KYC requirements for investments in ELTIF, including enhanced Due Diligence for high-risk investors and checks of beneficial ownership registers. For clients from Asia and the CIS we add CRS and automatic exchange of information to avoid surprises in reporting.

Minimum amount, fees and expenses

ELTIF 2.0 removed the regulatory minimum entry threshold, so the minimum ELTIF investment amount is now determined by the prospectus and the distribution policy. We often see a range from 5 000 to 25 000 EUR for retail and from 100 000 EUR for professional tiers. ELTIF fees and expenses are transparent in the KID and prospectus: fixed management fee, possible performance fee, structural expenses, depositary, audit, custody and administration. Compensation structures for ELTIF managers include a hurdle rate, carried interest and performance fee mechanisms, and the waterfall distribution and payment priority are detailed in the LPA/prospectus, including clawback provisions.

Liquidity for retail investors: tools and limitations

The main question is ELTIF liquidity for retail investors. ELTIFs are illiquid by nature, but 2.0 allowed buyback mechanisms before maturity: redemption windows, matching of secondary orders and liquidity management tools. Liquidity management in ELTIF uses redemption gates, suspension and lock-up periods, side pockets for troubled assets, as well as swing pricing and NAV adjustment on inflows/outflows. The secondary market for ELTIF units is developing: exchange listings are still rare, but secondary-market platforms for units of alternative funds and broker ‘notice boards’ for deal matchmaking are emerging.

Taxes: structure matters more than the rate

Taxation of investments in ELTIF is not harmonised at the EU level and depends on the jurisdiction of the fund and the investor. Tax efficiency of an ELTIF for international investors is achieved through structuring via SPVs and holdings, using tax treaties and avoiding double taxation. At COREDO we model flows in advance, taking into account withholding on coupons/dividends, CFC rules in investors’ countries and ‘pass-through’ regimes in Luxembourg, Ireland or Malta. For HNWIs and family offices we often create bespoke tax memoranda and accompanying information-exchange agreements.

ELTIF portfolio structure: eligible assets, diversification, leverage

ELTIF leverage restrictions are tied to whether the marketing is to retail investors or to professionals only, and subscription lines and leverage in ELTIFs are allowed within the risk policy and AIFMD limits.

Investment opportunities: infrastructure and private markets

investment opportunities in ELTIF infrastructure are especially in demand amid the energy transition and digitalization. We structured an ELTIF with a portfolio of brownfield transport and energy projects in Central Europe, adding a share of greenfield with staged capital calls and construction insurance. Private equity investments through ELTIF cover buy‑out and growth stages, as well as private debt for SMEs, where returns are generated through coupon income and arrangement fees. Benchmarking: ELTIF versus private equity and infrastructure funds shows comparable returns with better transparency and European supervision.

Valuation, NAV and tools for illiquid assets

NAV valuation issues in illiquid ELTIFs are addressed through independent valuation of alternative assets and model validation. ESMA recommends stress tests and portfolio scenario analysis to show the impact of rates and credit spreads, as well as liquidity management under shocks. Side pockets and handling of illiquid assets help isolate problematic positions, and swing pricing adjusts investor entry/exit to protect existing unitholders. Our experience at COREDO has shown that a clear valuation methodology and oversight by an independent valuer simplify audits and reduce dispute risks.

Governance, legal aspects and AIFMD

The legal aspects of ELTIF registration are tied to AIFMD: manager — a licensed AIFM, depositary – with full oversight and depositary responsibility for safekeeping/recordkeeping. Custody and the role of the depositary in ELTIF require clear SLAs and monitoring of conflicts of interest, and regulatory supervision and ELTIF audit include regular disclosures, Annex IV reporting and an annual audit. We record regulatory changes and the compliance roadmap in a compliance calendar with checkpoints for ESMA technical guidance and internal policies on best‑practice compliance governance.

Jurisdictions and corporate structuring

Registering an ELTIF manager in Luxembourg or Ireland is the most common choice, but Malta remains a workable alternative. Onshore vs offshore funds: EU advantages: transparent supervision and a marketing passport; disadvantages: higher administration costs compared to offshore SPCs. Structuring via SPVs and holding companies allows addressing tax issues, subordination and local licensing; structural subordination and credit risk of SPVs are accounted for in the credit documentation and covenants. For investments outside the EU we add local SPVs with arrangements on security and a cash sweep in the waterfall.

Documents, fees, waterfall and capital calls

Preparing the prospectus and key documents includes: constitutive documents, offering memorandum, PRIIPs KID, SFDR disclosures, risk and liquidity policies, target market and product governance documents. Subscription agreements and legal documents carefully reflect the mechanics of investor contributions, capital calls, default procedures and penalty interest. The waterfall and income allocation in an ELTIF detail payment priorities: return of capital, hurdle rate, catch‑up and carried interest; we often add an escrow mechanism and definitions of “realised proceeds” to avoid ambiguity. ELTIF fees and expenses are disclosed according to PRIIPs KID disclosure requirements for retail investors.

Suitability, marketing and distribution channels

MiFID II and suitability assessment when selling ELTIFs are critical for stable distribution. Marketing notices and UCITS‑style disclosure are adapted to local regulator expectations, avoiding aggressive yield promises. Distribution channels: banks, private banks, wealth‑tech platforms and licensed distributors; integrating ELTIF into wealth management solutions helps build a “core‑satellite” model where ELTIF is a long‑term core of alternatives. COREDO helps align ELTIF passporting and marketing across the EU, including regional restrictions on sales outside the EU and working with investors from Asia and the CIS through local NPPR regimes or Reverse Solicitation.

ESG and Sustainable ELTIF: from SFDR to real impact

Sustainable ELTIF and SFDR require alignment: classification under Articles 8/9, PAI indicators, sustainability measurement methodologies and reporting. Greenwashing risks and the control of ESG claims we mitigate through project KPI matrices, external verification and harmonization of wording with the depositary and auditors. In infrastructure, ESG metrics are integrated into credit covenants and financing terms; this simplifies subsequent refinancing and increases the asset’s value at exit.

Tokenization, digital fund units and the secondary market

Tokenization of fund shares and blockchain solutions increase operational efficiency and the transparency of the register of fund units. ELTIF tokenization and digital fund units are implemented through the DLT laws of individual EU countries, and it’s important to distinguish regulation of digital assets and MiCA in the context of ELTIF: tokens representing a fund share are not equivalent to crypto-assets under MiCA. Secondary market platforms for alternative fund units already allow organizing matching and periodic auctions, which support liquidity and reduce the cost to the investor in the case of an early exit. The solution developed by COREDO combines eKYC/eID, electronic signature, AML monitoring and a secondary trading module with restriction controls.

ELTIF risks for private investors and how to manage them

Key risks: illiquidity, valuation and NAV recalculation, credit risk of borrowers/projects, leverage limits, operational risks and cybersecurity. ROI assessment and performance metrics for ELTIFs include IRR/TVPI/DPI and scenario analysis, stress testing and portfolio scenario analysis for rising rates and multiple compression. Exit strategies and ELTIF redemption windows require discipline: pre‑agreed periods, matching mechanisms and communication with retail investors and the KID.

COREDO case studies: from design to distribution:

Infrastructure ELTIF in Luxembourg. The COREDO team implemented a structure focused on brownfield assets of transport and energy infrastructure in Central Europe, integrated independent valuation and side pockets, and established quarterly redemption windows with limits. Passporting to Germany, Italy and Spain, channels: private banks and licensed platforms.

Private debt ELTIF in Ireland. Our experience at COREDO has shown that using subscription lines and soft leverage up to 40% of NAV accelerates capital deployment without loss of diversification. We established independent loan valuation, stress‑tested for rising rates and developed a waterfall with a hurdle rate and transparent carried interest.

Integration of ELTIF into wealth solutions. For a network of wealth managers and private banks we prepared target market and product governance documents, KID in several EU languages, as well as a MiFID suitability procedure. Clients — family offices — received a clear due diligence model when investing in ELTIF and regular SFDR reports.

Due diligence: checklist for managers and investors

COREDO’s practice confirms the value of systematic DD. We use a due diligence checklist for managers and investors:

• Manager and governance: AIFM license, Board independence, conflicts of interest policy.
• Strategy and pipeline: eligible assets list, geographic scope, co-investment, ELTIF regulatory restrictions.
• Risks and liquidity: liquidity management tools, redemption policy, stress tests, NAV valuation, independent valuation.
• Finance: ELTIF fees and expenses, waterfall structure, hurdle rate and carried interest, ROI scenarios.
• Operations: depositary and oversight, custody, cybersecurity and backups, operational risks.
• Legal and tax: prospectus, subscription agreements, Annex IV, double taxation and tax treaties.
• ESG: ESG standards and disclosures under SFDR, monitoring greenwashing claims.

Enforcement and disputes: what to expect

Legal disputes and precedents regarding ELTIF are still rare, but issues usually concern valuation, disclosures and liquidity. We include arbitration clauses, a procedure for an independent revaluation and clear definitions of liquidity events. For regions outside the EU we comply with sale restrictions and NPPR regimes, and also document reverse solicitation to minimize regulatory risks.

Macro factors, refinancing and flow management

We take the impact of macroeconomics and the interest rate on asset valuation into account in our models: duration of infrastructure cash flows, sensitivity of PE multiples and cost of debt. We plan capital inflow/outflow management and the refinancing market in advance: subscription windows, synchronization of capital calls with the pipeline and covenants on project refinancing. For investors this means a more stable strategy implementation and predictable communication about the payment schedule.

ELTIF for investors from Asia and the CIS

Investors from Asia and the CIS value European supervision and the ELTIF European passport. We take into account local rules and currency regimes, set up AML Enhanced Due Diligence, ensure CRS reporting and ownership transparency through beneficial owner registers. Where sale outside the EU is restricted, we use cooperation with local licensed partners or reverse solicitation mechanisms, without breaching the regulatory framework.

Best-practice compliance governance for managers

The solution developed at COREDO includes: a matrix of regulatory obligations under AIFMD/ELTIF, an Annex IV calendar, internal LMT policies, regular reports to investors and UCITS‑style disclosures. For risk assessment we apply stress tests, default SPV scenarios, structural subordination and credit risk analysis, as well as IT controls and cyber backup. Such a «framework» increases trust and simplifies work with auditors and the depositary.

• More accessibility: no regulatory minimum, clear KID and MiFID‑processes.
• More portfolio flexibility: broader eligible assets, reasonable diversification.
• More realistic liquidity: redemption windows and LMT with clear disclosure.
• Stronger focus on disclosures: PRIIPs KID, SFDR, ESMA guidance and product governance.

Conclusion: how to move forward

ELTIF 2.0 has become a mature tool for international investors and asset managers. For companies from the EU, Asia and the CIS it opens access to infrastructure, real assets and private markets with a European level of protection and transparency. It is important to soberly assess illiquidity, properly structure taxes and build operational discipline; then an ELTIF becomes not just a “long‑horizon fund” but a stable anchor for a portfolio.

The COREDO team has already helped launch and adapt such structures in Luxembourg, Ireland, Cyprus and Estonia, and also integrate them into banks’ channels and wealth platforms. If you need a roadmap for ELTIF — from choosing a jurisdiction and a depositary to product governance and cross‑border distribution — I’ll share practical templates, checklists and examples. Mature design, transparent disclosures and a demanding approach to risk are the three pillars that underpin a quality ELTIF, and that’s exactly how I am accustomed to building solutions together with COREDO.

When I launched COREDO in 2016, my goal was simple and ambitious: to give entrepreneurs and capital managers from Europe, Asia and the CIS a reliable path into the complex world of international structuring, licensing and compliance. Since then the COREDO team has implemented dozens of fund projects: from the EU and the UK to Singapore and Dubai — and I can clearly see how the Variable Capital Company (VCC) in Singapore is changing the game for hedge funds. This article is a distillation of COREDO’s practice: what works, where the pitfalls are, and how to achieve maximum operational and tax efficiency from a VCC in 2026.

What is a VCC, and why choose Singapore?

Variable Capital Company (VCC), is a Singaporean form of fund organization, developed specifically for the needs of investment structures. Unlike a traditional company, a VCC allows variable capitalization: a fund can freely issue and redeem shares at net asset value (NAV), simplifies the distribution of income and the range of share classes, and also allows operating a structure in an umbrella fund structure with sub‑fund segregation. For hedge funds this is the equivalent of a Swiss Army knife: flexibility, speed and control over liquidity.

The regulator MAS builds frameworks through the Securities and Futures Act (SFA), supplements them with MAS guidance VCC, and the tax infrastructure relies on a wide network of double taxation agreements. As a result, the VCC in Singapore becomes a logical choice for hedge funds, especially when institutional acceptability and readiness for Due Diligence by prime brokers and banks are required.

VCC architecture: umbrella and sub-funds

VCC supports an umbrella fund structure with multiple sub‑funds. Each sub‑fund forms a separate segregated portfolio: the liabilities of one sub‑fund do not legally transfer to another. In real COREDO projects this allows isolating strategies (for example, market neutral and event‑driven) and creating different share classes by currency, fees and liquidity for different investor profiles.

The liquidity and variable capitalisation of a VCC allow organizing subscription and redemption mechanics with gate provisions and side pockets for complex or illiquid assets. I always recommend documenting capital reduction procedures and variable capital processes so that the Administrator and Custodian can execute them without manual workarounds. This is the foundation for robust liquidity management, especially when using leverage and derivatives.

For hedge funds, the flexibility of the VCC is revealed through capital flexibility and share classes: you can launch both open‑ended and closed‑ended VCCs, and if necessary – convert or launch parallel classes for new mandates. Our experience at COREDO has shown that properly structured classes can reduce conflicts of interest between investors with different liquidity windows and lower operational risks in stress scenarios.

Manager licensing

Key question: what licences does a fund manager need in Singapore. Depending on the strategy and investor base this is the Capital Markets Services (CMS) licence for fund management or the Registered Fund Management Company (RFMC) regime. CMS suits large-scale managers and allows a broader range of activities; RFMC is a simplified regime for managers with smaller AUM, but with limits. The solution developed at COREDO typically combines an assessment of target investors, marketing geographies and derivative instruments to determine the least sufficient regime.

For retail funds – different thresholds and requirements for a depositary/trust structure; for professional and institutional funds, more flexibility but not less responsibility. The COREDO team ensures that governance meets institutional investors’ expectations: independent directors with relevant qualifications, clear fiduciary duties, a meeting calendar, minutes and a conflicts of interest policy.

Regarding product restrictions the VCC as a form is flexible. Restrictions more often follow from investor status and the manager’s licence. In the institutional/accredited segment Singapore does not set strict limits on derivatives and leverage, but requires an adequate risk management framework, disclosures and controls. COREDO’s experience confirms: MAS’s inspection focus is on the actual implementation of policies, not just their formal existence.

Taxes for VCC: 13R/13X and residency

VCC tax benefits are based on the regimes Section 13R and Section 13X. The 13R regime is intended for onshore‑funds with certain requirements for AUM and investor profile; 13X is a more “institutional” incentive without investor restrictions, but with minimal economic criteria. In COREDO cases we achieve optimization by obtaining a tax residency certificate for the VCC, access to the DTA network and proper management of withholding tax implications for funds.

Economic substance requirements for VCC — a point of focus in 2026. A management function in Singapore is required: board meetings in Singapore, a local director, on‑the‑ground contracts with administrators and auditors, as well as a reasonable “critical mass” of operations and decision‑making. The issue of substance and employees vs service outsourcing is addressed by a combination of the manager’s core‑personnel and outsourcing non‑core functions. We take into account BEPS 2.0 / Pillar Two implications for funds: hedge funds are often subject to carve‑outs, but this requires a review of the group structure and investor layers.

GST treatment for investment funds in Singapore is usually neutral at the investment level, but contractual relationships with suppliers are important. Transfer pricing considerations for fund groups are relevant for cross‑border services of the manager and the related administrator, and I recommend establishing a TP policy from day one. This reduces the risk of queries when obtaining tax residency and during subsequent audits.

Timeline and stages for launching a VCC

The VCC registration timeline and launch stages depend on the readiness of the manager and investor documentation. In a standard COREDO project we complete this in 6–10 weeks from decision to first subscription:

• Weeks 1–2: VCC architecture and fund structure 2026, selection of RFMC/CMS, appointment of directors, start of KYC on beneficiaries, preparation of constitutional documents.
• Weeks 2–4: filing with the RFMC or CMS (if required), arranging corporate services, preparation of the offering memorandum, subscription agreement, NAV policy and valuation, draft AML/CFT framework.
• Weeks 4–6: opening bank and brokerage accounts, selection of administrator and custodian, setup of transfer agency and investor servicing, finalizing derivative ISDA/GMRA/prime brokerage arrangements.
• Weeks 6–10: testing reconciliations and fund accounting, launching CRS/FATCA processes, data protection policy and cross-border data flows, final board approvals and first subscription.

Operational blocks: AML/KYC and reporting

Operational reliability: a critical factor for VCC Singapore hedge funds. In COREDO projects I focus the team on the following modules:

• Administration and accounting: an independent third‑party administrator, clear NAV policies, independent valuation and NAV procedures for illiquid/OTC. Reconciliation and fund accounting best practices, daily reconciliation with prime brokers, the custodian and the bank.
• Prime brokerage and leverage: documenting prime brokerage and leverage arrangements, margin terms, haircuts, stress tests, derivatives clearing and collateral management. We include insurance and operational risk transfer where economically justified.
• Transfer agency and investor relations: transparent subscription and redemption mechanics, processing side letters, control of gate provisions and side pockets. Maintaining the beneficial ownership register of the VCC and notice requirements for investors.
• Compliance: AML/CFT controls for fund subscriptions, KYC and PEP screening procedures, transaction monitoring and sanctions screening. Integration with FATF recommendations for fund administrators and CRS/FATCA reporting obligations.
• Internal controls: risk management framework for hedge funds, internal controls and compliance monitoring, internal audit and external audit requirements. We include cybersecurity: cybersecurity controls for fund managers and a policy on data protection and cross‑border data flows.

Master-feeder: marketing in the EU and Asia

A VCC’s compatibility with a master‑feeder structure is a proven solution for geographic marketing. Often the VCC acts as the master, and the European feeder is managed by an AIFM under the applicable AIFMD. Alternatively, a feeder‑VCC with a master in another jurisdiction is possible, but for institutional investors a Singapore master is convenient from a reporting and DTA perspective.

Marketing funds to EU and Asian investors requires compliance with local rules. In the EU – NPPR under AIFMD, operating through a licensed AIFM and controlled distribution channels. In Asia, a country‑by‑country approach: onshore vs offshore domicile decision factors and passporting alternatives. The COREDO team configures distribution channels so as not to cross the line «offering to the retail public», if the strategy is strictly professional.

Cayman vs VCC: which wins when

The VCC vs Cayman question comes up in about every other hedge fund project. Cayman historically dominated as an offshore SPV, but the trend is shifting toward regulated onshore structures. VCC has tax advantages with 13R/13X, a network of DTA, a clear MAS regime and economic substance — arguments in favor of Singapore. On the other hand, Cayman can remain attractive for certain strategies, especially when there is an established pool of investors.

Cayman Islands vs VCC cost comparison in 2026 shows: setup for VCC is comparable or higher, but recurring compliance costs for VCC are often more predictable, and ROI improves due to tax efficiency, access to Asian investors and reduced frictions with banks and custodians. Operational due diligence for prime brokers also proceeds faster when the structure is onshore and regulated.

How to change your domicile without incurring losses

Redomiciliation of funds to Singapore is becoming in demand in 2026. Liquidation and re-domiciliation of VCC can proceed under two scenarios: transferring the existing fund while preserving its history, or closing the old one and launching a new VCC with the transfer of assets. In both cases, notice requirements and investor disclosures, assessment of tax consequences, and coordination with counterparties (prime brokers, custodians, administrator) are important.

Frequently asked questions from managers and investors

If the fund has institutional plans in Asia, a need for DTA and you are aiming for onshore residency, conversion makes sense. Weigh the cost of redomiciliation, tax savings and investor perception. Our experience suggests: a positive NPV most often appears on a 2–3 year horizon.

ROI benefits from tax incentives 13R/13X and reduced frictions with service providers. Operating expenses become more transparent: administration, audit, compliance, governance. In terms of OPEX/ AUM dynamics, especially after reaching critical mass, a VCC demonstrates competitive economics.

Key ones are economic substance in Singapore, the correct license (CMS or RFMC), continuous AML/CFT and sanctions control, as well as data protection for cross‑border data flows. The solution: allocate functions so that the “reasonable management center” is in Singapore, and outsourcing does not replace core‑decision making.

VCC as master, EU feeder under an AIFM with NPPR, a workable scheme. It’s important to synchronize NAV cut‑off, disclosures, KIDs/ PRIIPs (if relevant), as well as TP policy and cross‑border fee flows. The COREDO team designs documentation to meet both MAS and AIFMD expectations.

Documented NAV policies are required, independent valuations for illiquid/OTC, liquidity stress tests, counterparty and leverage limits, as well as regular reporting to the board’s risk committee. For derivatives: procedures for collateral management, variation/ initial margin and fair value models.

A VCC registers as a Reporting FI, the administrator conducts KYC/AML, PEP screening, CRS/FATCA reporting, and sanctions screening is performed at subscription and on an ongoing basis. COREDO solutions use automated lists and triggers for transaction monitoring.

In the institutional/ accredited segment, there are no retail‑style restrictions, but there are requirements for risk management, liquidity and disclosures. Brokers and custodians also impose their own limits, which effectively become the risk cap.

An independent director is highly desirable: it strengthens governance and passes investor ODD. A depositary is mandatory for retail funds; for professional funds, a custodian is required, and depositary functions can be handled through custody agreements and the administrator.

COREDO Case Studies: How We Solved the Challenges

Case 1: launches of two sub‑funds under a VCC for quant strategies.
Client: a European manager, targets – Asian LPs and prime brokerage in Singapore. COREDO developed a VCC sub‑fund segregated portfolio with market neutral and stat‑arb strategies, 13X, RFMC, an independent administrator and custodian. Result – launched in 9 weeks, successful ODD at two prime brokers, a positive track record and an expansion plan.

Case 2: redomiciliation from Cayman to a VCC while retaining investors.
Objective: reduce withholding on dividends and coupons through a DTA and enhance operational transparency. The COREDO team performed the redomiciliation, retransferred ISDA/GMRA, synchronized notice requirements and conducted a tax assessment. Within a year the client obtained a tax residency certificate and reduced the portfolio’s overall WHT.

Case 3: strengthening AML/CFT and sanctions screening at an existing VCC.
After a request from the bank the client approached us. The solution developed by COREDO included configuring KYC/PEP screening, ongoing transaction monitoring, updating policies in line with FATF and MAS guidance, implementing an incident‑management system and staff training. The bank confirmed compliance, and operational delays ceased.

Cost of a VCC in Singapore in 2026

Cost model: setup vs recurring compliance costs: the key to managing the fund’s P&L. Typically, initial costs include incorporation of the VCC, the manager’s licensing trajectory (CMS/RFMC), preparation of the Offering Memorandum and agreements, onboarding of the administrator and custodian, as well as legal and tax opinions. Recurring – administration and NAV calculation, audit, tax reporting, compliance-monitoring, corporate secretarial services and the board.

Project plan with COREDO for the initial subscription

• Diagnostics and target model: choose VCC vs alternatives, determine CMS or RFMC, assess the 13R/13X tax regime and economic substance requirements.
• Fund architecture: umbrella vs single‑fund, share classes, liquidity management, side pockets, gate provisions, NAV policy and valuation.
• Providers: third‑party administrator selection criteria, custodian and fund administration requirements, auditor selection, cybersecurity and data protection.
• Documents: offering memorandum, subscription agreement, AML/CFT policy, sanctions screening, CRS/FATCA, VCC beneficial ownership register.
• Integration with brokers and banks: prime brokerage, derivatives clearing, collateral management, reconciliation and accounting.
• Marketing and compliance: AIFMD/NPPR for the EU, Asian channels, notice requirements and investor disclosures, ESG integration (on LPs’ request).
• Launch and monitoring: test‑set, first subscription, board reports, internal audits, readiness for MAS inspections and enforcement trends.

VCC — a long-term vehicle

Variable Capital Company Singapore – this is not just a legal wrapper, but an institutional-grade platform for hedge funds ready to play the long game. The liquidity and variable capitalization of the VCC, sub‑fund segregation, tax incentives 13R/13X, compatibility with master‑feeder structures and the strict but predictable oversight of the MAS create the foundation for sustainable growth. Yes, there are requirements for economic substance, governance and compliance. But that is exactly what investors and counterparties like — and what adds value to your brand.

If you are wondering how to register a VCC for a hedge fund in Singapore, which licensing regime to choose, how to ensure economic substance for the VCC’s tax efficiency and how to build an operational model without “bottlenecks”, I am ready to discuss your case in detail. COREDO’s experience in the EU, the UK, Singapore and Dubai helps connect the tax, regulatory and operational dimensions into a single strategy. In the outcomes, discipline, transparency and speed matter — and those are precisely what we rely on every day.

Since 2016 I have been heading COREDO and every day I see how one discipline changes the resilience and value of businesses in Europe, Asia and the CIS: a competent whistleblowing program in fintech. It has long ceased to be a “compliance box” and has become an element of corporate governance that affects Licensing, access to banking infrastructure, cost of capital and customer trust. The COREDO team has implemented dozens of deployments for payment organizations, neobanks, crypto platforms, brokers and companies building multi-jurisdictional structures in the EU, the UK, Singapore and Dubai. Below is my practice summary: what the EU directive requires, how to launch a system in 8–12 weeks, where the ROI is, and how to scale solutions across an international group.

Why fintech needs a whistleblowing program

Fintech companies operate under increased scrutiny from regulators and payment infrastructure. Payment licenses, PSD2 processes, EBA Guidelines on governance, AML/CTF frameworks and operational resilience requirements converge on one point: the ability to quickly detect and remediate breaches. An internal whistleblower program provides a controlled early-warning channel, not a stream of leaks to social media and journalists.

Regulatory framework: directives and laws

EU directive on the protection of whistleblowers 2019/1937 obliges organizations with 50+ employees, as well as companies from regulated sectors, to establish internal reporting channels and protect whistleblowers from reprisals. Employer obligations under the EU directive include:

• a secure and accessible internal channel (including anonymous reporting channels where permitted by national law);
• appointing persons responsible for processing reports and conducting internal investigations;
• response to a complaint: acknowledgement of receipt within 7 days and final feedback within 3 months;
• a non‑retaliation policy and legal mechanisms to protect whistleblowers.

National implementing laws in EU countries introduce details: in some places anonymity is explicitly encouraged, in others it is left to the company’s discretion. COREDO’s practice confirms: even where anonymity is not mandatory, the market (banks, partners, auditors) regards anonymous channels as best practice.

In the United Kingdom the FCA expects mature whistleblower protection procedures (including a “whistleblowing champion” for large firms; see SYSC 18). For payment and banking groups, the EBA Guidelines on internal governance and reporting expectations apply: a corporate whistleblowing policy is considered part of the internal control system. PSD2 strengthens requirements for operational incidents and security; an effective complaints system helps to detect and document them.

Architecture and technologies of a mature system

I describe a reference target architecture that the COREDO team develops for fintechs.

• Channels: protected feedback forms (web), secure drop, hotline with recording, mailbox, channel for third parties (external channel for complaints by a third party: external reporting). For anonymity we use end-to-end encryption of messages, the ability to upload files, metadata and the degree of pseudonymization.
• Case management: tools for case management allow registering, routing and investigating reports; important are automation of complaint triage, prioritization of incidents and SLAs for response. Role separation (RBAC), access control and privilege separation are mandatory.
• Information security: ISO 27001 and SOC 2 standards for whistleblowing providers; PCI DSS is relevant if investigations involve payers and elements of payment data — then we design a strict separation of environments. Audit log and data integrity control, logging and auditing of actions in the system, chain of custody of digital evidence: without these, investigations and e-discovery risk failing in court.
• Submission technologies: external whistleblowing provider (SaaS) versus on-premise. SaaS speeds up the launch and covers multi-jurisdictionality, but requires legally correct data transfers (DPA, SCCs, list of subprocessors). On-premise gives maximum control and may be justified for banks/exchanges. The solution developed by COREDO for one payments group combines a SaaS portal for the employee and an on-prem evidence repository.
• ML/NLP: we apply ML/NLP capabilities for classifying complaints and identifying systemic risks cautiously: automatic scoring for triage, thematic clustering, highlighting PEP/sanctions triggers, but with a constant human-in-the-loop. Machine learning for identifying fraud patterns works well together with AML alerts data.

Integration of AML and KYC

Integration of whistleblowing with AML and KYC turns reports into operational signals for monitoring. Customer and employee complaints often highlight weak spots: fake accounts, trade in «mules», incompetent EDD, breaches of sanctions policy. In COREDO’s practice, a support operator’s complaint helped identify a limit‑circumvention scheme in a neobank; linking the complaint to the TM system reduced time‑to‑block to hours.

KYC processes and the impact of complaints on monitoring are expressed in three streams:

• risk re-scoring of the client and segment;
• cases about employees and contractors (third‑party risk) → review of access and functions;
• escalation to the FIU when signs of money laundering are detected.

AML compliance and interaction with complaints require clear procedures for dividing responsibilities among the CCO, DMLRO and the investigations team, to avoid conflicts of interest.

Implementation in a fintech company: step-by-step

I distilled the key steps into a practical roadmap. The COREDO team typically completes the rollout in 8–12 weeks for a startup and 12–16 weeks for a mature PSP.

1. Diagnostics and architecture
   • compliance audit of the directive at the group level;
   • map of jurisdictions and assessment of international delineation for complaints;
   • data protection impact assessment (DPIA) for whistleblowing;
   • choice of model: SaaS vs on‑premise, requirements for end‑to‑end encryption, secure drop.
2. Policy and documentation
   • template of internal policy on whistleblowing for fintech: objectives, scope, channels, roles and responsibilities (DPO, CCO, CRO, CTO), timelines 7 days / 3 months, non‑retaliation, data retention, interaction with EU regulators;
   • corporate documentation: regulations, investigation procedures, incident response plan and business continuity;
   • anti‑corruption policy and reports of violations – align with the overall compliance framework.
3. Technological implementation
   • provider selection and licensing, contracts with service providers, DPA and SCCs;
   • integration with ERM/CRM/HR systems, RBAC configuration, audit log;
   • testing of logging, integrity control, chain of custody, WORM storage.
4. Processes and SLA
   • legal assessment of complaints and triage: classification of legal significance, conflicts of interest, routing;
   • SLA for responding to reports, KPI time‑to‑resolution, % of confirmed complaints;
   • internal investigation protocol for reports of violations, forensic investigation, e‑discovery.
5. Training and communications
   • training of staff and awareness raising (awareness) with a focus on non‑retaliation;
   • communication strategy for employees and stakeholders, multilingualism, FAQ;
   • external channel for complaints from clients, partners and counterparties.
6. Pilot and launch
   • control period with parallel manual duplication, «hotline» for questions;
   • preparation for external audits and regulator inspections, dry‑run with internal audit;
   • reporting to the board of directors (board oversight), corporate governance and whistleblowing in one package.

Cross-border data and Schrems II

Scaling a program across multiple jurisdictions creates three types of challenges: legal, technical, and managerial. Managing multijurisdictional privacy requires local addenda to the policy, local case managers, and central coordination for cross-border matters. How to ensure cross-border transfer of complaint data? We use SCCs, encryption “in transit” and “at rest”, pseudonymization and data minimization, as well as technical measures for Schrems II (key management in the EEA, provider’s lack of access to the keys).

ROI and performance metrics

The assessment of ROI for implementing a whistleblowing system is based on the following metrics:

• cost‑per‑case, time‑to‑resolve, time‑to‑acknowledge;
• % of confirmed complaints and repeat incidents;
• prevented loss: avoided fines, losses from fraud, legal expenses;
• indirect benefits: lower insurance costs, improved terms with correspondent banks, increased attractiveness to investors.

The cost of implementation vs savings from prevented violations in a typical PSP is recouped in 9–18 months. In one of COREDO’s cases, complaints from the front office exposed a cashback theft scheme; the prevented loss in the first six months exceeded the budget for a three‑year subscription to the SaaS platform.

COREDO case studies: neobank and PSP

Case study: implementation in a neobank. The company operated in several EU countries and in the United Kingdom, serving millions of customers. The goal was a single reporting system for employees, as well as an external channel for customers and partners. Scaling the whistleblowing system across the international group required decoupling local legal particularities from centralized case management. COREDO implemented a SaaS solution with an on‑prem evidence archive, E2E encryption, RBAC, integrations with HRIS and TM, and an ML module for prioritization. The board of directors received quarterly KPI reports, and «tone from the top» lowered barriers to reporting. As a result, time‑to‑resolution fell by 47%, and the % of substantiated complaints stabilized at a healthy 32–38%.

Case study: a PSP licensed in the EU with operations in Dubai and Singapore. Regulators expected strict oversight of contractors and third‑party risk. COREDO developed a corporate policy, connected an external third‑party complaints channel, set up chain of custody, e‑discovery, and procedures for cooperation with external investigative authorities. In one incident an internal complaint led to an AML escalation and the correct filing of reports with the FIU. The regulator’s review concluded without sanctions.

C-level liability in the absence of a system

Legal risks when there is no complaints system include sanctions for non‑compliance with the EU directive, refusal or restriction of a license, increased regulatory scrutiny and tougher terms from payment partners. Legal liability of C‑level executives for the absence of a complaints system is not theoretical: in several countries leaders may face administrative liability. Employment law and protection against employee reprisals cover dismissal, demotion, harassment and indirect sanctions; a non‑retaliation policy and employee protections must be documented and applied in practice.

Criteria for choosing a provider

Recommendations for selecting a platform provider for complaints:

• compliance with ISO 27001 and SOC 2 Type II, independent audits, pentest results;
• end-to-end message encryption, secure drop, protected forms, no tracking;
• audit log, integrity control, immutable storage of critical artifacts;
• flexible RBAC model, segregated duties, delegation without revealing the informant’s identity;
• API integrations with ERM/CRM/HR, SSO, SCIM;
• transparent DPAs, list of subprocessors, options for data in the EEA, Schrems II compatibility;
• SLA for availability and time-to-acknowledge, clear total cost of ownership.

Technical choices: SaaS vs on-premise. For most fintech startups SaaS is more practical due to speed, cost, and continuous updates. Banks, exchanges and custodians often choose on-prem or hybrid.

Interaction with the regulator: roles

Roles and responsibilities: DPO: data protection, DPIA and cross-border transfers; CCO: methodology, triage and engagement with regulators; CRO – embeds the results into the risk map; CTO – security and integrations; internal audit: independent review of effectiveness and fraud investigation. Board oversight: a mandatory part of corporate governance.

Issues of engagement with EU regulators and national authorities are resolved through protocols: when and how to escalate, who makes contact, which notification templates are used. European Banking Authority reporting requirements and EBA Guidelines help set the structure. FCA expectations on whistleblower protection in the UK are useful to incorporate even for firms operating only in the EEA – it improves discipline.

Anonymous vs Identified

Anonymity and pseudonymization of reports increase willingness to report, especially in hierarchical cultures or in distributed teams. The advantages of anonymity – more signals, less fear. Drawbacks: difficulty asking clarifying questions and the risk of abuse. A practical compromise: an anonymous channel with the option for two-way communication, pseudonymization in case management, and a clear filter for ‘noisy’ signals. A non-retaliation policy also applies to identified reports; this is an important marker of maturity.

Company integration and licensing

Registering a legal entity in the EU: the impact on compliance becomes apparent immediately. When opening bank accounts, obtaining licenses (payment services, forex, crypto), as well as when expanding into the UK, Singapore or Dubai, regulators and banks expect to see not only AML/KYC‑policies but also a functioning complaints system. The AML and corporate support services provided by COREDO include linking whistleblowing with sanctions policies, anti‑corruption, compliance risk management, and corporate ethics.

Preventing Repeat Violations

Preventive measures and reduction of repeat violations depend on proper “closing the loop”: root cause analysis (root cause), action items, implementation controls and their verification by internal audit. Change management (change management) when implementing new controls and communications with employees reduce resistance and improve adoption.

• time‑to‑acknowledge and time‑to‑resolution;
• % of confirmed complaints and depth of root cause analysis;
• share of complaints that led to changes in policies/processes;
• employee awareness level, training coverage;
• ROI metrics: cost‑per‑case, prevented loss, time‑to‑resolve.

Forensics: evidence in court

Record-keeping and storage of evidence in accordance with the law: a foundational discipline. Internal audit and fraud investigations rely on the chain of custody, version control, hash sums, storage in secure containers, and segregation of access. Forensic investigations into internal breaches and e-discovery prepare the company for litigation; precise procedural logic increases the chances of a successful defense.

Timeline and stages of a startup and a mature group

Timeline and stages for implementing a complaints system for a fintech startup:

• Weeks 1–2: diagnosis, DPIA, architecture.
• Weeks 3–6: policy, contracts, SaaS configuration, integrations.
• Weeks 7–8: training, pilot, launch, short audit.

For a corporate group:

• Weeks 1–4: group framework, local addenda, DPIAs and TIAs.
• Weeks 5–10: integrations, migration from local “inboxes”, training and communications.
• Weeks 11–16: pilot in key countries, scaling, preparation for external audit.

How COREDO helps

At COREDO we cover the entire cycle: from choosing a provider and building processes to integration with AML/KYC and preparation for regulator inspections. The COREDO team has delivered projects in the EU, Czechia, Slovakia, Cyprus, Estonia, the United Kingdom, Singapore and Dubai; this helps account for local nuances and partner bank requirements. For neobanks and PSPs a package is available: policies and regulations, DPIA and Schrems II compliance, integrations with HR/ERM/TM, training, a KPI dashboard and an annual effectiveness audit.

Recommendations for C-level executives on one page

– Assign ownership at the board level and designate responsible persons (DPO, CCO, CRO, CTO).

– Ensure a multichannel approach: internal and external channels, anonymity, two-way communication.

– Adopt a non‑retaliation policy and real protections for EU whistleblowers.

– Integrate the system with AML/KYC, HR and ERM; set up automation for triage and SLAs.

– Conduct a DPIA, configure cross-border transfers per Schrems II, data minimization and pseudonymization.

– Set up an audit log, integrity controls, chain of custody; prepare e‑discovery.

– Choose a provider with ISO 27001/SOC 2, E2E encryption and a clear DPA.

– Introduce KPI and ROI metrics; run a pilot and regular external and internal audits.

– Build a communication strategy and regular training; remember third parties and contractors.

– Keep a response and business continuity plan ready; update measures after each case.

Conclusions

Whistleblowing is not a mere box‑ticking requirement under the directive, but a management tool that protects licenses, turnover and reputation. Companies that take AML, KYC, data protection and complaints systems equally seriously gain in decision‑making speed, control quality and market trust. In a multi‑jurisdictional growth environment — from the EU to Singapore and Dubai — a unified, technological and legally sound whistleblowing program becomes a condition for scaling.

I support transparent, effective systems that bring benefits to business and people. If you are preparing to register a legal entity in the EU, aiming for a new financial license or want to strengthen corporate governance, embed whistleblowing into the architecture from day one. COREDO’s practice shows: a properly designed and honestly implemented program pays off, reduces risks and makes the company stronger – regardless of jurisdiction and stage of development.

I have been building COREDO since 2016 as a place where entrepreneurs receive not only company registration and licenses, but a comprehensive risk management strategy. During this time the COREDO team has implemented projects in the EU, the United Kingdom, the Czech Republic, Slovakia, Cyprus, Estonia, Singapore and Dubai and sees a common pattern: sustainable international growth is impossible without a risk-based approach (RBA) embedded in the process of registration, licensing, AML compliance and operational management.

My practical focus:

Risks of international company registration

AML Compliance: from KYC/CDD to onboarding

• the process of client identification and verification (e-KYC, biometrics, document verification and trusted registers);
• verification of ultimate beneficial owners (UBO), including complex ownership structures and circumvention schemes (shell companies);
• PEP screening and sanctions lists (OFAC, EU, UN) and sanctions control with regular updates;
• source of funds and source of wealth, as well as assessment of counterparty and third-party risk (vendor Due Diligence).

The key to effectiveness is implementing RBA in AML processes.

Risk-based approach to onboarding

I start with a risk heat map for the product line and geography. Then I form rules:

1. initial assessment of the client’s profile (inherent risk): country, industry, product, onboarding channel, type of transactions;
2. assessment of control effectiveness: data quality, verification, sanctions filters, triggers;
3. calculation of residual risk, determination of the level of checks (CDD or EDD), configuration of limits and thresholds.

Risk matrix: building and calibration

Risk matrix for a legal entity in the EU

I use sources: requirements of AMLD5/AMLD6, EBA guidelines, local FIU rules, Wolfsberg practices. I define the risk taxonomy: customer, product, geographic, distribution channels, operational and regulatory. I assess probabilities and impact using probabilistic models and scenario analysis, and include stress-testing for high-risk segments.

Risk matrix for an international group

In an international group I maintain common principles and local adaptation. The group level sets the baseline risk appetite and minimum KYC standards/CDD/EDD. Subsidiaries in Estonia and Cyprus inherit the matrix but receive local weights and data sources. In the UK I add FCA emphases, in Singapore – MAS, in Dubai, VARA. This model preserves comparability of metrics and covers multi-jurisdictional risk.

Client risk scoring and residual risk

I set the formula:

Risk Score = Σ(weight_i × factor_i)

where factor_i are normalized values for country, product, channel, customer profile, counterparties and transactional patterns. For residual risk I apply the model:

Residual Risk = Inherent Risk × (1 − Control Effectiveness)

Control effectiveness is calculated based on backtesting results, precision/recall and FPR for monitoring rules.

I use Explainable AI so the model’s transparency holds up in an audit. The COREDO team performs calibration, comparing ROC/AUC and the alerting economics, and adjusts threshold optimization taking into account the cost of errors and investigation resources.

Thresholds for moving a client into high risk

I rely on risk appetite and operational capacity. Above the critical threshold the client moves into the elevated risk segment and receives EDD: an expanded document package, an in-depth analysis of source of wealth, additional sanctions and PEP checks, limits and enhanced monitoring. For low-threshold clients the thresholds are softer, SLAs shorter, but with control of transactional anomalies.

RegTech: data lineage and Explainable AI

Automation delivers the greatest impact when the business owns its data. I implement normalization and consolidation of data from different jurisdictions, ensure data lineage, build unified reference directories and data quality controls. As RegTech layers I use graph analytics and entity resolution to uncover hidden connections and structures, machine learning to detect anomalies, and orchestration of investigations in case management.

Data sources for the risk matrix

Transaction monitoring and false positives

Orchestration of investigations in GRC

How to manage the board of directors’ risks

The strategy begins with risk appetite. The board approves risk limits, target KRIs, and the budget for controlled automation. Then I document roles and responsibilities: risk owners in business lines, compliance as the second line of defense, internal audit as the third. I regularly prepare risk reporting for management and the board of directors with a heatmap, incident trends and control economics.

Structure of the risk-oriented approach

Documentation, control and audit testing

Change management

I maintain regular trainings on AML, scenario analyses and working with systems. Change management includes the approval process for new products (compliance by design), migration to the cloud or on-premise, TCO analysis and scalability for multi-jurisdictional business.

COREDO cases: international launches

One of our recent projects, Licensing of a crypto service in Estonia. The COREDO team built a risk matrix based on AMLD5/AMLD6, integrated e-KYC and graph analytics for UBOs, included PEP and sanctions lists, and configured EDD for high-risk clients. We demonstrated a mature RBA to the regulator and agreed on an internal control plan and regular testing.

The economics of compliance: ROI and TCO

Roadmap for implementing RBA in 90 days

First 30 days: diagnostics.
I document the risk appetite, build the initial risk matrix, describe KYC/CDD/EDD, assess data quality and sources, create an automation plan and quick wins. Meanwhile the COREDO team configures basic sanctions and PEP processes and prepares policy templates.

Days 31–60: design and pilot.
I run risk scoring, integrate onboarding and transaction monitoring, enable case management and the escalation matrix, configure KRI dashboards. We carry out backtesting, threshold tuning and train the investigations team.

Days 61–90: production environment.
I expand rule coverage, introduce regular control testing, approve risk reporting to the board of directors, finalize the audit trail and the SAR/FIU procedure. After that, quarterly calibrations and an annual scenario analysis with stress tests.

Questions from leaders: recommendations

How to align risk appetite and the risk matrix?

How to assess third-party and vendor risks?

How to adapt the risk matrix to EU and Asian legislation?

How to manage false positives in transaction monitoring?

What resources are needed at the RBA implementation stage?

A reliable partner for complex challenges

I build COREDO as a partner that takes on not only company registration and obtaining licenses, but also real responsibility for risk management. When a company enters a new market in the EU, Singapore, the UK or Dubai, I provide a structured RBA: a risk matrix, effective KYC/CDD/EDD, automated monitoring, GRC integration and measurable reporting. This approach creates resilience to regulatory requirements, increases the trust of banks and investors and accelerates scaling.

Over ten years of work I regularly hear the same request from capital owners and their managers: give a structured and practical approach to AML compliance in Luxembourg so that a family office can grow calmly, open accounts and conduct transactions unhindered in Europe, Asia and in the CIS markets. I built COREDO in 2016 as a comprehensive support platform: from company registration and obtaining financial licenses to AML consulting and audit support. Today I summarize our approach to anti-money-laundering compliance in Luxembourg – the center of the European private banking industry and family capital.

Family office in Luxembourg and AML

The key question is whether family offices must be registered as financial institutions in Luxembourg. The answer depends on the actual services: investment advisory to third parties, asset management, trust administration, company formation and provision of a registered address (TCSP activity): all of this can bring the office under CSSF supervision and impose anti-money laundering obligations on family offices. Even the single-family model falls under Luxembourg’s anti-money-laundering legislation if it performs functions classified as “obliged entities” under the AML law (for example, the formation of trusts and holding structures).

Regulatory framework: laws and standards

Anti-money laundering legislation of Luxembourg is based on the Law of 12 November 2004, which implements AMLD5 and AMLD6 and takes into account the recommendations of FATF. The role of the CSSF in AML for a family office is critical if the office falls under supervision as a PFS: the regulator publishes CSSF recommendations on AML, circulars on internal control, KYC/EDD procedures and risk management.

Financial intelligence – Cellule de Renseignement Financier (CRF), the national FIU. Offices file mandatory SAR reports in Luxembourg to the CRF when suspicious transactions are identified. EU sanctions lists, OFAC and global sanctions screening become part of daily screening. At the same time GDPR and data retention requirements, CRS and FATCA for the exchange of tax information, as well as DAC6 – for reporting on cross-border tax arrangements, affect compliance design.

Family office AML obligations

COREDO’s practice confirms: a strong AML framework is built around four pillars: KYC, risk assessment, monitoring and reporting.

• Know Your Customer policies. We build KYC requirements for a Family Office in Luxembourg around real processes: identification, verification, document collection, address confirmation, checking source of funds and source of wealth (SoF/SoW). Which documents are needed for KYC of a private investor in Luxembourg: passport/ID, address, tax residency declaration, confirmation of source of funds (sale of a business, dividends, inheritance), corporate package for structures.
• Ultimate Beneficial Owner (UBO) verification for a family office. Analysis of ownership and beneficiary chains, cross-check with the central UBO register (RBE), documenting control links and trust agreements. We use graph databases to accelerate analysis of complex structures and reduce errors.
• PEP screening for the family office and sanctions screening. Integration of sanctions lists screening into family office processes: EU, OFAC, HMT, as well as PEP screening and PEP data sources. We implement risk scoring and review frequency by risk classes.
• CDD and EDD for the family office. Basic Due Diligence (CDD) for low and medium risk and enhanced due diligence (EDD) for complex cases: complex trust structures, offshore chains, PEP status, high-risk geographies, unusual flow patterns. When to apply enhanced due diligence (EDD) — family office cases: entry of a high-risk partner into a private deal, investments through an opaque SPV, large transactions with intermediary funds.
• Transaction monitoring procedures for a family office in Luxembourg. Setting thresholds for SAR and criteria of suspiciousness in Luxembourg, AML risk scenarios in private investments (back-to-back loans, prepayments without commercial basis, atypical circular payments, closing a deal through an opaque crypto exchange wallet), documenting decisions and escalation.
• Requirements for internal control and AML policy. Policies and procedures, risk appetite and risk matrices, client risk assessment and grading (risk scoring), onboarding regulations for high-net-worth individuals, role responsibilities: compliance officer/MLRO, secondary roles RC/RR (if applicable), DPO and their interaction.
• Requirements for maintaining a register of beneficiaries in Luxembourg and retention: retention and archiving of KYC documents for 5–10 years depending on status, data storage requirements and retention periods in AML procedures, segregation of access to data.

How to implement AML in a family office

Our experience at COREDO has shown that a successful program is built on a clear logic: «diagnosis – design: implementation – improvement».

• Diagnosis. Assessment of the business model, mapping of products and channels, inventory of jurisdictions, gap analysis against AMLD5/AMLD6, CSSF guidance and FATF. Registration of the family office and AML risks are evaluated from the start, including «when a family office falls under AML regulation in Luxembourg».
• Design. Development of an AML policy and internal controls (internal controls), KYC/EDD procedures, risk assessment at the client, counterparty and transaction levels, scenarios for a transaction monitoring system, integration of AML into corporate governance and regulatory notifications and timelines.
• Implementation. KYC automation: OCR, APIs and integrations; electronic client identification (eID) and AML; connecting tools for sanctions screening, KYC providers and data aggregators; SIEM setup for event logging; incident response procedures and an AML crisis plan.
• Improvement. Metrics for AML program effectiveness (KPIs), evaluation of ROI from implementing AML technologies, cost-benefit analysis of compliance, management of false-positive alerts and handling false positives, regular horizon scanning of regulatory changes and adaptation of the AML policies of the family office.

Technologies: RPA, AI and graph analytics

The solution developed at COREDO for one of the European offices demonstrated how the move from manual KYC to RPA/AI solutions in family offices reduces onboarding time from weeks to days. We integrated OCR for passport recognition, APIs to registries and sanctions lists, a workflow engine for escalations and digital approvals.

The use of KYC platforms in a family office: the economic justification is measured by a combination of indicators, a TCO breakdown (licenses, integrations, support), reduction in verification time, reduction of operational errors and improvement in SAR quality. A cost-benefit analysis (ROI) of implementing AML technologies in a family office provides a clear picture when scaling.

GDPR and AML: data and privacy

Data privacy vs AML: a frequent source of questions. The impact of GDPR on AML procedures of a family office requires clear legal bases for processing (legal obligation, public interest), data minimization, limited access and logging. The roles of the DPO and compliance officer in the family office structure synchronize privacy and AML processes: access matrices, DPIA for new technologies, retention and scheduled deletion.

Reporting and interaction with the CRF and the CSSF

Mandatory SAR reports in Luxembourg are filed with the CRF when a transaction or client behavior meets the criteria for suspicious activity. We configure rules for detecting suspicious activity (SARs) by jurisdiction, counterparty type, atypical amount/frequency and source of funds. Internal investigations and interactions with the CRF in Luxembourg are documented with checklists so that every decision has supporting rationale and a timeline.

Preparing for CSSF AML audits in a family office includes sample testing, walkthroughs of KYC files, checks of sanctions screening and transaction monitoring logs. The COREDO team has implemented ready-made playbooks for inspections: who is responsible, which reports we export, how we document remediation.

Funds, M&A and correspondent banking

AML policy for private investment structures of family offices covers SICAR, SIF, SPF and SPV chains. The practice of due diligence on investor onboarding requires validation of SoF/SoW, verification of powers of attorney and trust structures, vendor due diligence for managers and advisers (AML due diligence for managers and asset managers of family offices). Compliance control when accepting new family assets and structures prevents subsequent account freezes.

AML control for cross-border private deals and M&A takes into account DAC6 triggers, sanctions risks, CLS windows, escrow schemes and PPAs. Managing the risk of de-validation of counterparties and correspondent banking is important for the ability to execute large transfers: banks expect transparency on UBO and payment chains, pre-agreed KYC packages and CRS/FATCA statuses. De-risking scenarios and loss of banking access for family offices often arise from inconsistencies in KYC and sanctions screening: we minimize such scenarios by proactive preparation and cooperation agreements with banks and intermediaries.

COREDO case studies: how we build compliance

• Case: implementation of an AML program in a European family office. The client, a multi-family structure in Luxembourg managing private funds (SIF) and direct investments in the EU and Asia. We conducted a risk assessment, classified clients, implemented KYC/EDD procedures, integrated sanctions screening and a transaction monitoring system. During the first quarter onboarding metrics improved, SAR processes received clear criteria and a timeline, and the CSSF review passed without remarks.
• Sanctions case: integration of OFAC and EU sanctions filtering into investment committees. The COREDO team set up pre-trade screening and post-trade monitoring, defined threshold events for escalation. The office implemented instant “stop-list” rules upon sanctions updates and graph analytics for indirect ownership.
• Automation case: transition to RPA/AI in KYC. Implementation of OCR and APIs to registries, workflows for EDD, automated risk scoring. ROI manifested in reduced manual work, fewer false positives and faster approvals without compromising quality.
• Audit case: preparation for a CSSF inspection. We conducted a pre-audit, trained staff, updated UBO registers, and worked through a SAR case study. Auditors noted the maturity of processes and control points.

Anti-money laundering outsourcing for family offices

AML outsourcing for family offices gives access to expertise, accelerates the start, reduces CAPEX on technology and lowers the risk of missing regulatory changes. I always note that outsourcing compliance functions and responsibility are different things: managers retain fiduciary duties and legal responsibility for AML violations.

Metrics and cost of compliance

Pricing of compliance services for family offices, cost benchmarks and ROI depend on the office model, geography, number of counterparties and transaction volume. Costs are made up of licenses for screening and transaction monitoring systems, integrations, training and regular audit samples. I look at AML program effectiveness metrics: onboarding time, share of EDD cases, level of false positives, incident response speed, completeness of KYC files, quality of SARs and results of external reviews.

AML Readiness Roadmap

• Days 1–30: legal qualification of activities, gap analysis against AMLD5/AMLD6 and CSSF, risk assessment, design of policies and roles, selection of a KYC/sanctions provider, data plan taking GDPR into account.
• Days 31–60: implementation of KYC/EDD procedures, integration of sanctions screening, basic rules of transaction monitoring, staff training, launch of SAR workflow, registration of processes for maintaining a central UBO register.
• Days 61–90: optimization of thresholds and scenarios, configuration of CRF reporting, CSSF audit test, stress test of the crisis plan, finalization of KPIs and dashboards, approval of regulatory notifications and timelines.

This roadmap is universal yet flexible. The COREDO team can adapt it for family offices of any complexity — from single-family offices to multi-level structures with funds and international SPVs.

Questions of owners and managers

• AML requirements when accepting investment funds in a family office. We verify the source of funds, reconcile amounts and sources with the investor’s profile, check transactional paths, and apply EDD in complex cases.
• Registration of beneficial owners and central UBO register. We reconcile data with corporate documents, trust agreements, and update records upon changes.
• CRS and FATCA impact on reporting. We synchronize KYC collection with tax forms, correctly determine tax status, and introduce control dates.
• impact of EU sanctions and international lists on family office investment decisions. The investment committee receives a sanctions report prior to a transaction and post-trade monitoring, with reporting to compliance.
• Counterparty checks (vendor due diligence). We use provider risk scoring, verify licenses and regulatory status, and analyze media risks and court records.

Culture of compliance and accountability

Legal liability of family office managers for breaches of AML, AMLD5 and AMLD6 compliance: a matter of personal and institutional risk. I always place a culture of compliance at the core: AML training and personnel testing, incentives and personal accountability of managers, regular refresher sessions and knowledge checks.

Role structure of compliance in a family office: clear responsibilities, independence of second-line functions, access to the board of directors and the investment committee. Integration of AML into corporate governance strengthens the office’s position vis-à-vis banks and the regulator.

What COREDO provides and when to contact us

Sometimes a targeted consultation is enough to set up risk assessment or SAR criteria. Sometimes a full project is needed to move to automation, configuring a transaction monitoring system, selecting providers and training the team. COREDO’s experience confirms: consolidating all these tasks into a single project and unified procedures produces a multiplied effect – fewer mistakes, transparent processes and a single logic for audits.

We handle company registration issues in the EU, the Czech Republic, Slovakia, Cyprus, Estonia, the United Kingdom, Singapore and Dubai, support Licensing (crypto, payments, forex and banking), build AML processes and prepare for inspections. This set of competencies allows a comprehensive view of AML: with an understanding of licensing, tax transparency, CRS, DAC6 and banking realities.

Conclusions

Luxembourg places high expectations on compliance, and that is good for Family Offices that want to operate long-term and with peace of mind. AML for Family Office in Luxembourg: not a set of formalities but an operating system: KYC/EDD, monitoring, SARs, sanctions, GDPR, CRS/FATCA and corporate governance. When this system works, banks trust it, deals close on time, and the regulator sees maturity.

I built COREDO as a partner that holds this complex together with a single logic and brings processes to fruition. If you are looking for compliance for a Family Office that withstands CSSF inspections and CRF requests, while accelerating business,, the COREDO team is ready to step in: we’ll assess risks, develop solutions and scale them together with the growth of your capital.

In recent years «beneficial ownership transparency» has ceased to be a narrow compliance term and has turned into a board-level topic. By 2026, against the backdrop of the EU AML package 2021–2026, the tightening of AMLD6 and global pressure from the FATF, companies, banks and payment providers are restructuring processes as if oversight will become total tomorrow.

My experience has shown: those who do not fight the trend but design business processes with UBO realities in mind come out ahead. EU beneficial owner registers, UBO registration rules when forming a legal entity in the EU, information exchange between jurisdictions: all of this has ceased to be «paper» bureaucracy. It is the very core of the operating model on which access to banking services, onboarding speed, the ability to obtain licenses and expansion into new markets depend.

Who is a UBO and why are thresholds needed?

Complex ownership structures and UBOs: my daily reality. Trusts and foundations, nominee shareholder arrangements and nominee directors, remnants of historical mechanisms like bearer shares (which are de facto prohibited), these are all layers that compliance peels away one by one. The practice of COREDO confirms: if a structure looks “too neat”, the bank will immediately raise the bar: enhanced due diligence (EDD) is inevitable.

UBO Registers 2026

UBO Registers and the Fight Against Money Laundering

COREDO’s practice confirms: a UBO register and information exchange between jurisdictions via TIEA and MLA are not theory but a tool for «rapid tracing» of control, especially in M&A transactions and when entering new markets. We regularly see how open-access registers vs restricted-access ones differently affect the speed of banks’ Due Diligence of UBOs and the risk of de-risking clients from offshore jurisdictions.

How banks verify UBOs in offshore jurisdictions

KYC and UBO: the combination without which you won’t be able to open an account or keep correspondent banking relationships. Bank UBO due diligence includes checking UBOs in offshore jurisdictions: banks use methods to verify beneficiaries through registers, requests to CSPs, independent sources, sanctions regimes and lists, PEP screening and adverse media. When a structure includes trusts and foundations, beneficiary verification for trusts and foundations requires a named breakdown of beneficiary classes and protector roles.

Requested documents and evidence

How do banks verify UBOs in offshore jurisdictions? At the core is a chain of documents: articles of incorporation, shareholder registers, trust declarations, director appointment minutes, certificates of good standing, CSP letters about nominee structures, and confirmations of the renunciation of bearer shares. Which documents prove the UBO in offshore jurisdictions? It always depends on the jurisdiction, but the single principle is the same: documentary continuity from the legal entity to the ultimate beneficiary with verified identity.

ETL pipeline and graph databases

Automating UBO checks for banks is impossible without integrating UBO registries into banks’ KYC pipelines. API tools for accessing UBO registries, APIs for exchanging registry data and real-time screening of UBO registries provide an advantage in time to onboard and reduce false positives/false negatives in checks. The solution developed at COREDO for one of the partner banks built an ETL pipeline for UBO registries with data quality validation, storage of data provenance and multi-stage source verification.

Graph analysis of company ownership and link analysis for detecting UBOs is my favorite part. Graph databases (for example, Neo4j) make it possible to visualize chains of dozens of entities and detect fraud analytics and shell structures. Machine learning helps with entity matching and fuzzy matching, and blockchain for storing provenance data improves audit immutability. Such a stack reduces MTTR on compliance cases and increases TPR with controlled FPR: metrics that CFOs understand without translation.

Metrics and ROI of AML technologies

Any technology is worth exactly as much as the savings it delivers or the risk it reduces. The costs of implementing UBO procedures in a bank and the compliance cost per customer should be compared with ROI metrics: reduction in time to onboard, decrease in operational hours spent on repeat requests, reduction in the number of SARs (suspicious activity reports) without loss of quality, and increased case throughput. The COREDO team implemented an ROI calculation model where we link the operational scalability of AML processes to business volume and correspondent relationship uptime.

Tuning of transaction monitoring rules and algorithms for prioritizing UBO checks helps eliminate bottlenecks in compliance queues. Compliance automation: RPA and workflows create repeatability and version control of playbooks. When the task is scaling AML processes for multinational companies, unified data quality control and data reconciliation (entity resolution) between systems deliver the real economies of scale.

Regulatory framework: standards and penalties

The UBO register and sanctions lists are a pairing that banks check daily. The bad news: sanctions regimes are updated unevenly; the good news: UBO monitoring practices in banks for 2026 already incorporate adverse media and PEP flags into unified screening frameworks. COREDO’s practice confirms: companies that document data provenance and best practices for documenting UBO sources more easily meet regulatory inquiries and respond to audits without stress.

COREDO case studies: solutions to complex challenges

First case: a fintech group entering the EU through a payment services license in Cyprus. The client came with a complex ownership structure involving a trust and two holding companies in different Asian jurisdictions. The COREDO team built an ownership graph, assessed the reliability of UBO data, and prepared compliance playbooks for UBO checks. Result – Licensing was completed on time, and the acquiring bank reduced time to onboard by 40% thanks to a pre-agreed document package and an EDD dossier.

Second case, a crypto provider opening an office in Estonia with subsequent expansion to the UK and Dubai. Registering UBO when forming a legal entity in the EU required alignment with the FCA’s AML registration requirements and with VARA rules in Dubai. The solution developed at COREDO included automation of KYC and UBO checks via API, entity matching with EU beneficiary registries and negative news. The client avoided de-risking of clients from offshore jurisdictions, as the banking dossier contained justification of control and a renunciation of nominee structures.

Third case: M&A with an offshore target asset and correspondent banking risks. We performed due diligence on the M&A involving an offshore target, built link analysis, identified nominee owners at the level of the second holding and proposed a restructuring to fall below the 10% UBO threshold in the EU with disclosure of the actual controller. This removed the risk of the deal being blocked by correspondent banks and reduced the cost of insuring representations and warranties.

Preparing a company for a bank UBO request

First – an ownership structure map showing all beneficial interests. Include shareholdings, control rights, shareholders’ agreements, trust documents and confirmations of the roles of protector and settlor. Second – a KYC package for each UBO: proof of identity, address, source of funds confirmation, PEP status and adverse media results. Third – a policy for monitoring changes in ownership structure and UBOs with an SLA for data updates and procedures for notifying the bank.

How to avoid mistakes when declaring UBOs? Do not rely on generalizations and “umbrella” formulations. Specify thresholds, disclose concerted actions and avoid nominee terminology without explanations. If foundations and offshore legal structures are present: attach legal opinions on the nature of control and beneficial interest, as well as letters from the CSP. At COREDO we implement checklists that minimize the risk of bank rejections.

Registry data quality: normalization

Integrating UBO registries into banks’ KYC pipelines via API increases speed. Still, do not forget about access control and personal data protection: set up a lawful basis for access to UBO data and an access revocation procedure. In some jurisdictions, part of the data is available only upon request from authorized persons – the COREDO team prepares such requests in advance and factors in a buffer in project plans.

Compliance: What to monitor at the C-level

Best practices for UBO verification for C-level: regular reports with performance and risk metrics. Include MTTR for compliance cases, FPR/TPR for screening, time to onboard, the number of cases in EDD and the share of structures with trusts and nominees. Add a cost-benefit analysis of implementing UBO registries and ROI metrics: reduction in cost per client, preserved correspondent relationships and the speed of opening bank accounts.

Practical steps for the CFO when assessing UBO risk: classify jurisdictions by EDD complexity, create a catalog of CSPs and company formation agents with a reliability rating, and create a map of sanctions linkages. The COREDO team implemented an owner risk-scoring model for a multinational client, where machine learning and graph features improve the accuracy of prioritizing UBO checks and reduce the load on the EDD team.

Linking the UBO to the actual operation

COREDO’s practice confirms: early alignment of UBO and licensing requirements saves weeks.

In Asia and the Middle East, the differences are significant. In Singapore, MAS emphasizes actual control, while in Dubai VARA and local regulators require clear documentation of ownership. In the Czech Republic, Slovakia, Estonia and Cyprus the processes are formally straightforward, but banks supplement them with their own EDD. The COREDO team builds a unified package that equally convinces the registering authority and the bank officer.

Outsourcing vs in-house: sustainable model

Shared utilities and centralized registries: a logical future. Corporate registries and interoperability will reduce the costs of duplicated checks, but there’s still a way to go before unified standards. For now, the winner is the one who can link different sources, maintain entity resolution and support real-time screening where it is critical for payments and correspondent settlements.

Monitoring changes in ownership structure

Monitoring changes in ownership structure and UBO is a process, not an event. I set an SLA for data updates: changes to the EU register of beneficial owners and to bank dossiers within specified business days. Include triggers: new shareholders, director changes, emergence of nominee services, trust relocation, material M&A transactions.

Banks value transparency and predictability. If a company announces a restructuring in advance and provides a package of documents, the risk of account freezes is noticeably lower. In one project, a solution developed at COREDO automated bank and registrar notifications via RPA, reducing the update cycle from weeks to days.

Common mistakes: how to avoid them

The first mistake: underestimating nominee structures and front owners. The bank will spot it if the beneficial owner is “hiding” behind a service company without a business reason. Second: incomplete information on trusts and funds: ignoring the protector, failure to provide a letter renouncing bearer shares, lack of description of beneficial interest. Third — lack of a documented source of funds for the UBO.

How to reduce onboarding time during UBO checks? Assemble the package in advance, use BODS standards and formalized structure diagrams, note sanctions and PEP checks, attach an adverse media report. Our experience at COREDO has shown that a proactive approach reduces the number of follow-up requests from the bank by 30–50% depending on the jurisdiction.

Conclusions: what to do next

COREDO was created to connect clients’ strategies with real regulatory practices in the EU, the United Kingdom, the Czech Republic, Slovakia, Cyprus, Estonia, Singapore and Dubai. I see how well-designed UBO processes, supported by technology and clear playbooks, turn the “pain” of compliance into a scalability advantage. Going forward, those who embed the UBO circuit into their business architecture will win: from company registration to bank onboarding and day-to-day operations.

UBO Registers 2026: public vs closed

Institutional interoperability is growing thanks to the Beneficial Ownership Data Standard (BODS) and the Open Ownership platforms, but the standard’s implementation is uneven. Where national corporate registers are synchronized with UBO records and use BODS, banks gain in time to onboard and reduce FPR without losing TPR. Below: a practical comparison.

Regulatory framework 2026: UBO checks

The regulatory map for 2026 relies on FATF Recommendations 24/25 on the transparency of legal persons and trusts, the AMLD5/AMLD6 directives and national transpositions. In the USA the Corporate Transparency Act (CTA) operates with Beneficial Ownership Information (BOI) reporting to FinCEN and access regimes for financial institutions. In the EU a horizontal AML regulation is being formed at the same time and control over the quality of registers is being strengthened, which directly affects banks’ KYC procedures and the checking of UBOs in offshore jurisdictions.

GDPR defines the lawful basis for banks’ access to UBO personal data, and this is a practical matter, not theory. Banks most often rely on Art. 6(1)(c) “compliance with a legal obligation” and Art. 6(1)(f) “legitimate interest”, supplementing them with internal DPIAs and data minimization policies. Special categories of data require a separate analysis, and for cross-border transfers, mechanisms compatible with EU standards and local privacy laws.

Practical compliance checklist for UBO checks

• Define thresholds and control: record the ownership percentage, veto rights, shareholders’ agreements and actual influence on management. Prepare a written justification of the beneficial interest and attach a legal opinion if there are gray areas.
• Record the lawful basis: specify the GDPR basis, describe the bank’s role as controller and collect consents where necessary. Add DPIA/LIAs and data minimization and retention procedures.
• Keep them up to date: set SLAs for updates in the national register and at the bank when UBOs change. Include RPA reminders and checkpoints for internal legal and finance teams.
• Prepare an EDD file: collect Source of Funds/Wealth, CSP letters, nominee agreements and confirmations of the renunciation of bearer shares. Conduct PEP/sanctions/adverse media screening in advance and attach the results.
• Log provenance: preserve sources, document versions and hash-based integrity checks. This will speed up responses to regulatory inquiries and internal audits.

How banks verify UBOs and KYC

A bank KYC pipeline for UBO is a managed sequence of steps with clear owners. I advise clients to align their internal procedure to the same logic to shorten question‑and‑answer cycles and minimize false positives/negatives.

Step-by-step KYC pipeline

• Intake and pre‑screening: collection of the questionnaire, corporate documents and an initial description of the structure. Sanctions and PEP checks are run, as well as a quick adverse media review.
• Ownership mapping: building an ownership graph up to the ultimate beneficial owner, recording controlling rights and agreements. Threshold rules of 25% and 10% in the EU are applied, taking cumulative control into account.
• Documentary verification: matching registries, certificates and nominee agreements with client and provider data. A request is sent to the CSP and a formal reconciliation with local registries takes place.
• Screening and risk‑scoring: combining sanctions, PEP, negative news and geo‑risks into a single profile. ML models support entity matching and reduce FPR as TPR increases.
• Decision and onboarding: either standard approval, escalation to EDD, or rejection with justification. Results and provenance are logged for audit and correspondents.

Roles and responsibilities are allocated in advance and by name. The Relationship Manager gathers the package and manages communication, the KYC analyst handles the structural and documentary layer, the AML/Financial Crime team performs screening and risk‑scoring, and complex cases go to EDD/SME with the final decision by the Compliance Officer. Such a matrix reduces MTTR and provides predictability for the business and the client.

KYC pipeline diagram (textual)
Client intake → Pre‑screening → UBO mapping → Documentary verification → Sanctions/PEP/Adverse media → Risk‑scoring → Decision/EDD → Onboarding/Monitoring. Each stage records provenance and SLA, and integration points with registries go via API or formalized requests.

UBO verification in offshore jurisdictions

Офшоры привлекают гибкостью и скоростью, но для банка это маркеры повышенного риска. Nominee directors and shareholders, historical bearer shares, foundations and trusts, as well as a prominent role of CSP, all of this requires combined validation and a closer dialogue with the client. Чем раньше клиент покажет экономическую логику структуры и реальный контроль, тем ниже вероятность де‑райзинга.

Рекомендации банка и типичные red flags

• Применять EDD, когда структура включает nominee arrangements, трасты без прозрачной экономической цели, или страны с высоким риском по FATF. Дополнительно запрашиваются SoF/SoW, интервью с UBO и письма от независимых юридических консультантов.
• Красные флаги: несоответствия между реестрами и документами, частые смены директоров без бизнес‑обоснования, CSP без лицензии, и негативные news о связанных лицах. Такие сигналы активируют расширенный скрининг и могут привести к отказу.

Disclosure of beneficial interest

Идентификация nominee начинается с документов и не заканчивается ими. Банки запрашивают декларации nominee, договоры оказания услуг и подтверждение полномочий, а также правовые мнения о том, кто вправе распоряжаться голосами и дивидендами. Важно показать, что номинал не осуществляет самостоятельного контроля и действует строго по инструкциям бенефициара.

Мы всегда совмещаем документальный слой с данными о поведении и транзакциях. Если фактические платежи, подписи и IP‑логи инициируются одними и теми же лицами, это поддерживает картину бенефициарного контроля. Когда наблюдается расхождение между ownership data и транзакционным профилем, кейс уходит в EDD, и банк запрашивает дополнительные подтверждения beneficial interest.

EDD for UBOs: criteria and thresholds

EDD is triggered by a combination of risk factors, and this is normal practice for offshore structures and complex ownership. Classic triggers: PEP status of the UBO or key directors, high‑risk or sanctioned jurisdictions, structural complexity with trusts/funds/nominees, and discrepancies between registers and the documents provided. In the EU banks increasingly rely on a 10% threshold for UBOs in the EU in complex structures, even if the formal general threshold remains 25%.

Standard EDD procedures are detailed and resource‑intensive, so it is better to prepare for them in advance. Extended SoF/SoW packages, bank references, tax returns, asset sale agreements and interviews with the owner—where the structure’s motivation and sources of capital are discussed—are requested. In offshore jurisdictions a letter from the CSP about the nominee, confirmation of the renunciation of bearer shares and legal opinions on trusts and foundations are almost always required.

Cross-verification of UBO registries

Reliable due diligence relies on the right mix of primary and secondary sources. National registries and trusted corporate registers form the “gold standard”, while OpenCorporates, Open Ownership, commercial aggregators and sanctions lists provide breadth and speed. Cross-verification through entity matching, fuzzy matching and reconciliation resolves contradictions and documents data provenance.

Cross-verification mechanics must be formalized and reproducible. We use entity resolution with canonicalization of names, addresses and identifiers, fuzzy matching to recognize transcriptions and aliases, and then run reconciliation against an internal “golden profile” and the client’s documents. This approach reduces MTTR and prepares the data for automated solutions and organizational audits.

Integration of registry data via ETL

A correct ETL pipeline for UBO data starts with ingestion via API and batch channels, then normalization according to BODS and local schemas, enrichment with sanctions and PEP data, and matching to already known entities. It’s important to log every transformation, store sources and versions, and also maintain re-validation on schedule and on triggers. At COREDO we additionally hash document versions and write provenance to immutable storage to simplify audit defense.

Best practice: separate the operational layer and the analytical data layer. The operational layer serves real-time screening and onboarding, while the analytical layer handles periodic reconciliation, reporting and ML training. This reduces the risk of SLA degradation and makes the system resilient to peak loads.

Automating UBO verification for banks

Integration into the KYC pipeline requires an architecture with clear SLAs and monitoring. Queueing systems, retries, deduplication and observability (tracing/metrics/logs) reduce operational risk, and graph analysis helps uncover hidden links between transactions and ownership data. In several projects, graph features produced a jump in the accuracy of detecting nominee structures without increasing FPR.

Integration of API, real‑time and ETL

APIs must meet requirements for performance, security and compatibility with the BODS standard. We use JSON schemas, OAuth2/MTLS, idempotent keys and detailed error handling with typing and recovery codes. Implementing rate limiting and queues ensures even load and predictable SLAs even during peaks.

Best practices for real‑time screening and batch reconciliation include separating data paths and independently scaling resources. Real‑time serves the “decide here and now” needs for onboarding and payments, while batch addresses “quality debt” and checks profile consistency. Regular A/B tests of rules and ML models allow reducing FPR without losing TPR.

Correspondent Banks and Sanctions

Correspondent banks assess UBO risk through the lens of their own regulatory exposure and reputational loss. If a client’s profile combines an offshore structure, weak documentation and adverse news, the likelihood of de-risking rises sharply. Strong UBO documentation and pre-agreed EDD packages: the best protection against sudden shutdowns.

Practical tips for clients

• Prepare a “correspondent folder”: sanctions provisions, UBO structure in BODS format, SoF/SoW, screening results and the contact details of the responsible person. This speeds up responses and reduces uncertainty.
• Communicate proactively: notify structural changes and regulatory news before the bank asks. This builds trust and reduces the risk of preventive de-risking.

Implementing UBO procedures in a bank

Costs consist of data licenses, integration development, infrastructure, training, and operational support. In a typical bank, average TCO in the first year includes 40–60% of costs for data and APIs, 25–35% for development and integration, and 15–25% for operational processes and training, although proportions change with scale. I strongly recommend budgeting for data quality and ongoing reconciliation, because that is where MTTR is reduced and onboarding time is shortened.

Profitability is measured through a set of applied metrics related to business value. Reducing time to onboard by 30–50%, lowering FPR by 20–35% and stabilizing correspondent relationships are direct drivers of ROI that the C-level and the board understand. For multinational companies the effect is amplified if you use shared utilities, centralized registries, and a hybrid outsourcing vs in-house model with strict SLAs and KPIs.

KPI for UBO AML checks

Quarterly targets should be ambitious but achievable. I often budget for -20% FPR while maintaining TPR, -25% time to onboard for standard cases and -15% MTTR for EDD thanks to templates and pre-checks. Such targets discipline the team and show the board of directors tangible progress.

Prepare the legal entity for the bank’s UBO request.

Proper preparation saves weeks and reduces stress for all parties. I recommend assembling three packages: corporate, beneficial and sanctions, each with versioning and provenance. Below is a consolidated checklist of documents by scenario.

Recommendations for registrations in the EU/Asia are simple and effective. In the EU, pre-synchronize the UBO record with bank onboarding and licensing, and in Singapore and Dubai arrange with the CSP the timing and format for issuing UBO documents for banks. Before submission the CFO should go through an internal checklist, ensure registers are up to date, and run a test sanctions/PEP/adverse media report.

UBO verification in M&A and transactions

UBO‑due diligence in mergers and acquisitions – это speed diligence с акцентом на контроль и санкционные сопряжения. Мы строим ускоренный граф владения, валидируем бенефициарный интерес, проверяем скрытые соглашения акционеров и оцениваем риски де‑райзинга у банков‑партнёров покупателя. Чем раньше покупатель покажет план ремедиации структуры под требования AMLD6 и корреспондентов, тем ниже скидка на риск в цене сделки.

Post‑deal мониторинг должен быть автоматизирован и связан с триггерами изменений. Смена директоров, перераспределение долей, назначение nominee или переезд траста запускают переоценку риска и при необходимости, EDD. Мы используем RPA для оповещений регистраторов и банков и графовые подписки для сигналов о новых связях в adverse media.

Practical templates for the deal

• UBO‑request list: структурированный перечень документов, включая BODS‑выпуск и карту контроля. Он экономит время юридических команд и снижает количество уточнений.
• Risk‑скоринг владельцев: модель приоритизации проверок с весами по юрисдикциям, санкциям, PEP и сложностям структуры. Она помогает фокусировать EDD там, где это действительно нужно.

Recommendations for C-level executives and owners

I’ve compiled a focused ten-point checklist to help prepare for banks’ UBO checks.

• Structure map in BODS and as a graph. Keep it current and version it for audit.
• A single UBO document package with provenance. Update it with every change and register SLAs.
• Preliminary sanctions/PEP/adverse media screening. Catch issues before the bank sees them.
• Nominee and trusts policy. Document the economic rationale and boundaries of control.
• SoF/SoW for UBO. Prepare evidence in advance and store independent confirmations.
• Data quality and entity resolution. Implement normalization procedures and reconciliation of sources.
• API integrations and RPA workflows. Reduce manual work and ensure process observability.
• Metrics and targets: time to onboard, MTTR, FPR/TPR. Link them to bonuses and performance management.
• Correspondent ‘folder’ and playbooks. Maintain trust with banking partners and reduce the risk of de‑risking.
• Remediation plan under AMLD6/CTA. Update structural arrangements for new rules and jurisdictions.

Frequently Asked Questions

Answer: UBO, the ultimate beneficial owner, controlling the company directly or through a beneficial interest. The general ownership threshold of 25% is supplemented by a 10% threshold in the EU for complex structures and high risk, as well as by analysis of de facto control beyond shareholding.

Answer: Banks compare local registers, CSP letters, corporate documents and trust agreements, then perform sanctions/PEP/adverse media screening. Most often they request a certificate of incumbency, register of members/directors, trust deed, nominee declarations, renunciation of bearer shares and confirmations of SoF/SoW.

Answer: Prepare legal opinions and nominee declarations confirming absence of independent control and demonstrate the economic rationale of the structure. If disclosure is refused, the bank will likely apply EDD or refuse the relationship, so it’s better to proactively provide the maximum evidence of beneficial interest.

Answer: The bank relies on Art. 6(1)(c) and Art. 6(1)(f) GDPR, supplemented by a DPIA and a minimisation policy. For cross-border data transfers compatible mechanisms are used and all requests and justifications of the lawful basis are logged.

Answer: Costs depend on scale, but in the first year the lion’s share goes to licenses and integrations, and thereafter the main effect comes from reduced FPR and time to onboard. In typical cases payback is achieved within a 9–18 month horizon due to OpEx savings and preserved correspondent lines.

Conclusion

Your next steps are clear and achievable. Conduct an internal audit of UBOs and update the structure map in BODS format, assemble a package of documents with provenance and set up API integrations with key registries and aggregators. If you need to accelerate the process, contact our COREDO team: we will carry out an express readiness diagnostic, share document templates and help implement the technology stack for your processes and jurisdictions.

Since 2016 I have been leading COREDO through dozens of investigations, thematic reviews and interviews with regulators in the EU, the UK, Singapore and the UAE. During that time the COREDO team has assisted clients in obtaining crypto, payments, forex and banking licenses, as well as in subsequent supervision, including high-stakes episodes: from AML investigations and sanctions issues to requests concerning cross-border transactions. This article is a distillation of practice: how to prepare the Chief Compliance Officer (CCO) and MLRO for questioning, what to expect, which rights to protect and which documents to present in order to pass the inspection professionally, maintain the regulator’s trust and controllably reduce risks.

COREDO’s experience shows: a regulatory interview is a controllable process if you start preparing in advance, ensure a transparent communications strategy and establish documentation discipline. Below is the working framework I personally use when, together with a client, I build the defence, communications and execution of supervisory authorities’ requests.

Activation of the response plan

The first signal is a request for documents, an invitation to an interview, or a supervisory notice. At this stage it is important to ensure procedural fairness: confirm receipt of the notice, clarify the scope of the inspection, agree on the timing and format of interaction, including consent to record the interview and participation of an external lawyer. The solution developed by COREDO begins with a risk triage: determining the scope of affected jurisdictions, applicable regulations (AMLD5/AMLD6, FATF, Wolfsberg), data categories (GDPR), and the list of involved roles.

Roles and responsibilities of CCO, MLRO, CEO

The rights and duties of the Compliance Officer during an inspection should be documented in writing. CCO and MLRO are responsible for the completeness of the factual part and the accuracy of references to policy, the CEO – for the company’s position and the strategy for interaction with supervisory authorities, and the board of directors for oversight and approval of key decisions, including the remediation plan and the budget for external consultants and forensic investigation.

Privilege and data protection: documents

Handling documents, observing privilege and data protection measures determine which materials are subject to disclosure and how to store them securely during a dispute. Below we will examine document production, legal hold and the practical application of privilege rules to clarify steps and minimize risks.

Documents, legal hold and privilege

GDPR: DPIA and cross-border requests

Cross‑border issues and cross‑border requests often raise GDPR compatibility questions when transferring data to regulators. At COREDO we prepare a DPIA in advance, determine the legal basis for the transfer (for example, performance of a legal obligation), and apply data minimization and encryption. Under MLAT (mutual legal assistance) we check compliance with local law and bank secrecy exceptions, and also ensure client confidentiality when multiple supervisory authorities are involved.

Preparing the CCO and MLRO for an interview

I view preparation as a multi-level program. First, we conduct interview preparation for legally significant statements: we build a structured interview protocol and template answers, and practice regulator question scenarios on sanctions, AML and KYC, SAR/STR procedures and monitoring. Then we run mock interviews and stress tests to prepare for interrogations, including roleplay scenarios and assessment of witness suitability.

Questions on AML/KYC/sanctions/transactions

Regulators often examine the depth of the risk‑based approach. We prepare responses to regulator questions about transactions: matching transactions and monitoring analytics, methods to reduce false positives, use of automated AML monitoring and machine learning in transaction monitoring. If external software is used, we present AML‑software providers and vendor screening, results of independent testing, and the monitoring and testing of AML controls.

Forensics and electronic evidence

In complex cases we engage the use of an external forensic expert and electronic examination and e-discovery, including e-mail discovery and investigation of corporate mail. We perform forensics and recovery of deleted data in compliance with the chain of custody, and carry out data handling in protected interview rooms and secure rooms, especially when the materials contain personal data or banking secrecy.

Mitigating factors and remediation

Notice of an investigation and self‑reporting is a difficult decision, but often yields credit for cooperation (voluntary disclosure strategies and credit for cooperation). In COREDO’s practice there is a case of a payment company in one of the EU countries where early disclosure and an immediate remediation plan with subsequent verification of the corrections and an independent audit of compliance‑measures allowed them to avoid a fine and be limited to an official warning.

Interaction with suppliers

Scaling the preparation process in a global company requires managing third parties and vendors during investigations. The COREDO team developed criteria for third‑party Due Diligence and supplier risk, as well as contracts with external consultants and experts, where responsibilities for confidentiality, information security and response times are clearly defined.

Compliance checklist for a regulator interview

This checklist is not an abstraction, but a distillation of our approach. Before the interview the team goes through it in full, recording execution in the incident management and tracking system (incident management):

• Confirm the scope of the review: supervisory notice, subject matter, timelines, recording format, and participation of counsel.
• Implement a litigation hold, define the legal hold scope, build a privilege log, and appoint custodians.
• Define the internal counsel vs external counsel strategy, select an approach and the boundaries of privilege.
• Conduct a gap analysis, prepare a remediation plan, and agree it with the board of directors.
• Confirm GDPR/DPIA, data transfer channels, encryption, cross‑border mechanisms, and banking secrecy.
• Organize document production: chain of custody, audit trail, document versions, and access control.
• Conduct mock interviews and stress tests, assess psychological readiness and backup witnesses.
• Form a structured response protocol and templates for the regulator reply.
• Check sanctions and AML/KYC blocks: OFAC/EU/UN, BO disclosure, SAR/STR, and automated monitoring.
• Prepare an executive summary of the investigation for the regulator and case law materials.
• Set up secure rooms/video conferences, obtain consent to record the interview, and document the risks.
• Conduct vendor screening (AML software, forensics), confirm ISO 27001/SOC 2.
• Agree media policy, D&O, escalation matrix, and BCP plans for the review period.
• Calculate preparation costs and economic efficiency, balance external consultant vs internal team.
• Set KPIs and ROI for preparation for regulatory interviews, time to resolution and recovery metrics.

Recording and Retention Policies

A records-keeping and retention policy is the foundation for the evidentiary base. We implement a retention policy and a destruction schedule with exceptions for legal hold, maintain an access log, and, as part of training, establish rules for documenting interviews and creating a transcript. Virtual interviews and secure videoconferences must meet recording requirements: obtaining consent and legal risks, storage and access in accordance with GDPR.

Pace and the economics of scaling

Preparation costs and economic efficiency — a matter not only of budget but also of decision-making speed. Analysis of costs for external consultants vs internal team allows forming a hybrid model: internal fact-gathering and preservation of privilege, external legal strategy and forensics. At COREDO we plan resources for investigations (resource planning), set SLAs for responses and rank issues by priority and risk so as not to waste time on secondary issues.

Typical question scenarios

During questioning of the AML officer (MLRO), the regulator may move on to the details of specific alerts, late escalation, or the absence of SAR/STR. Here the CCO should point to the risk‑assessment methodology, the monitoring frequency and the second‑line control function, as well as the improvements implemented after the incident. If sanctions are involved, we demonstrate checks against OFAC/EU/UN, enhanced triggers and a post‑event review.

COREDO practice cases

In one European jurisdiction, the COREDO team accompanied the questioning of the payment organization’s CCO after a series of sanctions alerts triggered on a client from a third country. We confirmed the correct configuration of the lists, demonstrated a reduction in false positives through retraining of the rules, and provided periodic monitoring reports. The outcome — an instruction to strengthen due diligence for a specific category of clients without imposing fines.

Pre-litigation dialogue with regulators

Best practices for preparing the CCO for European regulators include early pre-litigation dialogue, transparent demonstration of methodologies (AMLD5/6, FATF, Wolfsberg), a structured executive summary of the investigation and a clear reference base to policies and procedures. It is important not to argue about form, but to agree on reasonable timelines and process while protecting privilege and GDPR.

Conclusions

COREDO, after years of work in the EU, the United Kingdom, Estonia, Cyprus, the Czech Republic and Slovakia, Singapore and Dubai, has built a predictable, transparent approach that helps clients pass inspections, obtain licenses and grow. If you need a regulator engagement strategy, external legal support for an interrogation, e‑discovery or an independent audit of compliance measures, the COREDO team will offer a solution adapted to your business model and jurisdictions. I am convinced: a prepared CCO is the best argument for trust in your company and its sustainable growth.

I have been leading COREDO since 2016 and see every day how quickly the digital assets market is changing. Over the years the COREDO team has carried out dozens of projects for company registration and licensing in the EU, the United Kingdom, Singapore, Cyprus, Estonia, the Czech Republic, Slovakia and Dubai. Clients come with a variety of tasks: from creating an SPV for the tokenization of artworks to building institutional custodial infrastructure for NFTs. In this article I have compiled practical experience and strategic ideas: how to use NFTs as a financial instrument, how to manage risks, comply with MiCA, MiFID II, FATF and GDPR, and how to structure IFRS reporting so that the auditor has no questions left.

When NFTs are in a corporate portfolio

From an investment-logic perspective, NFTs and securities in the EU are different things. Security token vs non-fungible token: this is above all a difference in legal nature: a security token, as a rule, falls under MiFID II and national securities regimes, whereas an NFT is a unique digital token that may be an investment asset depending on its economic function, but does not automatically become a security. Classifying an NFT as an investment asset requires analysis of utility, rights, returns, market-making and liquidity availability.

Brands gain a new channel for audience engagement and licensing economics from NFTs. Our experience at COREDO has shown that strategic use of NFTs for brands pays off when the links between token ownership and utility are formalized in smart contracts, and IP-licensing and exclusivity issues are secured in clear agreements. Then an NFT logically becomes part of the corporate portfolio alongside tokenized lease rights, service vouchers and shares in an SPV.

NFT: a security under MiFID II?

We often use frameworks for assessing the legal nature of a token, where we apply the criteria of an investment contract (Howey test and analogies) specifically as an analytical lens: capital contribution, expectation of profit, efforts of a third party. In the EU this test is not law, but it helps structure arguments for regulators and platform compliance. COREDO’s practice confirms: when an NFT provides passive income or a promise of portfolio management, regulators may qualify such a token as a financial instrument, which brings MiFID II implications for brokers and platforms.

Tokenized securities vs NFTs: the key dividing line. If a token directly embodies a claim against an issuer, an equity share or a debt obligation, it becomes a security token subject to the full body of rules, up to prospectus requirements, provider licensing and reporting. If an NFT records access, a unique digital object or certifies a right of use without an investment component, we remain in a different regulatory zone.

Regulation of NFTs in the EU and secondary markets

Fractionalized NFTs (fractional tokens) and serial issuances with economically interchangeable properties may fall within the scope of MiCA, and in extreme cases: within MiFID II. The solution developed at COREDO: early token qualification and a compliance roadmap before launching smart contracts.

ESMA’s recommendations on digital assets complement MiCA with details on the delineation of services and investor protection. Regulation of NFT secondary markets requires transparency of fees, prevention of manipulation and manageability of listings. Monitoring for manipulation in the NFT market and combating wash trading become part of platforms’ internal controls, especially if they perform the functions of a broker or market operator.

If necessary, we launch the project through regulatory sandboxes for crypto startups in the EU to agree in advance on the approach to token functions and circulation mechanics. Interaction with regulators and supervisory authorities is critical here: it reduces the risk of the instrument being reclassified after launch.

AML/KYC: how to build compliance for NFTs

The COREDO team implemented risk‑scoring of buyers and sellers for marketplaces, sanctions filters and on‑chain analytics to detect links with “tainted” addresses.

Money laundering risks through NFTs are typical: rapid resales with inflated prices, wash trading, transactions through mixers, a high rate of order cancellations.

GDPR when processing NFT clients’ data requires minimization, justified retention periods and transparent information for the data subject.

Cross-border NFT sales and currency regulations add another layer. Our lawyers at COREDO set up cross-border compliance for buyers from Asia and the EU, aligning KYC procedures, withholding taxes and interaction with payment systems and PSPs. Banking oversight is also important: interaction with the banking system and banking supervision requires source of funds policies, invoicing standards and clear contractual documentation between the platform, the issuer and the buyer.

Royalties and licensing

Separation of rights: ownership vs right of use must be explicitly recorded in the terms of sale and/or in an on-chain link to the license. In COREDO projects we arrange IP licensing and NFT exclusivity through separate agreements, taking into account moral rights and assignment in EU jurisdictions.

NFT marketplaces and platform liability require clear rules in offers: transparency of fees, refund conditions, secondary NFT sales and fee regulation — all of this becomes a subject of attention for regulators and antitrust authorities if practices appear to restrict competition.

We insist on two-sided duplication of metadata, versioning and recording of hashes in the smart contract to prevent tampering. When IP is wrapped into an SPV and licensed via an NFT, the contractual framework links the rights holder, the custodian and the token holder.

Tokenization of art and real assets

SPV legal structures for tokenized art are a proven scheme: the assets are held by a rights‑holding company, and NFTs sell access to benefits, viewing rights, priority participation in exhibitions, or fractional rights through fractionalized NFT. Fractional ownership legal structures carry particular risks for investors: when ownership is fractionalized, characteristics of a security can sometimes emerge, which may trigger MiFID II.

SPVs and legal wrappers for art tokens are useful for managing taxes, rights, insurance and custody.

investment funds NFTs in the EU can be structured in the form of AIFs with corresponding regulation of the management company, custodian, valuer and auditor – the COREDO team has structured such funds taking ESMA and local supervision into account.

The distinctions between ICO/STO/ITO and the comparison with NFT issuance are needed to understand regulator expectations: STOs are securities; ICOs/ITOs can fall under MiCA; NFT issuance more often does not require a prospectus, but does require disclosure and compliance if investment characteristics are present. COREDO’s experience confirms that early consultation with the regulator reduces costs and speeds up market entry.

Taxes and accounting for NFTs under IFRS

The tax consequences of NFT sales in Europe depend on what is being sold: digital content, access to a service, or usage rights.

Royalty income may be subject to withholding tax in certain jurisdictions: this is taken into account when structuring SPVs and licensing agreements.

Accounting for NFTs on a company’s balance sheet (IFRS) is closer to accounting for crypto assets: they are more often intangible assets under IAS 38, except when held for trading as inventories under IAS 2.

Reporting and disclosure about NFT assets include accounting policies, valuation methodologies, liquidity and concentration risks.

Valuing NFTs for investors is built on three pillars.

The COREDO team sometimes supplements the valuation with option models for rare cases involving buyback rights.

Smart contracts: standards and insurance

Smart contracts (ERC-721, ERC-1155) and security are a central part of legal protection: bugs in code can wipe out rights, reduce royalties to zero, or open the door to an exploit.

Smart contract audits for legal protection should combine static analysis, formal verification, and testing of business scenarios: edge cases for listing, token burns, upgrades, royalties, and pauses. Blockchain code audits and formal verification reduce the risk of smart contract vulnerabilities and exploits, while digital asset insurance and loss coverage close out tail risks. Within companies we insist on corporate access control for wallets, role separation, and multi-factor policies.

Institutional custodial infrastructure for NFTs requires custodian solutions for institutional NFTs, SLAs, key recovery procedures, and controls over corporate transactions. Custody APIs and interaction standards enable integrating NFTs with ERP and accounting systems, automating transfers and tags for accounting. The COREDO team helped clients build cold‑hot‑warm storage architectures and asset movement policies aligned with auditors.

Markets and liquidity: risk control

NFT liquidity risk and exit strategies: this is the main area for the CFO. Exit strategies: listings on exchanges, OTC processes with KYC, buyback agreements and NFT options, as well as framework agreements with marketplaces for prioritized listing. Stress-testing the liquidity of an NFT portfolio models a drop in floor price, widening spreads, departure of market‑makers and regulatory shocks.

counterparty assessment and marketplaces by reputation reduces the risk of failures in settlements and delistings. The commercial model: fees, royalties, listing fees must be transparent and compatible with antitrust and competition-related risks of marketplaces — especially regarding exclusivity and restrictions on parallel sales.

Institutional players look at blockchain resilience: PoS vs PoW and energy consumption. Carbon footprint and offsetting NFT emissions are becoming part of ESG policy: we build in compensation mechanisms or choose energy-efficient networks. For collateralized deals, using NFTs as collateral (collateral) requires independent valuation, agreements with custodians and tripartite agreements with lenders.

COREDO: case studies and launch roadmap

• Legal qualification: framework ‘security token vs non-fungible token’, MiCA/MiFID II/ESMA assessment, ICO/STO/ITO comparison.
• corporate structure: SPV, IP agreements, licenses, royalty agreements, option and buyback.
• Technical architecture: ERC-721/1155 standard, IPFS/Arweave, URI strategy, on-chain provenance.
• Compliance: AML/KYC, SoF, travel rule, sanctions and export controls, GDPR, cross-border compliance.
• Infrastructure: custody, insurance, corporate access control to wallets, custody APIs.
• Taxes and accounting: VAT, transactional taxes, IFRS (IAS 38/IAS 2), disclosures and valuation models.
• Market and liquidity: listing rules, fees and royalties, OTC processes, stress testing and exit.
• Interaction with regulators: sandbox, notifications, responses to inquiries, internal reporting and best practices for internal control and reporting on NFTs.

Legal risks in EU practice

Legal disputes and case law on NFTs in the EU are still taking shape, but precedents are already setting the direction. Court precedents regarding the sale of NFTs (European cases) emphasize the importance of clear license terms, fair commercial practice and truthful marketing. Legal enforcement mechanisms in NFT fraud include asset freezes, platform notifications, interaction with custodians and cooperation with law enforcement.

Regulation of secondary NFT markets and marketplace liability require attention to the impact of MiFID II on brokers and platforms, especially when they begin to perform the functions of an organized trading venue.

DAOs as a tool for managing collections and funds have also become relevant in Europe. The role of DAOs in managing collections and funds requires aligning governance tokens and voting rights with off-chain corporate law. We increasingly use a hybrid: DAO voting logic on top of a legal entity (SPV or fund), where mandatory corporate actions are executed by a delegated director.

Payments and banking between on-chain and off-chain

Для корпоративных клиентов COREDO выстраивает мосты: кастоди для хранения, PSP для мерчанта и банковские счета для расчетов, чтобы снимать вопросы у финансового контроля и аудита.

При крупных продажах due diligence чек-лист перед покупкой крупного NFT включает KYC контрагента, проверку provenance, юридический статус IP, анализ маркетплейса, репутационные риски и страхование доставки цифрового актива.

ESG for NFT sustainability and reputation

Clients in the institutional segment increasingly include ESG criteria. Blockchain sustainability: PoS vs PoW and energy consumption affects network choice. Carbon footprint and offsetting of NFT emissions are configured through compensation programs, green certificates, and sustainability reporting. For public companies this becomes part of non-financial disclosure alongside liquidity and compliance risks.

This approach protects the portfolio and accelerates deal approvals at the level of boards of directors and risk committees.

Conclusions

NFTs have moved from an experimental status to a managed asset class where legal qualification, compliance and infrastructure are as important as creativity and community. My position is simple: if NFTs are treated as a financial instrument from the start, a business gains transparent processes, clear economics and access to institutional capital. COREDO’s experience in the EU, the UK, Singapore, Cyprus, Estonia, the Czech Republic, Slovakia and Dubai shows: a well-designed SPV structure, clear IP licenses, proper IFRS accounting and AML/KYC discipline turn NFT initiatives from a risky bet into a sustainable product.

If you plan to launch, start with legal qualification and architecture: choose a standard (ERC-721/1155), describe ownership and usage rights, resolve custody and insurance issues, define the tax model and disclose risks in the white paper. The COREDO team will help build a compliance roadmap, align the approach with regulators, audit smart contracts and integrate accounting. This will preserve your speed and provide the reliability on which long-term value is built.

Regulators are tightening requirements, customers expect instant payments, and the compliance team is overloaded with alerts. Over recent years, the COREDO team has implemented dozens of KYT (Know Your Transaction) projects for fintech companies in the EU, the United Kingdom, the Czech Republic, Slovakia, Cyprus and Estonia, as well as in Singapore and Dubai. In this article I systematize the approach that has proven effective at COREDO: from architecture and risk-scoring models to legal liability and the AML team’s KPIs.

What is KYT and how does it integrate into AML processes?

KYT (Know Your Transaction) for fintech is the continuous analysis of blockchain transactions in real time with risk scoring at the level of each operation. Unlike KYC, which answers the question «who is the client», KYT answers the question «what is happening with their transaction right now». For payment and crypto services this is the foundation of blockchain payments compliance and the key to managing operational risk.

Regulatory frameworks: AMLD5/AMLD6, FATF and the Travel Rule

European AMLD5 and AMLD6 have shaped expectations for transaction monitoring policies, sanctions screening obligations and suspicious activity reporting. Recommendations of FATF, including the Travel Rule, require matching on‑chain and off‑chain data and transmitting payer/beneficiary attributes between providers. In practice this means the need for on‑chain sanctions screening, compliance with watchlists (OFAC, EU, UN) and automation of SAR/STR reporting.

Architecture: from streaming to investigations

The solution developed at COREDO is typically built as a streaming pipeline. Block indexing and mempool parsing provide minimal latency, and data streaming (Kafka, Kinesis) delivers events to the risk-scoring core. We enrich transactions with additional data: address attribution, exchanges, OTC entities, cascades of transit wallets. This increases accuracy and reduces false positives when monitoring on-chain.

For graph analytics of transactions we often use Neo4j or TigerGraph, and for full-text search and event analytics: ElasticSearch. Such a stack delivers performance benchmarks for latency/throughput at millions of transactions per day and the ability to scale monitoring for cross-chain payments. SLAs are important for transaction monitoring: alert latency, API availability, incident handling time, and the speed of sanctions updates.

Blockchain fraud detection systems integrate via API and webhooks for alerts with subsequent processing in case management and analyst workflows. Audit trail, multi-level access control, encryption and key management form a secure perimeter. For global providers, SaaS KYT multi-tenancy and a clear policy on TCO, CAPEX and OPEX are useful when implementing KYT.

Analytics and models: a hybrid of rule-based and ML

COREDO’s practice confirms: the best effectiveness is achieved by a hybrid of rule-based detectors and machine learning models for KYT. Heuristic rules quickly catch known patterns, while unsupervised training detects anomalies in new flows. Supervised models for risk scoring increase the prioritization of investigations and reduce the conversion of alerts into SARs where justified.

Feature engineering for transaction scoring takes into account the degree of connectivity to sanctions tags, the depth and breadth of paths, temporal patterns, amounts, and repeatability. Backtesting of the transaction risk-scoring model is necessary before go-live: we check metrics on historical data and stress scenarios (for example, spikes after a token listing). As a result, the client gets a reduction in alert fatigue and an increase in the operational efficiency of the AML team.

On-chain risks: DeFi, mixers and privacy coins

On‑chain analytics of transactions must take DeFi specifics into account. Monitoring DeFi transactions focuses on DEX and AMM transaction patterns, bridges and token transit flows, wrapped tokens and multichain tracking. The impact of L2 and rollup on transaction monitoring is expressed in increased speed and the need to index smart contract events.

We track leaked wallets and key leaks, and also build an incident response plan upon detection of money laundering. For legal investigations, chain‑of‑custody for on-chain evidence is important: immutable logs, hash fixations and procedural integrity. This simplifies interaction with lawyers and regulators and reduces the risk of disputes over the evidentiary base.

Integrating KYT into processes: from onboarding to SAR

Integration with wallets and payment gateways provides pre-credit holds and real-time operation of the KYT API. AML/KYC orchestration platforms help tie KYT to KYC and sanctions screening, and also implement automated decisioning for low-risk scenarios. Proper implementation of a transaction monitoring policy formalizes thresholds, roles, and escalations.

At COREDO we set up SAR automation and regulator reporting, which reduces manual delays and improves submission quality. SOC/AML team organization and processes include triage levels, playbooks, and SLAs for incident closure. Key metrics — alerts-to-SAR ratio, analyst efficiency, average investigation time, and repeat-alert rate.

How to choose a KYT platform and assess ROI

We perform Due Diligence on blockchain analytics providers, including open sources and commercial solutions, as well as open source tools for blockchain analytics as a supporting layer. It is critical to check which SLAs matter for monitoring transactions in fintech: RPO/RTO, alert latency, tag update frequency, support for new networks and the quality of customer support. Vendor comparison: this is not a feature race, but a check of alignment with your risk scenarios and jurisdictions.

Implementation plan: from pilot to production

The pilot begins with defining target risks and selecting networks/tokens. Next: configuring sanctions lists and watchlists, integrating with enrichment sources and setting up API integrations and webhooks for alerts. After that, backtesting on historical data, determining thresholds, training staff and running in parallel mode with manual oversight.

Implementing a real-time KYT API requires performance testing, latency/throughput benchmarks and fault-tolerance plans. We build in model risk governance (model governance), regular testing and rule validation, as well as drift detection and model monitoring. DevOps and MLOps for production KYT systems simplify releases, disaster resilience and traceability of changes.

COREDO case studies: what worked in practice

• European payments provider with expansion into the United Kingdom and Singapore. The COREDO team implemented KYT integration with internal KYC and sanctions screening, deployed on‑chain sanctions screening and SAR automation. We combined graph algorithms for on‑chain investigations with rule‑based detectors, achieving a double‑digit reduction in false positives and shortening investigation time. As a result the company accelerated PI/EMI licensing and preserved SLAs for client‑facing payments.
• An OTC desk in Dubai with multichain flows. The solution developed at COREDO emphasized on‑chain transaction analytics to detect bridges, wrapped tokens and AMM anomalies. We set up address and wallet tracking, address attribution and clustering, as well as an incident response plan for detected money laundering. This enabled proper handling of cross‑chain flows and meeting the local regulator’s AML requirements for fintech companies.
• Fintech in the Czech Republic/Slovakia expanding into the EU. COREDO’s practice confirmed that integrating KYT into the onboarding process speeds up KYC through dynamic risk scoring of initial transactions. We ensured compliance with AMLD5/AMLD6, correlation of on‑chain and off‑chain data and automated reporting. The company gained transparency of chains and reduced incident costs.
• Licensing of a crypto service in Estonia and launch in the United Kingdom. The COREDO team prepared an AML policy, implemented address identification and wallet tagging, and deployed case management and workflow for analysts. A key element was explainable AI for fintech compliance: the regulator valued the transparency of scoring and the completeness of logs, which simplified the audit process.

Legal aspects: liability and cross-border data

Processes and team: how to avoid overload and burnout

Case management and workflow for analysts with investigation templates and playbooks reduce cognitive load. SOC/AML team organization and processes increase predictability and manageability of SLAs. COREDO’s experience shows that clearly defined roles, task rotation and quality control reduce turnover and increase the resilience of the AML function.

Data, vendors and security

Multi‑tenancy of SaaS KYT and data security require segmentation, encryption, access management and monitoring. DevOps and MLOps for production KYT systems help maintain release quality and rollbacks. Log auditability and an immutable trail simplify audits and build trust with the regulator and partners.

Cross-chain and the future: L2, rollups and new risks

The impact of L2s and rollups on transaction monitoring is growing: the volume of smart contract events increases, speed rises and attribution becomes more complex. Best practices for building a blockchain monitoring pipeline include deterministic indexing, retry queues, schema versioning and consistency checks. Scaling to millions of transactions per day requires horizontally scalable shards and backup strategies.

Total on‑chain traceability versus privacy‑enhancing tech is a balance between compliance and privacy. At COREDO we follow the principle of ‘minimum necessary’ storage of personal data and maximally preserve technical signals for risk detection. Past cases of address sanctioning and lessons learned help adjust rules and models in advance for new patterns.

Practical checklist: where to start and what to measure

• Determine target risk scenarios: sanctions, mixers, DeFi bridges, privacy coins, leaked keys.
• Choose the architecture: SaaS KYT vs on‑prem considering CAPEX/OPEX, GDPR and multi‑jurisdictional constraints.
• Build the pipeline: mempool parsing, streaming (Kafka/Kinesis), graph database (Neo4j/TigerGraph), search (ElasticSearch).
• Configure sanctions lists: OFAC, EU, UN, local watchlists, and the policy for updating them.
• Enable hybrid analytics: rule‑based detectors + ML (supervised/unsupervised), explainable AI.
• Run a backtest: precision/recall/F1 metrics, false negative tests, drift detection.
• Launch a pilot: TTV, SLA, reduction of false positives, alerts‑to‑SAR ratio, analyst efficiency.
• Formalize processes: case management, playbooks, incident plan, SAR automation.
• Prepare for audit: immutable logs, chain‑of‑custody, data‑sharing regulations between branches.
• Plan for growth: L2/rollups, DeFi risks, new networks, regular validation of rules and models.

How COREDO supports a project from licensing to production

COREDO covers the entire cycle: from registering legal entities in the EU, the UK, the Czech Republic, Slovakia, Cyprus and Estonia, to structuring in Singapore and Dubai. We assist with obtaining licenses (crypto, payments, forex and banking), develop AML policy, design KYT architecture and implement blockchain payments compliance. This approach eliminates gaps between the legal framework, processes and technology.

Conclusion

KYT is not just real-time analysis of blockchain transactions. It is the foundation of your license, payment speed, and market trust. When transaction monitoring is linked with KYC, sanctions screening, and clear investigation processes, fintech gains control over risk and predictable economics. COREDO’s experience in the EU, Asia, and the CIS shows: a well-designed KYT reduces operational costs, speeds time-to-market, and stands up to audits.

If you are building a payment service, a crypto platform, or expanding presence across multiple jurisdictions, start with a clear architecture, transparent metrics, and a pilot on real-world scenarios. The COREDO team has walked this path dozens of times and knows how to reconcile the requirements of AMLD5/AMLD6, the FATF Travel Rule, GDPR, and the specifics of DeFi. That way you’ll gain not just compliance but a competitive advantage—a resilient, scalable risk control built into the product.

When I launched COREDO in 2016, entrepreneurs had an obvious request: to enter new markets quickly, safely and transparently. Over the past few years the puzzle has become more complex: requirements for company registration, licensing and AML compliance have tightened. Today it is impossible to build an international business without a well-designed compliance function, and the EU AML Package 6.0, the launch of AMLA and 6AMLD are turning “due diligence” from a formality into a strategic discipline. In this article I systematize our experience and explain how to build a working AML and KYC/KYB system without losing scaling momentum.

EU regulatory map: AMLA and 6AMLD

The EU AML Package 6.0 formalizes the shift toward more unified regulation: it creates AMLA (the European Anti‑Money Laundering Agency), the provisions of 6AMLD come into force, and the main body of requirements is consolidated into pan‑European AML regulation. For businesses this means uniform technological and procedural standards across the EU and fewer gray areas in the interpretation of rules. At the same time, the role of national regulators remains: they will interact with AMLA by sharing data, coordinating inspections and harmonizing local procedures.

Company registration with AML considerations

Registration of legal entities in the EU with AML requirements in mind is not just articles of association and an address. Competent preparation of a UBO dossier, analysis of source of funds, assessment of the business model from the AML-risk perspective, and the mandatory elements of the starter package. I recommend starting with a jurisdiction map: the Czech Republic, Slovakia and Cyprus are convenient for trading and holding structures; Estonia and United Kingdom — for tech and service companies; Singapore and Dubai — for regional headquarters and structures with active payment activity.

Registration and support of companies in the EU from an AML perspective includes alignment with future licenses and banking needs. If the goal is: payment services, it is worth building in advance a functional compliance structure, the allocation of responsibilities of “obligated persons” for AML, and an initial set of CDD/EDD controls. When these elements are embedded before applying for an account or a license, the process proceeds noticeably faster.

AML Program Architecture

Compliance program AML for companies is a managed system of policy, procedures, a technology platform and metrics. I recommend starting with a risk-based approach: conduct an AML risk assessment, identify client and country risk profiles, determine high-risk scenarios, and then embed them in the corporate policy. It is important to describe roles and the chain of responsibility, including the director’s and corporate structure’s responsibility for AML, and an internal control plan.

From a cost perspective, a cost-benefit analysis of implementing AML platforms is needed already at the RegTech selection stage. AML effectiveness metrics (KPIs and ROI) are not only about reducing fines and administrative measures for AML non-compliance, but also accelerating M&A, access to correspondent banking and reducing operating costs. Scaling AML processes as the business grows becomes a routine task when the architecture already supports new jurisdictions, languages and data sources.

How to implement KYC, KYB, CDD and EDD?

KYC and KYB requirements in the EU are based on 6AMLD and national laws, but expect the same logic: verification of identity, address, tax residency status, source of funds and UBO/BO status. For corporate clients, KYB includes checking registers, the charter, ownership structure, as well as assessing the business reputation of executives. We use automation of KYC processes and tools for VASP/PSP to reduce document collection time and minimize human errors.

Transaction monitoring and risk assessment

risk assessment for AML is a living document that is tied to transactional behavior models. We apply customer profiling and risk scoring, using historical and behavioral parameters: geography, average transaction amounts, types of counterparties, temporal patterns. Technologies for AML, transaction monitoring, screening, analytics: form an observation framework that operates in real time while also supporting off-chain monitoring for non-standard scenarios.

Monitoring the risks of counterparties and supply chains complements transactional rules. For cross-border companies we implement off-chain indicators: reputation in industry databases, court cases, changes in ownership structure. This layer improves the accuracy of EDD and helps promptly identify triggers for revising the risk profile.

Strategies for crypto and VASP

Regulation of virtual assets and VASP under the AMLA aligns the framework for crypto services with traditional financial institutions. Virtual asset service providers (VASP) and KYC requirements should cover customer identification, source-of-funds verification, sanctions screening, and monitoring of on-chain and off-chain transactions. Blockchain chain analysis and blockchain analytics help build a link-based risk model for addresses, wallets, and exchanges, and identify mixers, obfuscation, and connections to the darknet.

risk management when working with crypto assets requires correlating on-chain signals with off-chain customer profiles. For tokens and stablecoins, an additional layer evaluates the issuer, reserve model, and counterparties involved in redemptions. Regulatory tests and pilot projects (sandboxes) are a useful option if the market allows testing new compliance models under controlled risk. In several projects the COREDO team supported KYC pilots for VASP in the EU and Dubai, which enabled clients to obtain licenses faster and establish a dialogue with the regulator.

STR/SAR: interaction with the FIU

The obligations of obliged persons (obliged entities) under AML include detection and reporting of STR/STRs (or SAR), record keeping and cooperation with the FIU. Preparing and submitting STR/SAR requires a clear checklist: indicators of suspiciousness, escalation logic, the level of detail in the description of the pattern and attachments. We configure signal handling routes from first line to the MLRO to eliminate delays and improve the quality of reports.

Licensing: payments, forex, crypto

obtaining financial licenses – is an assessment of the maturity of your AML system. For payment providers and PSPs, regulators assess governance, the independence of the compliance function, the quality of KYC/KYB, EDD and transaction monitoring. For forex and investment licenses, particular attention is paid to sources of liquidity, policies on high-risk jurisdictions and stress testing. Crypto licensing in the EU and Dubai integrates requirements for VASPs, blockchain analytics and counterparty risk management.

The impact of AML obligations on corporate transactions and due diligence has noticeably increased. The integration of AML requirements into M&A and corporate transformation includes audits of the client base, retrospective analysis of STRs, assessment of regulatory history and vendor due diligence. The participation of banks and non-bank institutions in AML is now assessed in the context of the single EU AML Package, and the alignment of national legislation with the AMLA reduces divergences in requirements for cross-border licensing.

Outsourcing third-party compliance

Outsourcing compliance functions and its risks are often underestimated. Outsourcing vs in-house – it’s not about “cheaper”, but about control, competencies and resilience. We usually set up a hybrid: key roles and decision-making in-house, while part of monitoring and screening is with external providers under clear SLAs and with audit rights. This approach simplifies scaling the AML infrastructure when entering new markets, while maintaining manageability.

COREDO: access to banks and de-risking

One of the recent projects was a fintech from Central Europe with a payment model for cross-border e-commerce. The client faced difficulties accessing banking services due to de-risking. The COREDO team rebuilt the compliance package: detailed suppliers’ KYB, strengthened sanctions screening, and implemented transaction profiling with adaptive thresholds. The bank reconsidered its decision, opening correspondent accounts after a pilot period with KPIs on false positives and alert handling time.

AML Package 6.0 Compliance Plan

Every compliance officer benefits from a pragmatic roadmap. Below is the checklist we use during implementation.

1. Conduct an AML risk assessment and record the risk appetite. Ensure that client, country, product and sales channel profiles reflect the current strategy and growth plans. Update the risk map at least once a year and after major business changes.
2. Update the AML compliance program, roles and accountability. Define MLRO authorities, describe escalation and independence of control. Document the corporate policy on anti-money laundering and sanctions screening.
3. Review KYC/KYB, CDD/EDD and PEP procedures. Include automation of KYC processes, regular sanctions screening and relationship checks. Clarify the practical implementation of UBO identification and the frequency of data updates.
4. Reconfigure transaction monitoring and rules tuning. Introduce metrics for false positives, average alert handling time and the share of escalations to STR/SAR. Conduct transaction analysis in real time and off-chain monitoring for atypical scenarios.
5. Approve the STR/SAR playbook and interaction with the FIU. Describe suspicion criteria, the quality of the evidentiary base and filing deadlines. Check legal data-exchange mechanisms and GDPR compliance.
6. Check AML integration into ERP/accounting and dashboards. Ensure data integrity, access log audits and consistency of reporting standards. Set compliance KPIs and ROI to demonstrate business impact.
7. Organize training and testing for staff. Run targeted modules for the front office, analysts and management every six months. External certification and participation in industry programs are useful for compliance officers.
8. Agree the outsourcing process and third-party controls. Document SLAs, audit rights, security requirements and continuity plans. Verify vendor approaches’ compatibility with 6AMLD and local regulations.
9. Prepare a high-risk and sanctions policy. Develop a policy for working with high-risk jurisdictions and client profiles. Clarify the approach to tokens, stablecoins and VASPs, if relevant.
10. Plan regulatory engagement and pilots. If the product is innovative, consider participation in sandboxes and supervised pilots. This will speed up feedback and reduce regulatory uncertainty.

What to consider when entering new countries

AML analysis when entering the markets of Asia and the CIS must take into account local standards and the FATF’s international recommendations. Differences in access to UBO registries, document retention periods and STR formats can affect process design. The impact of AMLA on fintech and payment services in the EU makes the European part of the infrastructure more predictable, which simplifies integration with Singapore and Dubai.

Why I support systemic compliance

Compliance is not an “insurance against fines”, but an operational discipline that increases a company’s capitalization. AML Package 6.0, the EU Directive on anti-money laundering and the launch of AMLA are creating a common playing field with clear rules, and those who adapt their processes earlier will gain an advantage. I see COREDO clients opening accounts faster, obtaining licenses with confidence, and shortening deal cycles when compliance is integrated into the business architecture.

The COREDO team has implemented projects in the EU, the UK, Singapore and Dubai, from registration and licensing to setting up monitoring and providing full AML support for companies. I continue to personally oversee complex cases and am convinced: transparency, technological sophistication and discipline deliver the best results. If you plan to scale, pursue M&A, or expand into new markets, build compliance into your growth strategy: it will save time and strengthen the trust of partners, banks and regulators.

Since 2016 I have been building COREDO as a team that turns complex regulatory challenges into working operational models. During this time we have carried out dozens of projects in the EU, the United Kingdom, Singapore and Dubai, as well as in a number of offshore and mid‑shore jurisdictions in Africa and Asia. Today entrepreneurs and CFOs increasingly come to me with one request: how to strategically choose between the Seychelles and Mauritius for a VASP license, accelerate the VASP 2026 licensing process and at the same time ensure AML/CFT compliance, bankability and a stable project economy. In this article I have compiled our practical experience, working checklists and a view of trends for 2024–2026 so that you can make an informed decision and move toward ROI without unnecessary iterations.

Choosing a VASP jurisdiction in 2026

Comparison of Seychelles and Mauritius for VASP

For VASP the strategic comparison of jurisdictions of the Seychelles and Mauritius focuses not so much on the attractiveness of the locations as on differences in regulation and practical compliance with requirements. Let’s review the key differences in the regulatory frameworks and approaches of the FSA and FSC to understand what risks and advantages each system carries.

Regulatory frameworks: FSA vs FSC

In the Seychelles supervision of VASPs is exercised by the Seychelles Financial Services Authority. The regulator relies on the local law on virtual asset service providers and general AML standards oriented to FATF recommendations for virtual assets. For VASP registration in the Seychelles the applicant prepares internal policies, appoints a responsible MLRO, describes custody architecture and demonstrates operational readiness.

Capital requirements and presence

VASP capital requirements in the Seychelles are structured by activity classes and are confirmed by paid-up share capital and liquid reserves. Economic presence in the Seychelles includes local control and reporting, availability of responsible persons and enforceability of service agreements.

Taxation, DTA and the impact of substance

In the Seychelles the tax regime is oriented toward international cooperation, participation in the CRS (automatic exchange of information) and meeting transparency requirements. The impact of economic substance on a VASP’s tax status in both jurisdictions is growing, especially in light of the Pillar Two initiatives (global minimum tax). Our experience at COREDO has shown: thorough documentation on risk management, transfer pricing and substance is the basis for a positive position in tax audits.

Banking services and bankability

In COREDO projects we develop an account roadmap: an operational account in a local bank, accounts in international EMIs, escrow for custody and segregation of funds, as well as integration with payment gateways and PSPs with demonstrable compliance with the Travel Rule.

Market access (passporting) and risks

The impact of MiCA on offshore VASP licenses is increasing: targeted marketing in the EU will require MiCA compliance and adherence to national regulator regimes. COREDO’s practice confirms: correct marketing policy and clauses in client documents reduce the risks of breaching local rules.

VASP License 2026: from application to go-live

obtaining a license VASP in 2026 is a multi-stage procedure covering the path from application submission to actual go‑live and requiring coordinated work of lawyers, compliance and IT. Below we will analyze key timelines and stages in detail to help plan the process and minimize the risk of delays.

Stages and timelines

The standard route includes preliminary diagnostics, preparation of policies and procedures, gathering registration documents, submission to the FSC or FSA, responses to queries, conditional approval and the final go‑live with verification of operational readiness. Timelines and stages of obtaining a license for VASP depend on the category, custody complexity and chosen providers. In our practice in Mauritius the typical horizon is 4–6 months to conditional approval and another 1–2 months to fulfil the conditions; in the Seychelles: comparable with good preliminary preparation.

Checklist of registration documents

• corporate documents, charter and the share capital structure;
• disclosure of beneficiaries (UBO) for VASP, compliance with UBO register rules;
• business plan, financial models, OPEX calculation and liquidity reserves;
• VASP compliance program 2026, AML/CFT policies, sanctions procedures and screening;
• technological requirements for VASP licensing: key management, custody, BCP/DRP;
• agreements with critical providers: KYC/KYB, KYT, blockchain forensics, custody insurance.

The COREDO team structures the document package so that the regulator can see the connectivity: risks – controls, metrics – reporting.

Fit and proper, UBO and background checks

In COREDO projects we perform an internal pre‑screen in advance to mitigate potential FSC/FSA queries and to justify the appointment of the MLRO, CTO and key functions.

AML/CFT 2026: operational control

In the context of AML/CFT 2026 it is critical to shift the focus from drafting policies to real operational control that actually reduces risks. This requires strengthening KYC, KYB, sanctions screening and regular PEP checks at all stages of client interaction.

KYC, KYB, sanctions screening and PEP

AML requirements for VASPs in Mauritius and AML requirements for VASPs in the Seychelles converge in spirit: demonstration of effectiveness, not only policies on paper. Regular AML training and employee testing with documented results help here.

Travel rule, KYT and blockchain forensics

AML implementation transaction monitoring for VASP relies on scenarios and manual reviews. At COREDO we set up performance metrics: escalation speed, average time to close an alert, and the share escalated to SAR.

MLRO and SAR: interaction with the regulator

The MLRO and the AML officer role include independence, access to the board of directors and the authority to stop transactions. SAR and the procedure for filing suspicious transactions are formalized with clear SLAs. In dialogue with the FSC/FSA, structured reporting, a log of decisions and regular AML/CFT 2026 effectiveness self-assessments for VASP management are helpful.

Requirements for VASP

Technological and operational requirements for VASP define a set of standards and practices that ensure security and compliance when working with crypto assets. Special attention is paid to hot/cold wallet architecture, multi‑sig schemes, custodial governance models and insurance — these solutions form the foundation of operational resilience and client protection.

Hot/cold wallet and multi-signature architecture

Requirements for hot and cold wallets boil down to the principle of minimizing exposure and separating duties. Multi‑sig, cold wallet and hot wallet architectures are complemented by segregation of user funds and custody rules. For significant volumes I recommend custody insurance and independent cold storage audits, including a technical assessment of key protection (key management).

Custody rules and crypto asset storage imply detailed procedures for access, logging and emergency scenarios. The solution developed at COREDO often includes hardware modules, version control and regular drill tests.

Cybersecurity: SOC2, ISO27001, ISAE

Cybersecurity for crypto businesses in offshore jurisdictions: a mandatory block. SOC 2 and ISO 27001 security requirements increase trust from banks and institutions. ISAE 3000 / ISAE 3402 audits are appropriate for service providers. In COREDO projects we perform a pre‑assessment, close critical controls and plan certification together with licensing.

Operational resilience BCP/DRP

Structuring and tax model

A well-designed corporate structuring directly determines the practical applicability of the chosen tax model and the level of legal risk for the business. In the following subsections we will examine in detail the options for organizing a VASP offshore, the related tax consequences and practical measures to minimize risks.

VASP structure in offshore jurisdictions

The administration of trust structures and foundations is possible for holding IP or reserve assets, provided there is UBO transparency and compliance with the UBO register.

Transfer pricing, CRS, BEPS, Pillar Two

CRS (automatic exchange of information) and OECD BEPS rules require proper documentation of intercompany services and rates. Transfer pricing and transactional schemes must reflect substance and market conditions. Pillar Two — the global minimum tax — becomes a factor when planning profits and royalties.

Capital, investments and exit/M&A

COREDO case studies and takeaways

COREDO’s practice is based on real cases and concise extracts of experience that help quickly identify practical solutions and risks. In the first subsection we will analyze VASP registration in Mauritius and the key findings useful for similar tasks.

VASP registration in Mauritius

Cryptocurrency exchange licensing in the Seychelles

Bank servicing and integration with PSPs

Cost of compliance and ROI

Assessing the cost of compliance is not only about initial investments but also an ongoing burden on the budget that directly affects expected ROI. To properly calculate returns, OPEX, licensing fees and annual payments must be analyzed separately.

OPEX and annual licensing fees

VASP license ROI in Mauritius vs Seychelles

Regional expansion and scaling

Scaling operations and regional expansion require pre-planned modularity: additional licenses, the availability of regional accounts, and expansion of the compliance team. Passporting and access to African and EU markets are achieved through local licenses and partnerships, not through a “universal” offshore license.

Impact of MiCA on 2024–2026 trends

New regulatory trends during 2024–2026 are substantially changing requirements for the digital assets market, and MiCA’s influence is already setting benchmarks for enforcement and compliance. In the following subsections we will examine how these changes are reflected in European rules for VASPs and what service providers will need to take into account.

MiCA: EU rules for virtual asset service providers

Virtual assets, FATF recommendations

FATF compliance for VASPs is an informal “currency of trust”. Regulators expect a clear linkage between risks and controls, including Due Diligence providers for VASPs, scenario monitoring and SAR‑procedures. The COREDO team pays attention to country‑risk models and periodic risk reassessment.

Regulatory sandboxes and innovation

Risk checklists

Risk management and regular checklists help to identify vulnerabilities in advance and reduce the likelihood of non-compliance during inspections. Next we’ll review compliance with FSC/FSA requirements and practical steps for preparing for on-site inspections.

On-site inspection for FSC/FSA

Regulatory reviews and on-site inspections include interviews, selective transaction reviews, testing of BCP/DRP and verification of reporting. Reporting requirements in FSC / FSA cover regular reports, audits and VASP inspections. Our checklist includes a self-assessment of key controls and readiness for spot-checks.

Nominee directors

Marketing restrictions in the EU and Britain

COREDO Licensing Roadmap

When building the COREDO licensing roadmap, COREDO focuses on aligning business processes and technical solutions to minimize risks and accelerate engagement with regulators. Within this strategy, the choice of technology stack and vetted due diligence providers that ensure compliance and transparency at every stage is especially important.

Stack and due diligence providers

AML training and compliance program

The VASP 2026 compliance program is built as a living system: policies, playbooks, metrics, training. AML training and employee testing are mandatory for all roles, including product and support. We prepare VASP reporting, audits and inspections in a format convenient for regulators, banks and investors.

Hybrid models: custody, broker, exchange

The functional classification of a VASP defines the scope of the license: exchange, wallet, custody. For hybrid models, boundaries of responsibility, requirements for reserve storage, cold storage audits and custody insurance are important. We also evaluate opportunities for licensing stablecoin and e‑money through partnership schemes and local licenses.

Brief risk profile Seychelles vs Mauritius

• Seychelles: speed, flexibility, affordable compliance costs; greater focus on EMIs/PSP; important to carefully establish AML/KYT and demonstrate the effectiveness of controls.
• Mauritius: strong DTA network, developed banking sector, focus on substance; higher requirements for an office and team; a convenient platform for Africa and institutional flows.

Key takeaways

The COREDO team has gone through this journey with different models: from crypto exchanges to custodians. I see how proactive AML/CFT planning, technological discipline, a proper corporate structure and respect for regulators’ requirements transform a launch from a ‘risk’ into an ‘investment’. If you are building a VASP in 2026, start with a risk map, define target markets taking into account MiCA and FATF, assemble a strong team of directors and an MLRO, and then sequentially close out issues related to custody, banking and reporting. COREDO’s practice confirms: this approach shortens timelines, reduces OPEX and accelerates the path to sustainable ROI.

I regularly meet executives who are ready to scale work with digital assets, but are stuck on two things: the BaFin license and the architecture of secure key storage. Since 2016 the team COREDO has supported dozens of projects for company registration in the EU and Asia, obtaining financial licenses and building compliance functions. During this time I have gathered a set of proven approaches that really save time and reduce operational risks. In this text I will systematically go through the path from legal structure to key architecture and regulatory reporting – with a focus on Germany and BaFin, but taking into account MiCA and EU requirements.

Our experience at COREDO has shown: a strong custody service doesn’t start with HSM, but with a clear regulatory model, a comprehensible operational architecture and compliance discipline. Technology is an important layer here, but without the right license, contractual framework and AML/KYC procedures the business risks getting a stop signal at the start.

Regulatory framework of Germany and the EU

The regulatory framework of Germany and the EU increasingly shapes requirements for the handling and storage of crypto-assets, setting standards for licensing, supervision and investor protection. Below we will examine the key elements of oversight – including the role of BaFin and the specifics of regulating crypto custody.

BaFin regulation of crypto custody

MiCA: impact on BaFin custodians

AMLD5 and AMLD6: AML/KYC and GDPR

BaFin license for crypto custody

BaFin‑Licensing of crypto custody requires strict compliance with regulatory requirements and transparent documentation. Below we will examine in detail the stages and structure of obtaining the license, including the key legal, operational and technical criteria for successfully completing the process.

How to obtain a BaFin custody license

I recommend starting with the legal structure for custody in the EU (GmbH, AG). For crypto custody in Germany a GmbH is usually suitable, while mature players planning to raise capital choose an AG. Capital requirements for custody depend on the service profile; for pure storage of private keys the starting capital is usually from €125,000, and is higher when combined with payment services. The cost of obtaining a BaFin license consists of document preparation, technology implementations (HSM/MPC), hiring key personnel (MLRO, CISO, Head of Risk), certifications (ISO 27001, sometimes SOC 2 Type II), insurance and legal support.

Process stages:

• Pre-licensing gap analysis against BaFin/BAIT/MaRisk and MiCA.
• Designing the operational model: custody vs non-custodial, cold/hot storage, MPC or multisig, key ceremony protocol and key rotation policy.
• Building compliance: AML/KYC, sanctions screening, risk-based approach, incident management and notifications to the regulator.
• IT and security: HSM (Hardware Security Module) or MPC (Multi-Party Computation), cold key storage infrastructure, air-gapped signing, audit trail and logging.
• Documentation and submission: policies, regulations, client agreements, legal agreements for HSM outsourcing.
• On-site inspections and responses to inquiries.

Checklist for preparing for a BaFin inspection

• Governance: qualified executives, independent risk and compliance, information security committee.
• Policies and procedures: private key storage requirements, access management and role models in custody, key ceremony and backup, disaster recovery plan and business continuity plan.
• IT governance under BAIT: asset inventory, vulnerability management, change management, incident response.
• Security: BaFin HSM security requirements, description of MPC/threshold signatures, multisignature and key storage, cold wallet architecture and hot wallet risk.
• Quality control: penetration testing and red team, bug bounty programs, security audit for crypto custody, SOC 2 Type II audit if available, ISO 27001 certification.
• Finance: capital requirements, OPEX vs CAPEX model, ROI calculation for security investments and overall financial plan.
• Contract framework: preparation of custody agreements for corporate clients, SLA 99.9% availability, key storage regulations and GDPR, fiduciary duty for custodians, segregation of client assets, trustee model custody.
• Reporting: BaFin regulatory reports, security metrics for BaFin reporting, incident notification policies.

Supervision and incident reporting

Key storage architecture

Building the technological architecture for key storage defines a set of decisions responsible for the security, availability and manageability of cryptographic materials. In the following subsections we consider the role of HSMs and outsourcing options for critical components to show how different approaches affect risks and operational requirements.

Outsourcing critical components and HSM

MPC, multisig and secret sharing

Fault tolerance, scaling and audit

Designing a fault-tolerant key architecture includes distributed key storage for scaling, geo-replication, independent quorum channels and deterministic run-books for incidents. A multi-tenant custody platform requires strict segmentation, circuit isolation and continuous monitoring. Audit trail and logging must cover administrative actions, transactions, access to secrets and configuration changes.

Custodial staking: risks

Assets, integrations and SLA

Risk management and compliance

Effective risk management and strict compliance require a systemic approach to identifying and mitigating financial threats. In this context, AML/KYC and regular transaction monitoring become key tools to prevent fraud and money laundering.

AML/KYC: transaction monitoring

Resilience and security

Insurance and fiduciary duties

Insurance of crypto custody assets: a separate track. Custody insurance policy and underwriting of crypto risks take into account limits for hot and cold wallets, exclusions and deductibles. How to choose an insurance product for a custodian? I assess the insurer’s financial stability, cyber-risk coverage, limits on social engineering and control requirements.

Data privacy and regulations

Strategy and economics of launching a service

The project’s economics and the chosen strategy shape the decision-making framework during preparation and launch of the service, setting priorities for resources and the acceptable level of risk. Below we will examine in detail the cost model, required capital and key ROI metrics to build a justified go-to-market plan.

Cost model and ROI

OPEX vs CAPEX модель помогает прозрачнее коммуницировать с советом директоров. CAPEX, HSM, сети, лицензии на ПО, сертификации; OPEX – штат комплаенса и ИБ, страховки, аудит, колокации, bug bounty. Стоимость получения лицензии BaFin и последующее содержание зависят от масштаба.

In-house vs third-party and white-label

The comparison of in-house vs third-party custody boils down to control, speed of launch, and the regulatory curve. White-label custody solutions allow faster market entry but increase dependence and requirements for third-party risk management. Migration of crypto-assets between custody providers — a scenario I plan for at the start — includes procedures for key rotation, attestation of balances and client notifications.

Outsourcing HSM legal agreements require clear SLAs, audit rights, requirements for data geography and recovery plans. Third-party risk management includes periodic assessments, stress tests and forensic clauses in contracts.

Operational resilience and SLA

COREDO case studies: licensing and integration

In a series of COREDO case studies we show practical steps – from obtaining a license to real bank integration scenarios. Using the example of Germany, we examine BaFin’s requirements, key architecture and technical solutions necessary to comply with regulatory and banking requirements.

BaFin: license and key architecture

The COREDO team recently implemented a project for a fintech planning custody for large corporate clients. We chose a GmbH, prepared the BaFin submission package, deployed HSMs for master keys and MPC for operational signing. The client obtained ISO 27001 certification, underwent a SOC 2 Type II audit and set up proof-of-reserves methodologies with regular attestation reports. The contractual framework established segregation of client assets and a trustee-model custody, as well as terms for custodial staking and disclosure of slashing risk.

EU passporting after launch

Another client launched custody in Germany with an eye on the EU. We built a model compatible with MiCA and prepared EU passporting for custody services. The legal structure and policies immediately accounted for Cyprus and Estonia’s requirements for IT resilience and staffing, which accelerated regional expansion.

Integration into a banking group

A separate case — implementing custody in a banking group with presence in the UK, Singapore and Dubai. We integrated custody into the bank’s structure via API, REST/WebSocket, supporting corporate accounts and sub-accounts. For the CTO/CISO we set up key KPIs, reports for risk committees and regular red team exercises.

Practical tools

To minimize risks when choosing a custody provider, rely on practical methods and tools that turn abstract requirements into concrete checks. Below is a compact checklist for reviewing custody providers with key criteria for security, compliance and operational reliability.

Checklist for reviewing custody providers

Reviewing custody providers: a checklist for the director

• Licenses and supervision: BaFin license for crypto custody, MiCA plans, regulatory history, inspection precedents.
• Security: HSM/MPC, key ceremony protocol, air-gapped signing, penetration testing, bug bounty, ISO 27001/SOC 2.
• Operations: SLA 99.9%, incident response, disaster recovery, business continuity, audit trail.
• Compliance: AML/KYC, sanctions screening, AML transaction monitoring, GDPR.
• Legal: segregation of client assets, trustee model custody, insurance, outsourcing, HSM legal agreements.
• Technology: support for Bitcoin/Ethereum, ERC-20/ERC-721, layer-2 and custody, cross-chain custody, API REST/WebSocket.
• Economics: fees, limits, OPEX vs CAPEX, ROI assessment.
• Migration: export of keys/addresses, proof of reserves during transition, timelines and risks.

What to include in contracts and SLAs

Preparing custody agreements for corporate clients should specify:

• Scope of services, supported assets, custodial staking requirements.
• Segregation of assets, fiduciary duty, insurance and limits.
• Incident management and regulator notifications, RTO/RPO, maintenance windows.
• Key policies: private key storage requirements, key rotation, access controls.
• Proof of reserves and attestation reports, audit rights.
• Management of custody operational risks and third-party risk management.

Recovery after key compromise

A key recovery plan after compromise should include:

• Identification of the affected area and containment scenario.
• Generation of new keys (key ceremony), transfer of assets, policy updates.
• Communications: clients, regulator, counterparties.
• Forensics package: collection of artifacts, preservation of logs, independent analysis.
• Post-incident plan: lessons learned, control updates, retesting and attestations.

Frequently Asked Questions and Short Answers

Conclusions

COREDO doesn’t offer magical shortcuts. But we do have the tools, practices and experience that make this path manageable: from choosing between HSM and MPC to BaFin regulatory reports and proof of reserves. If you are planning a custody case in Germany, Czechia, Slovakia, Cyprus, Estonia, the United Kingdom, Singapore or Dubai – let’s break it down into clear modules, calculate ROI and build an architecture that will withstand both regulatory audits and the requirements of your corporate clients. COREDO’s experience shows: a systematic approach pays off faster than promises to ‘do everything in three weeks’.

I have been building COREDO since 2016 and have set up dozens of structures in the EU, the UK, Singapore, Dubai and Central Europe through incorporation, licensing and tax planning. In recent years Portugal has become a notable hub of European crypto business. The COREDO team has implemented a number of projects to create crypto holdings in Lisbon and Porto, and by 2026 the picture has become significantly more mature: MiCA comes fully into force, DAC8 and CARF change the rules of information exchange, and the Portuguese tax regime (IRC) is finally adapting to crypto assets.

In this article I have compiled a practical roadmap: how to choose a legal form, meet substance requirements, obtain CASP registration, set up AML/KYC and accounting under IFRS, plan profit repatriation and withstand tax audits. I rely on specific COREDO cases and break down the key issues: taxes on crypto assets in Portugal, corporate tax (IRC) for Portuguese crypto companies, transfer pricing, Pillar Two and the implications of MiCA/DAC8/CARF.

Portugal’s regulatory landscape 2026

MiCA (Markets in Crypto‑Assets Regulation) introduces unified rules in the EU: By 2026, CASPs operate under standards for licensing and operational risk, reserve requirements for stablecoins and risk disclosure. DAC8 expands the automatic exchange of information on crypto-assets, while the OECD CARF sets a global reporting framework. COREDO’s practice confirms: the “do the minimum and hide” strategy no longer works. Build compliance from the start “for audit” — it saves years, not months.

Private limited company vs public limited company and tax residency

The following are most suitable for holdings and operating crypto companies in Portugal:

• Sociedade por Quotas (Lda) – equivalent of a private limited company, flexible management structure, moderate capital requirements.
• Sociedade Anónima (SA): a form for large structures and public plans, stricter corporate procedures and a board of directors.

substance of a crypto-holding in Portugal

• a resident director with fintech/crypto experience and a real management role;
• a physical office where meetings are held and originals of documents are kept;
• local functions: risk management, an AML officer, accounting, preparation of financial reports;
• contracts with local providers (custody, audit, legal support), reflecting the ‘centre of interests’ in Portugal.

IRC for crypto holdings

Taxes on crypto-assets in Portugal

• utility tokens, a right of access to a service, accounted for as an intangible asset or a prepayment;
• security tokens – characteristics of a security, supervision by the CMVM, potential application of rules for financial instruments;
• asset-backed, asset tokenization, a distinct legal and fiscal profile.

VAT on trading crypto assets and NFTs

VAT and cryptocurrency trading: Portuguese rules follow the EU Hedqvist case, fiat/crypto exchange is exempt from VAT as a payment transaction. But not all crypto services fall under the exemption. Custodial services, technical support, SaaS access to protocols, market-making and listing packages are usually subject to 23% VAT in mainland Portugal.

CASP Registration: AML/KYC Requirements

AML/KYC requirements for crypto holdings and CASPs include:

• AML‑Risk Assessment, written policies and procedures;
• KYC/KYB, PEP‑screening and enhanced Due Diligence for investors;
• Blockchain‑analytics and AML tools (on‑chain monitoring), Travel Rule;
• financial monitoring and sanctions compliance (FATF Guidance on virtual assets and VASP).

UBO Beneficiary Register and Privacy

MiCA, DAC8, CARF: crypto business models

Impact of GloBE on crypto structures

Transfer pricing for tokens

Accounting for crypto-assets under IFRS and in Portugal

Accounting for crypto-assets under IFRS and Portuguese accounting standards in 2026 follows the approach: crypto-assets: intangible assets (IAS 38), except where traders hold them as inventory at fair value. Impairment, impairment tests and disclosures are mandatory, and the valuation policy is subject to audit. The IFRS project on crypto assets is moving toward clarifying classification and disclosures, and auditors are scrutinizing accounting policies.

Declaration, audits and disputes by 2026

Dividends and WHT: profit repatriation

International structures, family offices

DeFi: derivatives and custodial services

Governance / responsibility / due diligence

Corporate governance (CG) practices for international crypto holdings include independent directors, a risk and audit committee, SOX‑like requirements for public holdings, and key‑control tests. Liability of directors and executives for tax non‑compliance is real: AT and CMVM expect personal involvement, minutes of meetings, and approval of policies.

Risks of double taxation and CbCR

COREDO cases – what works

• European crypto exchange and custody. The COREDO team obtained CASP registration with Banco de Portugal, implemented an AML framework with on-chain analytics and obtained an APA on intra-group market-making commissions under TNMM. Result: predictable tax burden and fast bank onboarding for large clients.
• Family office with tokenized assets. The solution developed at COREDO used Lda as a holding, the participation exemption for dividends from the EU and DTT for royalties. We obtained a binding ruling classifying NFT income as electronic services, established VAT accounting and secured a refund of input VAT on development.
• DeFi liquidity provider. Our experience at COREDO showed that a documented methodology for valuing remuneration and a compact master file for TP smooth out the rough edges in audits. AT accepted a cost-plus model for service functions and CUP for intra-group liquidity transfers with a discount for locking.

How to set up a crypto holding in Portugal

• Choice of form (Lda vs SA) and group design under participation exemption and DTT.
• Confirmation of tax residency: directors, office, board meeting calendar.
• Registration of CASP (if necessary), appointment of an AML officer, implementation of KYC/KYB, PEP screening, Travel Rule and on-chain monitoring.
• UBO registry, GDPR‑DPIA and data‑governance policies under DAC8/CARF.
• Accounting policy: IFRS, token valuation (mark‑to‑market or cost), impairment tests, key control.
• TP policies: CUP/TNMM/cost plus for token transactions, master/local file, where possible: APA.
• VAT model: exemptions, electronic services, place of supply, refund of input VAT.
• Banking compliance: counterparty dossiers, description of flows, confirmation of substance.
• Audit plan and AT checks: on‑chain/off‑chain registers, AML reports, board minutes.
• ROI model: tax rate, cost of compliance (KYC/AML, reporting, audits), repatriation and re‑investment scenarios.

Scaling and Exit Strategies

Strategies for scaling the crypto‑business that take tax burden into account rely on diversification of functions within the EU, expansion of the CASP‑license and integration with institutional custody providers. Exit strategies: M&A, asset sale, IPO and tax consequences require early planning, TP‑history, clean IFRS reporting and the absence of “skeletons” in the AML closet increase the deal multiple.

Non-compliance risks: case law

What is important to remember

I have been leading COREDO since 2016, and from the early years I saw how international business in fintech faces not “barriers” but labyrinths. Company registration, obtaining financial licenses, AML/sanctions compliance, building processes across different jurisdictions — these are not a set of disparate tasks but a single architecture of risk management. The COREDO team builds this architecture in the EU, the United Kingdom, Singapore and Dubai, truly integrating legal, financial and technological solutions. Below I share how to think about MiCA, DeFi and compliance today so as not to “keep up with” regulation, but to get ahead of it and monetize predictability.

MiCA: regulation of crypto-assets in the EU

Who is responsible in DeFi under MiCA?

Requirements for stablecoin issuers

AML/KYC in DeFi – compliance with FATF/MiCA

How to implement KYC in a DEX without compromising UX

Smart contract risks and compliance

Consequences of MiCA for blockchain startups

COREDO launch plan under MiCA

• Jurisdictional strategy. Define the entry point into the EU considering the type of services (CASP), capital requirements and operational base. Take into account access to talent, regulatory practice and authorization timelines with the national regulator.
• Licensing and passporting. We assemble the licensing package, describe controls, and plan passporting to the second wave of EU countries. We embed MiCA technical reporting standards and procedures for interaction with ESMA/EBA.
• AML/sanctions and the travel rule. We design RBA, CDD, beneficial ownership, SAR and sanctions processes. We set up KYC for on‑ramp and off‑ramp; travel rule: technical and legal implementation, rejection policies.
• Technology and security. SDLC, audits and formal verification, upgrade policy, oracle SLA, MEV controls, custody architecture (multisig/TSS/MPC). We set up incident reporting and a response playbook.
• Transparency and disclosure. Whitepaper obligations under MiCA, best practices for risk disclosure (impermanent loss, oracle/MEV, liquidity), proof-of-reserves and methodology limitations.
• Governance and DAO. Legal wrapper for the DAO (foundation or corporate), allocation of responsibilities, on‑chain/off‑chain governance rules, front‑end liability and agreements with providers.
• Operational resilience. SLA, continuity plan, redundancy, third‑party and cloud risks, stress-scenario testing, incident reporting and interaction with law enforcement.
• Listing and scaling. Preparation for listings/integrations, compliance KPIs, passporting, inter-regulatory communications and a migration plan for MiCA updates.

Case studies: practice becomes the standard

Compliance: tools and automation

Frequently asked questions and answers

• CEX vs DEX: regulatory distinction. Centralized exchanges have the full range of CASP obligations, including custody. For DEXs, attention is on the interface, centralized components, AML on on-/off-ramps and the responsibility of DAOs/developers when there is de facto control.
• Who bears responsibility in permissionless protocols? Where there is control or influence (front-end, admin keys, oracles, treasury), the regulator sees those responsible. A legal wrapper for the DAO and distribution of functions reduce risks and improve manageability.
• How to apply the travel rule in decentralized applications? Through partner VASPs for fiat and centralized bridges, attribute exchange, refusing transfers when data is absent, and logic on the front-end/contracts.
• Proof‑of‑reserves: limitations. Without accounting for liabilities and affiliated risks, PoR is misleading. A combined methodology and regular independent audits are needed.
• MEV and frontrunning: how to reduce regulatory risk? Implement anti-frontrunning mechanisms, disclose risks, monitor abuses, document response policies and incident reporting.

Compliance as a scaling strategy

I founded COREDO in 2016, and since then I have seen every day how entrepreneurs lose momentum because of regulatory uncertainty. This is especially noticeable in projects with virtual assets: licensing, AML, bank accounts, infrastructure — too many things are moving at once. In this article I have compiled the practices our team has tested in the EU, the UK, Estonia, the Czech Republic, Cyprus, Singapore and Dubai, and I also examined in detail the topic “Crypto licensing in Bulgaria” with a focus on VASP registration in Bulgaria, AML requirements and the impact of MiCA. This is not a forward-looking overview, but practical steps, metrics and solutions that help teams launch on time, keep compliance risks under control and achieve a predictable ROI.

Bulgaria: an entry point for VASP

Bulgaria attracts with the simplicity of company incorporation, a modest corporate tax and flexible approaches to registering virtual asset service providers. crypto company registration in Bulgaria proceeds without excessive barriers: the corporate structure is set up quickly, and VASP registration relies on the EU anti‑money‑laundering requirements (AMLD5/AMLD6) and national rules. For a startup this means a shorter regulatory lead time and a manageable time‑to‑market.

AMLD5/AMLD6 and MiCA: the role of registers

Today Bulgaria applies a VASP registration model (exchange services and custodial wallets) in state registers and under AML supervision. The FIU (Financial Intelligence Unit) functions are performed by the Directorate of Financial Intelligence, and VASP accounting is conducted in accordance with national norms and the requirements of AMLD5/AMLD6. Licensing of virtual assets in Bulgaria is often used as a market term, but legally it is a registration regime with compliance, reporting and inspection obligations.

MiCA and Bulgaria

MiCA introduces a pan-European authorization for CASP (Crypto‑Asset Service Providers) and uniform standards: capital, governance, client protection, as well as passporting. The impact of MiCA on VASP licensing in Bulgaria is twofold: on one hand, the existing VASP registration serves as a “temporary berth” for launching; on the other, it creates a basis for future CASP authorization with minimal process refactoring. Our experience at COREDO has shown that the “migration” from a registration regime to MiCA authorization proceeds smoothly if you account in advance for the minimum capital requirements, governance and information security (IS).

EU passporting for VASP

MiCA opens full EU passporting for CASP: having obtained permission in one EU country, you can offer services across the Union. Before MiCA, companies have to rely on equivalence, local registrations or “mutual recognition” frameworks, which complicates cross‑border compliance. The solution developed at COREDO envisions choosing Bulgaria as the “base” state with a subsequent expansion plan via MiCA passporting once the rules are fully in force.

EU anti-money laundering legislation and the FIU

VASP in Bulgaria are obliged entities. They perform KYC/KYB, CDD and EDD, implement transaction monitoring and submit SARs (suspicious activity reports) to the FIU. Regulations for crypto exchangers in Bulgaria require an internal AML policy, risk assessment procedures, appointment of an MLRO (Money Laundering Reporting Officer) and staff training. The regulatory landscape also includes FATF requirements, including the Travel Rule for VASP‑to‑VASP and transactions to non-custodial wallets (VASP‑to‑OB) through additional checks.

VASP business models — compliance with regulations

Each model — exchange, brokerage, custodial service, OTC, payment gateways — carries its own risks and a set of prudential measures. I often ask founders to start with a risk appetite statement and a process map: without this it is difficult to align the AML framework, technical architecture and capital requirements.

Prudential capital requirements

Capital requirements for VASPs in Bulgaria are currently modest at the registration stage, but MiCA introduces threshold capital requirements and minimum reserves by type of service. Minimum registration capital requirements for VASPs in Bulgaria depend on the corporate form, while the future MiCA authorization foresees fixed levels (benchmarks of 50–150 thousand EUR by service type). I recommend building in a buffer: regulators value a conservative approach to capital and liquidity.

Corporate structure and governance

Legal structure, holding, subsidiaries, branches: determine the tax burden and the manageability of risks. Corporate governance and directors’ responsibilities require real control: regular meetings, a risk committee, minutes, independent audits. The COREDO team has implemented corporate frameworks where the duties of the MLRO, CTO and the risk director do not critically overlap, and backup authorities ensure business continuity (BCP/DR).

Tax optimization and transfer pricing

Taxation of crypto companies in Bulgaria is based on the general corporate tax (10%) and local VAT rules. Crypto–fiat exchange operations in the EU are often exempt from VAT, but the details depend on the specific service and the contract with the client. In transfer pricing, transparency and documentation are mandatory, especially for cross-border services within a group.

Company registration prior to VASP

The COREDO team regularly runs “end‑to‑end” projects where we take on the full cycle: from company formation to the “go‑live” launch of operations, including bank accounts, AML policy and technology implementation.

Company registration in Bulgaria

Opening a company in Bulgaria for a crypto project typically takes 5–10 business days after the package is prepared. Beneficial owners and directors are entered into the register, UBO (Beneficial ownership disclosure) is disclosed, and compliance officers are appointed. requirements for beneficiaries and the ownership structure for VASP in Bulgaria include transparent source of funds and clear control.

VASP in Bulgaria: documents and AML

Realistic timelines and cost

license processing times for VASP in Bulgaria (registration) depend on the completeness of the package and the readiness of the AML architecture. In our practice: 4–8 weeks for VASP registration after incorporation and agreement on the AML package. The cost of VASP licensing in Bulgaria consists of legal services, AML/IB consulting, notary and state fees, and the technology stack; TCO for the first year varies depending on the model (exchange vs custody) and the level of automation.

How to reduce the risk of rejection

The risks of license refusal for VASP in Bulgaria are most often associated with:

• a weak MLRO track record and lack of relevant cases;
• incomplete disclosure of UBO and source of funds;
• formal AML procedures without real control points;
• inadequate IT security.

Compliance architecture AML/KYC

Compliance procedures for small VASP require balance: excess control harms the customer experience, lack of it increases SARs and regulatory inquiries. I build a “layered” architecture: from risk policy to technology and KPIs.

Reporting to the FIU and AML requirements

AML requirements for VASP in Bulgaria include:

• Risk Assessment and Risk Appetite with annual updates;
• CDD/EDD scenarios and periodic KYC refresh;
• transaction monitoring in real time and rule engines;
• SARs, procedures for filing suspicious reports to the FIU;
• Reporting requirements for VASP in Bulgaria on training, incidents and internal audits.

KYC/KYB: sanctions and GDPR

KYC for crypto companies in Bulgaria is built on multi-level verification: document, biometrics, liveness, geo-risks. Best KYC practices for Bulgarian VASP include PEP screening and sanctions lists (OFAC/UN, EU), plus additional rules for legal entities (KYB). GDPR and personal data protection for VASP are a separate priority: data residency and storage of KYC data, data subject rights, DPIA for high-risk processes.

Blockchain transaction analytics

MLRO: independent review and audit

Requirements for the MLRO (qualifications, independence, access to the board of directors) set the tone for the entire function. Requirements for internal audit and independent review of compliance – an annual cycle, coverage of key processes, sample testing and a report to the board of directors. AML training and staff upskilling form the overall culture and reduce operational mistakes.

Compliance team KPIs

Custody, keys, access

The technology stack affects risks as much as the legal form. I rely on the principles of “security by design” and certification.

Custody key management

Custody models: custodial vs non-custodial define different depths of control. Requirements for cold and hot wallet management under Bulgarian regulations are described at a high level, so we cover them with best practices: HSM, MPC, threshold signatures and multi‑sig. Key management (custody) procedures for VASP Bulgaria include role separation, on-call shifts, segmentation and change control.

Information security and continuity

ISO 27001, SOC 2 and cybersecurity standards create a foundation of trust. Access control, IAM and least privilege principles reduce insider risks; audit trail and logging requirements help incident response and audits. Operational resilience and business continuity (BCP/DR) are a mandatory part of risk passports.

Integrations and liquidity

Integration with exchanges and liquidity pools requires API integration and security standards, as well as counterparty assessment. Technology stacks for VASP – from KYC/AML to Wallet and Custody – we select taking into account the target revenue model and TCO so as not to “overheat” CAPEX at launch.

Bank accounts and payment partners

Bank account for a crypto company in Bulgaria: a common question among founders. I always say: accounts are opened not by presentations, but by your compliance and case study.

Agreements with banks and EMIs

Agreements with banks and payment providers in the EU require clear limits, described VASP‑to‑OB scenarios, completion of Due Diligence and demonstration of a control environment. Interaction with banks and payment partners for VASPs in Bulgaria is built on a transparent risk assessment and clear SLAs for monitoring. When a bank is conservative, we add EMI solutions with SEPA and fast onboarding.

Data management

Entering EU markets

How to scale a VASP after obtaining a license in Bulgaria? I recommend a two‑track strategy: compliance maturity and commercial expansion.

How to bring the product to market

Market‑entry and go‑to‑market procedures for VASPs depend on the segment: retail, B2B, institutional. Revenue models, fee‑for‑service, spread, custody fees, dictate UX, SLAs and even compliance metrics. The COREDO solution: launching pilot segments with a controlled budget and measurable LTV/CAC to avoid “burning” capital at an early stage.

Cross-border license compatibility

Cross‑border compliance and a multi‑jurisdictional strategy involve matching local rules with the future MiCA passporting. Compatibility of a Bulgarian license with licenses of other EU countries becomes linear after MiCA: passporting replaces the cascade of local registrations. Until then we choose “core” markets and providers to avoid duplicating costs.

What regulatory sandboxes are

Regulatory sandboxes and pilot regimes in the EU can give an edge on time‑to‑market. In Bulgaria the focus is on careful pilots with banks and EMIs, where the compliance architecture is already in place and easily auditable.

TCO, unit economics and project ROI

The decision to obtain a license is about economics. I ask teams to record TCO and unit economics from day one.

TCO and compliance costs

Compliance costs and the TCO (Total Cost of Ownership) assessment include: legal support for the VASP in Bulgaria, AML/IB platforms, audits, training, independent checks, policy updates and insurance. Add overhead for regulatory lead time and capital reserves.

Unit economics: CAC/LTV and revenue models

Unit economics of the license: CAC and LTV for the VASP show the model’s resilience. For a spread model liquidity and turnover are important; for custody, AUC (assets under custody) and fees. Real-time transaction monitoring and rule engines are not only about risk but also about conversion: a low false-positive rate strengthens the UX.

ROI, NPV and payback

How to assess the ROI from licensing a VASP in Bulgaria? Compare NPV taking into account TCO, expected customer base growth and the timing for MiCA passporting. ROI metrics — payback period and NPV — become more predictable with a stable regulatory lead time and clear agreements with banks.

COREDO Case Studies: What Worked

I believe in the power of case studies: they are better than any declarations.

Small EU VASP: launch and risk control

Asian fintechs entering the EU via Bulgaria

Custodial platform: technical security

Founders’ Frequently Asked Questions

I’ve collected the questions I hear most often and the answers that work for us.

What documents are needed at the start?

Beneficiaries, personnel and partners

How to choose a legal partner

Relationship with banks and reputation

VASP registration in the EU via Bulgaria

If your clients are in the EU, Bulgaria provides a quick start, straightforward VASP registration and preparation for MiCA. The compatibility of Bulgaria’s license with the licenses of other EU countries will strengthen as MiCA and passporting are fully implemented. This reduces fragmentation and the costs of duplicating compliance.

VASP business model for Bulgaria

COREDO’s Position and Conclusions

I lead projects where speed is as important as reliability. Bulgaria gives entrepreneurs the chance to open a company quickly, complete VASP registration and simultaneously prepare for MiCA realities: EU passporting, common standards and predictable requirements. The COREDO team has implemented dozens of such routes, and I see consistent patterns: a strong MLRO, a mature AML architecture, technological discipline (HSM/MPC, IAM, ISO 27001/SOC 2), a transparent economic model (TCO, CAC/LTV, NPV) and a calibrated plan “registration – launch – scale: MiCA”.

Legal support for VASP in Bulgaria is not about paperwork; it’s about a strategy where compliance becomes a competitive advantage. If you are evaluating a crypto license in Bulgaria or a VASP license in Bulgaria as a route into the EU, lay the right foundations: uncompromising AML/KYC, managed operational security and a clear revenue logic. Then the “regulatory wind” will fill your sails, not blow in your face.

I founded COREDO in 2016, and since then our team has supported dozens of international projects: from company incorporations in the EU and Asia to obtaining crypto, payment and forex licenses. Over the years one topic consistently returns to the agenda of executives and CFOs: whether it is possible to work with clients from the EU without a license if the contacts originate from the clients themselves. This is MiCA reverse solicitation — a narrow corridor of lawful cross-border servicing where the time to market, compliance risks and profitability are at stake.

MiCA: what falls within the scope

MiCA rules for CASPs cover custody and administration of crypto-assets for clients, trading platform operations, exchange of crypto-assets for fiat or other assets, order execution, crypto-asset placements, receipt and transmission of orders, and crypto-asset advisory. If you perform these functions for EU clients from the territory of a third country, you must understand the boundaries of MiCA reverse solicitation and the national rules of complementation in individual member states.

The European Securities and Markets Authority coordinates practice together with national competent authorities (NCAs), but enforcement details are often shaped at the country level. Our experience at COREDO has shown: ignoring local guidelines is a short route to enforcement and regulatory inquiries, even if formally you rely on pan-EU rules.

What is reverse solicitation
I use a working definition: MiCA reverse solicitation is a situation where an EU client on their own initiative (client-initiated contact) approaches a provider in a third country, and that provider provides a service without prior individual or mass solicitation of demand in the EU. This is the passive reception doctrine: you accept a passive inbound, rather than creating an economic nexus by active measures in the Union.

MiCA licensing logic and exceptions
Exceptions to MiCA’s licensing obligation essentially boil down to the correct application of reverse solicitation, but national regulators calibrate the threshold of permissible actions differently. In one COREDO project for a client from Dubai we agreed with local lawyers in two EU jurisdictions the boundaries of permissible web communication: neutral content, no personalized offers, a strict ban on EU-ID retargeting.

MiCA transitional provisions are important for providers already operating under local regimes before full implementation. At the same time transitional provisions do not make reverse solicitation limitless: NCAs continue to apply their own economic presence tests, and ESMA publishes enforcement guidance that influences interpretations.

Servicing EU clients from a third country (onshore vs offshore servicing) is permissible in the absence of presence and substance in the EU, by forming a contractual structure outside the EU and building processes around passive reception. But as the share of EU clients grows and onshore teams, representative offices or agents appear in the Union, the risk of forced jurisdiction and enforcement arises.

Legally offering crypto-asset services
The key question is how to document inbound client requests. The solution developed at COREDO includes multi-level recording of client-initiated contacts in the CRM and web platform logs: recording the original click source, storing the voluntarily submitted contact form, timestamp, IP and geodata, as well as screenshots of user journeys.

Best practices for crypto service providers include an opt-in onboarding process where the client confirms they initiated the contact independently, understands the absence of an EU license and acknowledges that servicing is provided from a specific third country. Consent documentation and record-keeping requirements under MiCA require retaining these confirmations for periods at least equal to the document retention policy adopted in your jurisdiction and aligned with EU expectations.

The evidentiary basis in a dispute with a regulator relies on audit trails and IT logging. At COREDO we add to the legal memorandum an evidence preservation layer: captured versions of the site at the time of contact (web archives), cold campaign logs (showing zero EU targeting), internal instructions to managers prohibiting proactive contacts. Such COREDO practice demonstrates that even in the event of a regulatory request you can present a structured defense line.

KYC and EDD under reverse solicitation
AML principles under reverse solicitation are not weakened: a risk-based approach is mandatory just as it is for licensed activity. I recommend building KYC/CDD processes for non-residents from the outset, including PEP screening and EU sanctions lists, confirmation of beneficial ownership (UBO), and source-of-funds and wealth checks when internal thresholds are exceeded.

Enhanced Due Diligence for clients from the EU is necessary in cases of heightened risk related to jurisdiction, transaction typology or product category (for example, highly volatiletokens, participation in off-chain transactions, working with mixers). In some projects the COREDO team implemented a hybrid model: basic KYC in-house, while EDD and screening are carried out by a certified provider, with transparent outsourcing of compliance to a third party.Marketing: pre-contractual communication
Restrictions on advertising and cold outreach, the basic rule of reverse solicitation under MiCA. Any contact activity directed at EU residents, including partner programs with EU bloggers, referral payments, localized landing pages “for EU clients”, are red flags for NCAs. legal opinion drafting for reverse solicitation at our firm always includes a legal assessment of advertising campaigns and oversight of marketing materials.

Pre-contractual communication rules of MiCA allow responses to specific inquiries, but prohibit expanding the dialogue into mass mailings.

Structuring relationships with an EU client

Transparency and disclosure in reverse solicitation are an ally, not an obstacle. Proper product governance, client segmentation and territorial risk assessments, as well as a documented evaluation of the applicability of the MiCA scope to specific assets (for example, ART or EMT), will help demonstrate the model’s good faith to NCAs. At COREDO we formalize governance and board-level oversight in the form of a report to the board on the share of EU clients and triggers for migration to licensing.

Data protection and GDPR implications are also critical. Even if you are outside the EU, processing personal data of EU residents requires GDPR compliance: appointing a DPO where necessary, legal bases for processing, cross-border data transfers and contracts with processors. Confidentiality and information exchange with counterparties must take into account banking secrecy, local AML rules and NCAs’ requirements.

Risks: compliance, reputation, taxes

Limiting reputation risks requires a conservative information policy and readiness for regulatory inquiry. Evidence preservation and a document retention policy are not formalities: the absence of log records and screenshots often undermines the provider’s legal position. Our clients who had an established audit trail went through checks with minimal losses.

Tax consequences of cross-border services depend on economic presence. The economic nexus test and the risk of a permanent establishment (PE) in the EU depend on where key managerial decisions are made, where employees are located and where marketing is conducted from. We recommend assessing cross-border tax reporting implications together with tax advisors and taking into account CRS/FATCA when structuring.

Checklist for responding to a request from an EU client

• Confirm client-initiated contact: record the channel, time, IP, consent.
• Check geotargeting: exclude retargeting and personalized offers for the EU.
• Perform KYC/CDD, conduct PEP/sanctions screening, determine the risk profile.
• Assess tokens: MiCA scope and classification (ART/EMT/utility), product limitations.
• Provide disclosures: non-resident provider status, lack of an EU license, contract jurisdiction.
• Appoint the MLRO responsible for monitoring and the travel rule, record thresholds and alerts.
• Preserve all evidence: website screenshots, CRM logs and marketing platform logs.
• Assess the share of EU clients and thresholds for migration to EU licensing.
• Prepare a legal opinion on MiCA reverse solicitation and internal instructions for the team.

Licensing or reverse solicitation
Licensing vs servicing via reverse solicitation: a matter of cost-benefit analysis. The economic feasibility of operating without a license is high at early stages when you need to quickly test a product and reach initial transactions. But compliance cost modeling shows: as the share of EU revenue grows, the cost of marketing controls, legal opinions and enforcement risks begins to exceed the CAPEX for obtaining a license in the chosen EU jurisdiction.

Exit strategies include migrating the business to the EU or servicing remotely while obtaining a license in a country oriented towards CASP. A regulator sandbox program option sometimes accelerates testing of innovative products. Registration formalities in the EU and interaction with a local lawyer, preparation of governance documents, AML policies and procedures for CASP, this is an area where the COREDO team has implemented full cycles, including product governance and board supervision.

Practice and interaction with ESMA/NCAs

The COREDO team prepares legal opinions on MiCA reverse solicitation taking into account national nuances, including the legal position of third countries and MiCA, product mapping and assessment of the marketing footprint. We agree with the client in advance on a response playbook: who responds, what data is disclosed, how the internal compliance manual for CASP is demonstrated, and how evidence preservation is presented.

Practical tip: conduct a pre-emptive gap review of marketing, onboarding and IT logging before going live with EU traffic. It is faster and cheaper than urgently fixing traces after a regulatory letter.

Internal policies and controls
Drafting an internal control policy for CASP in the context of reverse solicitation is not a simplified version of the “full” license. Documents should cover the risk-based approach to AML/CFT, KYC/EDD, transaction monitoring algorithms, thresholds for SAR, travel rule, outsourcing governance and data quality controls. The internal compliance manual for CASP structures the roles of the MLRO, the second line of defense and escalations to the board.

Governance and board-level oversight address strategic issues: limits on the share of EU revenue, triggers for moving to licensing, a compliance and legal risk reserve budgeting model. It is at this level that it is decided whether reverse solicitation will remain an experiment or become a bridge to a full EU presence.

COREDO practice examples that work
Case 1: a Singaporean provider serving EU holdings on a request basis. The COREDO team built opt-in onboarding, centralized KYC with EDD for high-risk profiles and a strict “no EU marketing” policy. We prepared a legal opinion on MiCA reverse solicitation with a risk map and a migration plan to a Cypriot license upon reaching a 25% EU-share threshold. A regulatory inquiry from one of the NCAs was closed with an evidentiary base: logs, screenshots, instructions.

Case 2: a Dubai VASP with active content marketing. COREDO’s audit revealed hidden geotargeting to several EU countries and a referral network with EU bloggers. We froze the campaigns, rewrote public disclosures, implemented pre-clearance, trained the sales team and put in place a document retention policy. At the same time we started the licensing process in Estonia; after 8 months the company moved to an onshore model.

Case 3: a British fintech platform with utility tokens. The legal assessment showed exceptions for some tokens, but ancillary services fell within the MiCA scope. COREDO’s practice confirmed: mixed models more often err in classification. We separated product flows, for some — reverse solicitation with neutral web architecture, for others — an application for a license in Slovakia.

Contract models and data protection
Contract models with an EU client should include: choice of law and dispute jurisdiction outside the EU, clear product restrictions, terms for termination of service on regulatory grounds and notifications, disclosure of economic and legal risks. Contracts should set out mechanisms for KYC/EDD, consents for processing and transfer of data, as well as the provider’s rights to transaction monitoring and freezing operations upon red flags.

When reverse solicitation is not advantageous
Business model alignment with MiCA requires an honest assessment. If your growth depends on marketing, partnerships and public promotion, reverse solicitation will limit scaling and increase the cost of compliance. If the business case envisages a significant flow of clients from the EU, it is advisable to plan for EU licensing in advance, choosing jurisdictions with a clear NCA practice and accessible infrastructure (for example, Cyprus, Estonia, some Central European countries).

Compliance cost modeling helps management see where the breaking point lies between the costs of legal protection for the reverse model and the CAPEX/OPEX of a licensed presence. The COREDO team often calculates scenarios: a basic reverse for 6–9 months, a hybrid model with limited marketing and a full transition to a license with an onshore team and presence and substance requirements.

What the regulator will ask during an inspection
Preparation for a regulator’s inspection on client-initiated contacts: it is not only documents. Regulators check product governance, the continuity of the customer information trail, monitoring stability, response to alerts and the competence of the MLRO. We conduct simulated requests where the client team answers questions about site structure, onboarding logic, token classification and the use of EU sanctions lists.

The regulatory perimeter under MiCA changes as ESMA publications are released, and COREDO regularly updates templates of the internal compliance manual for CASP. This allows rapid implementation of changes: for example, strengthening requirements for pre-contractual disclosures or revising the passive client test procedure.

Nuances of ART, EMT and utility tokens
Asset-referenced tokens are regulated more strictly, especially regarding issuance, reserves and disclosures. E-money tokens under MiCA trend towards requirements similar to electronic money, including capital and safeguarding of funds. Utility tokens may be outside MiCA with a narrow functional purpose, but as soon as trading availability or an investment motive appears: we return to the MiCA scope.

COREDO helps clients with product mapping: a matrix of token functions, use scenarios, impact on AML/KYC and product restrictions in reverse solicitation. This reduces the risk of incorrect classification and NCA claims.

From hypothesis to a sustainable model

• Carry out a MiCA scope and applicability assessment to the product, taking into account national transpositions.
• Decide whether the model allows passive inbound without marketing in the EU.
• Build web and CRM architecture with inbound logging, disable EU targeting.
• Develop an internal compliance manual, AML policies, travel rule procedures and the MLRO role.
• Set up KYC/CDD/EDD, sanctions and PEP checks, transaction monitoring.
• Prepare a legal opinion on MiCA reverse solicitation and a response plan for inquiries.
• Agree on ToS, agreements, disclosures, a privacy notice and GDPR processes.
• Identify triggers for moving to licensing, calculate ROI and choose a jurisdiction.
• Maintain record-keeping, evidence preservation and regular board oversight.

Conclusions

The COREDO team has walked this path with clients many times: from the legal opinion and process setup to transitioning to a licensed model in the EU. I am convinced that resilience in the crypto-economy is built on two pillars – strategic clarity and operational excellence. Reverse solicitation can become your bridge to Europe if you define the boundaries in advance, stay within the regulatory perimeter and make a timely decision about licensing.

Since 2016 I have been leading COREDO through dozens of regulatory cycles and changes in the EU, the UK, Singapore and the UAE. The COREDO team has gone all the way from company formation and CASP/VASP licensing to building mature AML‑programs, reserve proofs and setting up operational resilience. In this article I have compiled the strategy we actually use in projects: how to prepare a crypto exchange and related fintech services for MiCA in the EU and for VARA in Dubai by 2026, with details, not theory for theory’s sake.

MiCA and VARA: what you need to know in 2026

MiCA and VARA are already shaping a new regulatory landscape for crypto-assets, so it is worth having a clear understanding of the main implications for businesses and users. Below we break down what is important to know in 2026: the scope of MiCA, requirements for providers and practical interaction with VARA.

Scope of MiCA

VARA mandate in Dubai

CASP vs VASP, terms and responsibilities

In the EU under MiCA, Crypto‑Asset Service Provider (CASP); in Dubai — Virtual Asset Service Provider (VASP). The difference is not only in terminology. COREDO’s practice confirms: VARA describes technological and information requirements in greater detail (logging, cybersecurity, BCM), while MiCA focuses on prudential and market integrity aspects for EU market participants. For crypto exchanges the question “MiCA vs VARA for crypto exchanges” often means not choosing “or” but “and”, when an international structure builds a licensing architecture covering both jurisdictions.

Extraterritoriality and equivalence

Market entry: EU vs Dubai

Choosing a strategy for market entry in the EU or Dubai is determined by differences in regulation, taxes and access to customer and technological infrastructure. Special attention should be paid to passporting under MiCA and its limitations, which directly affect the speed and scalability of presence in Europe.

MiCA passporting: limitations

VARA license for exchanges in Dubai

ROI from compliance: CapEx vs OpEx

How to obtain a crypto exchange license

Licensing crypto exchanges is a complex process implemented through clearly structured step-by-step procedures that minimize regulatory and operational risks. The first key stage, registration of a legal entity in the EU and bringing operations into compliance with MiCA requirements, is followed by the preparation of documents, compliance processes and technical integration.

Registering a legal entity in the EU under MiCA

Registration in the UAE: Free Zone/Mainland

Migration of license, clients and data

Capital, governance and risk management

Understanding capital requirements, effective governance and reliable risk management processes form the basis of financial resilience and compliance with regulatory standards. In the next section we will examine the minimum capital and reserves necessary to maintain solvency and cover potential losses.

Minimum capital and reserves

Management of conflicts of interest

Operational resilience (BCM)

AML/KYC: from policies to technologies

AML/KYC today requires a shift from formal policies to technological solutions that automate checks and minimize operational risks. This is especially important when implementing MiCA and VARA requirements and when organizing KYC/EDD for corporate clients.

KYC/EDD requirements under MiCA and VARA

Travel Rule for cross-border transactions

FATF, AMLD5/6 and STR/CTR with authorities

Sanctions, screening, PEP/SDN and information exchange

Proof of reserves and asset custody

The topics of custody, proof of reserves, and overall asset security define the rules for storage and transparency when working with digital assets. Below we will review MiCA’s custody requirements and the key provisions of custodian agreements that help ensure compliance with these standards.

Agreements and custody under MiCA

Custody models under VARA and insurance

Proof of reserves: audit and certification

CISO and cyber risks of wallet providers

Disclosure and investor protection

Operational transparency and detailed disclosure: key elements of effective investor protection in the digital assets space. In the following subsections we will examine MiCA’s disclosure requirements, the organization of the token register and the content of the whitepaper that help implement these principles in practice.

MiCA disclosure: registry and whitepaper

Stablecoin regulation and reserves

Protection of token marketplace consumers

Compliance and operational integrations

Tools for compliance and support of operational integrations combine automated risk monitoring, blockchain activity analysis and ML models to fight fraud. Below we will examine the key elements in detail: KYT and on‑chain monitoring, anti‑fraud ML and graph analytics.

KYT and on-chain monitoring

ROI assessment: automation, BPM, KPI/KRIs

Integration with banks: PSD2 and KYC

Blockchain interoperability and oracles

Regulatory supervision and sanctions

Attention to supervision and potential sanctions has become a key factor for market participants: non-compliance with rules often entails operational and reputational risks. Below we examine regulatory practice at the ESMA and national regulator levels, including reporting requirements and the frequency of document submissions.

Reports to ESMA and national regulators: frequency

VARA regulatory sandboxes: appeals

Supervisory sanctions and fines

COREDO Case Studies: launching exchanges in the EU and Dubai

COREDO case studies demonstrate how we bring exchanges to the EU and Dubai markets through a phased regulatory compliance strategy. Next, we will break down the MiCA compliance plan — from onboarding counterparties and setting up internal processes to scaling operations and maintaining compliance.

Exchange compliance plan under MiCA

VARA risks and controls in Dubai

Migration from Asia to the EU: clients and data

Liquidity, M&A and exits

For sustainable business expansion, liquidity, proper M&A planning and well‑thought exit strategies remain key. In the following section we will examine the principles of liquidity management and stress testing that help assess a company’s ability to withstand shocks and prepare for deals and exits.

Liquidity management and stress tests

IPO and M&A exit strategy: regulatory framework

Impact of geopolitics and sanctions

Checklist for launching an exchange under MiCA/VARA 2026

• Legal structure: SPV/branch/subsidiary; beneficial ownership register; tax planning.
• Licensing: CASP under MiCA with passporting; VARA VASP classes for exchange/custody/broker-dealer.
• Governance: board, independent directors, risk committee; roles CCO, MLRO, CISO.
• Capital and reserves: minimum requirements and buffers; liquidity plan and stress tests.
• AML/KYC: risk‑based KYC/EDD, sanctions (PEP/SDN), STR/CTR, FATF/AMLD5/6, Travel Rule (OpenVASP/Sygna/TRP).
• Custody: hot/cold wallets, multisig, HSM, insurance; agreements with custodians under MiCA.
• Proof of Reserves и аудит: methodology, independent attestation, regular public reporting.
• Technology: KYT, on‑chain analytics, anti‑fraud ML, SIEM/PAM; BPM automation, KPI/KRIs.
• Transparency: token registry and classification under MiCA; whitepaper and disclosures; market conduct.
• Operational resilience: BCM, incident management, RTO/RPO, redundant sites and backups.
• Integrations: banking gateways, PSD2 compatibility, banks’ KYC requirements.
• Regulation: reports and frequency, VARA sandboxes, right of appeal, engagement with the regulator.
• Data and GDPR: DPIA, client and data migration, contracts with providers, access control.
• Smart contracts: audits, bug bounties, deployment management; oracle risks and interoperability.

Why COREDO is a long-term partner

The 2026 MiCA regulation for crypto-assets and the 2026 VARA regulation for virtual assets in Dubai set a high bar for crypto exchanges. For some it’s a barrier, but I see a window of opportunity: passporting under MiCA, equivalence and international recognition of VARA, mature procedures, a foundation for scaling without regulatory surprises. Our experience at COREDO has shown that the right compliance architecture not only grants market access but also saves capital, speeds up deals, and increases company valuation.

Since 2016 I have been building COREDO as a company that removes regulatory uncertainty for entrepreneurs and financial directors. During this time the COREDO team has obtained licenses and set up operating models in the EU, the United Kingdom, the Czech Republic, Slovakia, Cyprus, Estonia, Lithuania, Singapore and Dubai. In this article I have compiled practical recommendations on CASP licensing, with a focus on capital, personnel, AML and technological resilience. I draw on the experience of numerous projects so that you can immediately see where the main value lies and how to avoid costly mistakes.

Why MiCA and global supervision now

The European MiCA regulation introduces common requirements for CASPs regarding capital, organizational structure and client protection, and also provides passporting mechanisms in the EU. COREDO’s practice confirms: the new regime raises the entry threshold, but with proper preparation accelerates scaling across regions and reduces fragmentation of requirements. We take into account that MiCA and the capital requirements for CASPs tie own funds to the set of services and fixed overhead costs.

Choosing a jurisdiction and market entry

Decisions on choosing a jurisdiction and forming a market entry model define the legal, tax and commercial framework of expansion. Below we will examine step by step how these factors manifest in the EU context: from regulatory harmonization to requirements for economic substance.

EU regulatory harmonization

MiCA creates uniform rules, but in practice each state retains particularities in supervision and expectations regarding local presence. Economic substance and local presence of a CASP are not a formality: real resident directors, an office, a full-time MLRO, and management functions within the country strengthen the position at the application stage. At COREDO we design the organizational structure of the CASP in advance for licensing and prepare a passporting strategy to later use cross-border CASP services without duplicating licenses.

Estonia, Malta, Lithuania offer different entry barriers. In Estonia the minimum share capital for a VASP depends on the services and usually ranges from €100,000 to €250,000; personnel and control requirements have been strengthened since 2022. In Malta the VFA classification raises the bar for capital and governance: for advanced classes this means hundreds of thousands of euros and enhanced internal controls. Lithuania actively welcomes crypto business: VASP registration is possible, but banks and payment providers expect confirmed substance and a mature AML framework.

Depth and supervisory models in four countries

The FCA conducts strict registration of crypto companies: there is no formal minimum capital, but a CASP’s own funds must cover risks and fixed expenses, and personnel must demonstrate competencies and independence of compliance functions. FINMA and the Swiss cantonal regulators apply a high level of scrutiny to custody solutions and directors’ responsibilities. In Singapore under MAS’ PSA for DPT providers the minimum capital and security deposit depend on the volume of operations; mature processes for cybersecurity and key management are expected. In Dubai, VARA imposes clear requirements for product documentation, outsourcing of critical functions, and SLAs with providers.

CIS: a bridge to the EU and Asia

Capital for CASP: terms and calculations

For proper capital management within CASP it is important to first build a clear understanding of key terms before moving on to practical calculations. In the first section we will go through the basic terminology and regulatory logic to lay the foundation for further capital assessment methods and concrete computations.

Terminology and regulatory logic

Capital versus liquidity: the regulator for CASP requires both. Capital is a buffer against losses; liquidity is the ability to meet obligations and withstand outflows. Some jurisdictions apply elements of ICAAP: internal capital assessment and stress-testing, and risk-weighted assets (RWA) are adapted to the nature of crypto exposures and operational risks.

Risks, stress tests and capitalization

How to calculate capital requirements for a crypto exchange? We take the minimum CASP share capital, add a buffer to FOE (fixed overheads) for 12–18 months, account for CASP reserve capital requirements for custody and cyber risk coverage. Capitalization strategies when scaling a CASP include additional issuances, subordinated debt as a source of regulatory capital within limits, and cyber insurance, which indirectly reduces net losses in stress scenarios.

Funding and corporate actions

Personnel: fit and proper and organizational design

A company’s effectiveness largely depends on its personnel, adherence to the fit and proper principles, and thoughtful organizational design. In the following points we will examine staffing requirements and leadership roles in detail to understand how to build competencies, responsibilities, and managerial interactions within the organization.

Requirements and leadership roles

The roles of MLRO, CCO, CTO, CFO, CIO in a CASP allocate responsibilities: MLRO: management of AML and SARs, CCO – overall compliance framework and reporting, CTO/CIO – security, keys, infrastructure, CFO: capital, liquidity, reporting. The responsibility of CASP directors and staff is personal: the regulator assesses their decisions, the management of conflicts of interest in CASP leadership, and the independence of control.

Hiring and screening effectiveness

Recruitment and personnel screening procedures for a CASP include background checks, biography checks, criminal record and sanctions screening of the director, verification of education and actual achievements. Preparing CVs and proof of experience for CASP applicants should be substantive: projects, KPIs, implemented rollouts, certifications. The composition of the compliance and AML department in a CASP is built from an MLRO, KYC/KYB analysts, a sanctions officer, a reporting officer, and an independent internal auditor.

Ongoing operating expenses for CASP personnel should be planned for 12–18 months ahead. Performance indicators for the compliance function (KRI, KPI) include SLA for KYC, alert processing time, escalation rate, SAR quality, as well as ROI metrics from investments in compliance personnel. The assessment of the economic efficiency of hiring vs outsourcing shows: some functions are cost-effective to keep in-house, while others should be given to an external provider. Compliance function: in-house vs centralized for a CASP group: often a hybrid model with coordination at the holding level.

Succession, motivation and retention

Technologies, security and resilience

Reliable technologies, the indispensable foundation for ensuring the security and operational resilience of services. Below we will examine in detail custody, segregation and key management practices that are critically important for protecting assets and maintaining operations during incidents.

Custody and key management

Asset insurance and client loss coverage reduce operational risks; cyber insurance and capital requirements are linked: having adequate coverage can affect the assessment of residual risk in ICAAP. Agreements with liquidity and leverage providers should limit counterparty risks, and outsourcing exchange engines and SLAs for critical functions are required with transparent RTO/RPO.

Compliance and privacy

Technical requirements: SOC2, ISO27001, regular pentest, vulnerability management and access control. Business continuity and backup policies support operational resilience, while incident reporting and engagement with the regulator reduce regulatory risks during outages. Practices to prevent personal data leaks (GDPR/PDPA) and integration of HR and compliance for access control to assets close significant security gaps.

Independence of quality control

internal audit and the quality control of CASP personnel assess the effectiveness of the first and second lines of defence. Critical functions can be outsourced, but responsibility remains with the directors; we define vendor control KPIs and independent monitoring. Engagement with external auditors and capitalization reviews helps demonstrate the maturity of risk management.

License application: documents and process

Properly assembled documents and a structured submission process are the key to a successful application, and checkpoints help track readiness at each stage. We’ll start with organizational matters, then go over substance requirements and finish with the practical part – a business plan that confirms the project’s economic justification.

Substance of the organization and business plan

Product documentation details custody chains, exchange procedures, brokerage, limits on client transactions and margin risks. Segregation of client funds is codified in contracts and operating instructions, taking into account regulatory guidance on custodian vs exchange liabilities. The organizational structure of a CASP for licensing demonstrates the independence of compliance and risk functions.

Deal structure: timing and cost

Timing and cost of obtaining a CASP license depend on the jurisdiction and the readiness of the materials. In the EU, with a quality package, review takes from 3 to 9 months; in Singapore and Dubai: longer for complex models. We assess in advance the ongoing operating expenses for CASP personnel and funding sources for the CASP license to avoid cash shortfalls at the finish.

Reporting and control in the operational phase

In the operational phase, reliable reporting and continuous internal control become key to minimizing risks and ensuring compliance with standards. Regulatory reporting and AML are especially important – they require clear coordination of procedures, data transparency and prompt incident response.

AML and regulatory reporting

Internal reporting procedures and regulatory reports record compliance with capital and liquidity requirements, security incidents and governance changes. Capital and liquidity reporting rules vary, but in all cases a transparent accounting of own funds for CASP and FOE is required. AML reporting and Suspicious Activity Reports (SAR) require a qualified MLRO and precision in escalation procedures.

Liquidity management in cases of laundering and rapid outflows relies on pre-approved limits and stress plans. Setting limits on client transactions and margin risks reduces the likelihood of sudden breaks and market cascades. Regulatory fines and license refusals typically occur due to undercapitalization, weak AML and unverified sources of capital; the COREDO team remedied such situations through recapitalization and redesign of the KYC/KYB framework.

Structure audit, modification and closure

Regulatory approvals for changes to capital structure and corporate rights: a standard practice when scaling. External auditors check capitalization, IT controls and compliance with GDPR/PDPA. Business closure procedures and protection of clients’ interests include an asset return plan, regulator notifications and an independent audit of segregation.

COREDO case studies: where details matter

In Lithuania, the COREDO team implemented a project for an exchange CASP oriented toward a MiCA passport. The key was the strategy: the minimum capital for the CASP was covered with equity, and the CASP’s own funds were strengthened with subordinated debt within the limits. We implemented an ICAAP approach and outflow stress tests, recalculated FOE for 18 months and achieved a comfortable assessment by the regulator.

In Singapore, a solution developed at COREDO helped a DPT provider obtain a status compliant with PSA requirements. We built a SOC2-compliant architecture, implemented KMS/HSM and multisig, conducted a pentest and set up incident reporting. MAS positively assessed the competencies of the MLRO and the independence of internal audit.

In Estonia, our experience at COREDO showed how critical staffing requirements are for crypto companies. We supplemented the team with a strong MLRO, separated the CCO and MLRO roles, strengthened Travel Rule integration, and updated AML policies in light of AMLD6 and FATF. The result: a successful license review, reduced risk of enforcement actions, and stable relationships with banks.

In Dubai, the COREDO team established outsourcing of exchange engines with strict SLAs, formalized agreements with custodians and custody terms, and provided for asset and cyber risk insurance. This allowed for reduced capital add-ons for operational risks and sped up VARA approval. We also implemented KPI/KRI for compliance to transparently demonstrate ROI at the board level.

Checklists for CASP license

• Capital and liquidity:
  • Own funds (own funds): minimum and FOE ≥ 25% of annual expenses.
  • Proof of sources of capital: bank statements, SPA, audit.
  • Recapitalization plan: additional share issuance, subordinated debt, cyber risk insurance.
  • Liquidity reserves and stress tests: outflows, margin calls, provider outages.
• Personnel and governance:
  • Fit and proper for CASP management; independent CCO, qualified MLRO.
  • Procedure for checking the director’s background, criminal record and sanctions clearance.
  • Management succession plan; Risk, Audit, RemCo committees; conflict of interest.
  • Compensation models and risk-oriented bonuses; compliance KPI/KRI.
• Technology and security:
  • Segregation of client funds; cold/hot wallets, KMS, HSM, multisig.
  • KYT: Chainalysis/Elliptic/TRM; Travel rule provider; sanctions lists.
  • SOC2/ISO27001; pentest; BCP/DR; incident reporting and contact with the regulator.
  • SLA with outsourcers; agreements with custodians and liquidity providers.
• Documentation and process:
  • Organizational chart and job/function descriptions; local substance.
  • Business plan: products, revenue models, stress scenarios, financial forecasts.
  • AML/CTF policies, sanctions, KYC/KYB, SAR reports; internal reporting.
  • Passporting plan to the EU; assessment of tax and licensing consequences.

Cost planning and return on investment

Assessing the economic efficiency of hiring vs outsourcing requires comparing TCO: salaries, training and certification of AML/CTF staff, software licenses, external auditors. Metrics for return on investment in compliance and security are measured by reductions in losses from incidents, refusals in banking relationships, fines and licensing timelines. Techniques for optimizing personnel and compliance costs include a centralized center of expertise for the group, policy harmonization and shared services.

Staff planning when entering new markets builds in increased workloads for the MLRO and IT security, as well as stronger Travel Rule compliance and reporting. Economic efficiency assessment that takes into account capital threshold requirements by jurisdiction (EU/Asia/CIS) helps choose the optimal scaling route. comparison of jurisdictions by entry barrier and personnel cost we record in the financial model to support the board of directors’ decision.

Trends and Recommendations

Regulatory trends: tightening capital requirements after incidents and clarifying regulatory guidance on custodian vs exchange liabilities. Benchmarking of capital requirements between the EU and Asia shows an increased emphasis on FOE and operational risk. The impact of crypto insurance on capital requirements is becoming noticeable: regulators view real coverage with minimal exclusions positively.

Managing liquidity and sudden increases in outflows is becoming a key competency. Management of conflicts of interest, the role of the board of directors and committees, measures to reduce operational and reputational risk: all of this affects the assessment of an organisation’s “fit and proper” status. Taxation and reporting requirements for CASP require constant calibration as product lines and geography change.

Lessons from COREDO’s practice

In one project, the regulator initiated license revocation due to a capital shortfall after market fluctuations and an increase in FOE. The COREDO team quickly prepared a recapitalization plan, arranged subordinated debt, and updated the ICAAP and stress scenarios. The regulator accepted the adjustments, and the client avoided a business shutdown and strengthened liquidity reserves.

Another case concerned the travel rule: the provider was failing to meet SLAs and AML alerts were piling up. The solution developed at COREDO included replacing the provider, rebuilding the alert logic, setting KPIs for the team, and improving the MLRO’s competencies. Within two months processing time decreased threefold, and SARs became more accurate in structure and content.

I also highlight a project on the transition from a subsidiary to a branch in the EU. We assessed licensing implications in advance, adjusted capital and internal reporting, and agreed on governance changes. As a result the client retained passporting and optimized their tax position without regulatory delays.

How to gain time and reduce risks

The sooner you turn regulatory requirements into a concrete plan, the easier it is to scale the business and protect clients’ interests. Regulators in the EU, the UK, Switzerland, Singapore and Dubai expect from CASPs the same as from mature financial participants: sufficient capital, responsible management, transparency and operational resilience. COREDO’s experience confirms: it is these principles that make crypto business sustainable and predictable over the long term.

I have led COREDO since 2016 and every day I see the same thing: companies lack structured, pragmatic compliance that works as a business asset rather than a bureaucratic overlay. Over years of working in the EU, the Czech Republic, Slovakia, Cyprus, Estonia, the United Kingdom, Singapore and Dubai, the COREDO team has delivered hundreds of projects – from company incorporations and obtaining financial licenses to building AML/CFT systems and regulatory reporting. This text is not a review of ‘best practices’, but a distillation from real cases, mistakes and solutions that turn a compliance strategy into a real driver of business growth and investor confidence.

Compliance as a competitive advantage

Compliance for international business

Compliance program: stages and KPIs

Registration and licenses – Europe/Asia/CIS

COREDO cases: from idea to operations

Third parties in international supply chains

RegTech and compliance automation

Compliance in investments and M&A

Budget and ROI for the Board of Directors

Culture of learning and continuous improvement

Frequently Asked Questions from Clients

What leaders should remember

Conclusions

Since 2016 I have been leading COREDO through a shifting regulatory landscape, helping entrepreneurs from Europe, Asia and the CIS launch and scale fintech businesses. Over that time regulators have learned to speak the language of technology, and technology — the language of regulators. I see how the fintech director has evolved from a visionary product specialist into an architect of corporate governance for fintech, a proponent of the risk-based approach and a leader of change. And every time the COREDO team takes on a project, I start with a simple question: how to turn regulatory expectations of fintech directors into a competitive advantage?

In this article I have gathered practical approaches, hands-on tools and proven frameworks that at COREDO consistently lead to licenses, a sustainable operating model and flawless inspections. I deliberately use plain language but employ precise terminology — this way our clients build a shared vocabulary with regulators and increase trust at every stage.

Company registration and jurisdiction selection

jurisdiction selection – not about the speed of opening an account and not about “where it’s cheaper to register an LTD”. This decision is about regulatory risk appetite, market access, compliance costs and reporting requirements. COREDO’s practice confirms: early calibration of objectives (payments, e‑money, crypto, brokerage, lending, neobank) saves months and tens of thousands on restructuring.

We most often compare the EU (Lithuania, Cyprus, Estonia), the United Kingdom, Singapore and Dubai. In Europe the PSD2 linkage and open banking matter, in the United Kingdom: FCA expectations for senior managers (SM&CR) and mature financial crime practice, in Singapore – MAS sandbox and an approach to risk‑based licensing, in Dubai: a focus on virtual assets and structuring client funds. The COREDO team carefully assesses local specifics: regulatory supervision for neobanks, requirements for e‑money providers, safeguarding and escrow options.

License vs local registration

In conversations with clients I rarely recommend a “one‑size‑fits‑all license” without a clear go‑to‑market model. An international license opens doors, but only where it is recognized. Local registration for a pilot market sometimes provides a faster product‑market fit and manageable compliance. The solution developed at COREDO typically includes a map of passporting opportunities, post‑Brexit constraints, requirements for agents/distributors and a plan for subsequent harmonization in the EU or Asia.

EU passporting after Brexit

Service passporting is a real advantage for payment institutions and EMIs, but only with a robust model of three lines of defense (three lines of defense) and readiness for cross‑border supervision. After Brexit a UK license does not provide automatic access to the EU, and “reverse” passporting is impossible. Our experience at COREDO has shown: a hybrid architecture with EU‑EMI and UK‑AEMI can cover both zones with a reasonable compliance TCO.

Beneficial owner (BO) checks

In the EU and in several Asian jurisdictions the beneficial owners register (BO) is part of basic hygiene. We build in advance the evidentiary base of source of funds, the ownership structure and the chain of control to withstand enhanced Due Diligence. This sharply reduces friction when opening accounts and speeds up onboarding with partner banks.

PSD2, crypto and brokerage licenses

When it comes to licensing, the main thing is not the list of documents but the alignment of the operating model with the regulator’s intent. I think in terms of governance, risk, compliance and reporting. This helps design processes so the regulator sees risk control embedded in the fabric of the business, not in detached policies.

Licensing of payment institutions

A payment institution in the EU requires evidence of control over operational and financial risks. We rely on EBA guidance on managing payment risks: risk segmentation, incident management, outsourcing, IT and security. For PSD2 compliance we prepare:

• a map of products and data flows, including eIDAS and electronic signing schemes;
• regulatory reporting for fintech: formats, deadlines, SLAs, process owner roles;
• GDPR and fintech requirements: privacy by design, DPIA and data pseudonymization;
• procedures for client money rules, safeguarding and reconciliation.

Requirements for e-money providers

For EMI we always model capital adequacy requirements taking into account growth rate, seasonality and stress scenarios. Safeguarding client funds is the core of trust: segregated accounts, escrow structures and daily reconciliations. At COREDO we implement checkpoints for custody vs safeguarding so that no custodial storage function is disguised as protection of client money.

Regulation: AMLD5/AMLD6 and the Travel Rule

We divide crypto regulation for companies into three layers: Licensing of VASPs, AML/CFT and data requirements. Directives AMLD5 and AMLD6 and VASP requirements demand a risk‑based approach, EDD for PEPs, and KYC/KYB processes adapted to on‑chain risks. The Travel Rule sets standards for data transfer in inter-exchange transfers of crypto assets; here we design secure channels and data-sharing agreements. At the same time we take into account sanctions compliance for fintech (OFAC/UN/EU) and restriction registers.

Neobank and regulatory sandboxes

Regulatory sandboxes: a tool, not a goal. I design a sandbox procedure for fintech as a managed experiment with clear hypotheses, metrics and a sandbox exit strategy. In the UK we focus on FCA SM&CR and the role of senior managers; in Singapore – MAS sandbox and Singapore’s requirements on risk disclosure; in Hong Kong, regulatory practice of the HKMA and SFC. We agree in advance on regulatory forbearance, checkpoint mechanisms and a commercialization plan after exit.

Corporate governance of fintech

The right architecture of governance determines the “health” of a license for years to come. The fintech director today: an integrator of product, risk and compliance, owner of culture and performance benchmarks.

Regulatory expectations for fintech directors

Regulatory expectations for fintech directors include transparency of decisions, a managed risk appetite, demonstrable competencies and process resilience. The fintech leader’s responsibility extends to strategy, product economics, fintech compliance and supplier‑chain resilience. The role of the fintech director in the corporate governance system is to ensure a balance between growth and control, to define tolerance statements and to monitor their operationalization.

Compliance director KPIs

What do regulators expect from the compliance director? Clear board reporting, independence of the second line of defense and measurability of controls. We implement KPIs and KRIs: false positive rate and triage speed, SAR rate, detection rate for key scenarios, the closure rate of audit findings and the maturity of continuous monitoring. We complement this with reverse stress testing and scenario analysis so the board can see the boundaries of resilience.

Product cybersecurity: the leader’s role

How does the fintech director ensure product cybersecurity? Through the cloud shared responsibility model, contractual guarantees and regular checks. I build in penetration testing and red team exercises, API vulnerability controls, SIEM/SOAR processes and incident response with pre‑defined communication to the regulator. This reduces operational risk and readies the evidentiary base for inspection.

AML for fintech: detections

Compliance does not live in documents but in data and case‑level decisions. We configure processes so they are fast for the customer and persuasive for the regulator.

How to build an AML program in a neobank

The roadmap always starts with RBA: segmentation of customers, products, channels and geographies. Next — KYC/KYB, identity verification (IDV) and biometric verification with KYC orchestration to reduce friction and increase conversion. We incorporate PEP screening, Enhanced Due Diligence for high‑risk profiles, counter‑terrorism financing controls (CFT) and anti‑money laundering reporting requirements for payment services.

Transaction monitoring and algorithmic risk

Transaction monitoring systems require careful tuning of scenarios. We combine expert rules and machine learning for fraud detection with explainable AI to ensure algorithmic transparency. Model risk management is a mandatory layer: model governance, model backtesting, drift monitoring, model risk management in scoring and anti‑fraud systems. For complex schemes we use graph analytics and network analysis to improve signal quality.

Sanctions compliance

The sanctions program begins with a risk taxonomy and covers sanctions screening, OFAC/UN/EU lists and local registries. I recommend taking into account the impact of sanctions on supply chains and payments, supplementing vendor due diligence and continuous vendor monitoring. For complex jurisdictions we build a “dual‑track” counterparty screening and near‑real‑time monitoring of sanctions updates.

Regulatory reporting/SAR/audit trail

Suspicious Activity Report (SAR) and interaction with the FIU or FinCEN: an area where speed, completeness and security matter. We prepare regulatory reporting with clear SLAs, requirements for log retention and auditing (audit trail) and continuous monitoring procedures. This ensures reliability and readiness for sudden supervisory requests.

GDPR and data governance

Data is the lifeblood of fintech, and GDPR is the anatomy. I always start with a map of data flows, legal bases, and transfer boundaries.

Schrems II: SCC/BCR and privacy by design

GDPR: the legal aspects of transferring customer data require consideration of Schrems II and international data transfer mechanisms — SCC and BCR. At the same time, we implement privacy by design, DPIA and requirements for pseudonymization and protection of customer data. eIDAS facilitates cross-border payments and identification, but does not eliminate the need for thoughtful cryptography and access controls.

Outsourcing and third-party risks

Outsourcing is not a way to “shift responsibility”, but an area of increased regulatory scrutiny. I design controlled boundaries with clear metrics and accountable parties.

Outsourcing governance: evidence

Shared responsibility and cyber risks

Approaches to risk management when outsourcing cloud providers include the shared responsibility model, encryption, segmentation, least privilege and monitoring. Contractual guarantees are complemented by technical measures: logging, anomaly detection, periodic red team exercises and independent audit.

Cross-border supervision and coordination

Interagency coordination and cross-border supervision mean that queries may come from several regulators at once. I proactively arrange communication channels, mapping of regulatory requirements and allocation of roles within the team to ensure a coordinated position.

Regulatory transformations, automation

Regtech today is not a fashionable option, but a way to keep pace with change. I evaluate not only functionality, but also TCO (total cost of ownership) and ROI from investments in AML and regulatory automation.

AML roadmap and change management

The roadmap for implementing an AML project at COREDO consists of discovery, design, build, validate, run. We create regulatory intelligence and mapping of regulatory requirements, configure continuous controls monitoring and prepare the team through targeted training. Change management mitigates the risks of service disruption and loss of knowledge.

Regtech platforms: performance metrics

Regulatory inspections: preparation

Inspections are part of a license’s lifecycle. The more transparent the processes, the smoother the inspection.

Checklist for AML inspection readiness

The regulatory checklist for launching a payment product includes confirmation of capitalization, governance, IT and security, AML/CFT and data protection. How to prepare a company for an AML regulator inspection? We build an audit trail, pre-assign communication owners and compile an “evidence package”: policies, triage procedure, logs, case examples and SAR. internal audit helps to capture an objective picture before the inspectors arrive.

Reputational risk and dealing with findings

After an inspection, a constructive follow-up is important. I use a matrix of findings’ severity, owners and deadlines, and regular reports to the board. This strengthens regulator trust and reduces reputational risk during inspections.

COREDO case studies: what worked

Examples are the best way to show how approaches come to life in real projects. Below: several case studies where the COREDO team delivered on complex objectives on time.

EMI in Cyprus: capital, safeguarding

For a B2B‑fintech we launched an e‑money license in Cyprus. We developed a capital adequacy model with reverse stress testing, set up safeguarding and an escrow model, and established client money rules. For PSD2 compliance we connected open banking modules with eIDAS certificates and carried out a DPIA. The regulator accepted the operating model without additional rounds of questions, a sign of maturity in the documentation and processes.

VASP in Estonia: Travel Rule

A crypto service in Estonia required a VASP license and a full AML/CFT framework. We implemented KYC/KYB with biometrics, configured the Travel Rule, integrated sanctions screening against OFAC/UN/EU lists and network analysis to identify high‑risk wallets. The regulator noted strong explainability in the detection models and transparency of case management.

Neobank in the UK: SM&CR and sandbox exit

For a European startup we designed participation in the UK sandbox and built an SM&CR matrix for senior managers. We defined sandbox metrics, continuous monitoring and a commercialization plan. The sandbox exit strategy included scaling compliance and an international data architecture taking Schrems II and SCC into account.

EU institute: cross-border outsourcing

In a payment institution project in the EU we established outsourcing governance with the cloud provider, defined SLAs and control points, conducted vendor due diligence and continuous vendor monitoring. The regulator requested evidence of supplier risk management, and the prepared package demonstrated process maturity, including contractual guarantees and resilience tests.

Roadmap for the fintech leader

To translate regulatory requirements into growth, I propose a simple framework. It helps the fintech director maintain a balance between product and supervision across different regions.

Steps for scaling compliance

1. Formulate the regulatory risk appetite and tolerance statements, align them with the board, and operationalize them into metrics.
2. Build the three lines of defense, define critical KPIs for the fintech director on risk and compliance, and integrate them into the OKR cycle.
3. Deploy regulatory intelligence, account for fintech regulation in Europe, MAS and HKMA/SFC in Asia, and evolving expectations in Africa.
4. Plan compliance scaling when entering international markets: passporting where possible and localization where required.
5. Prepare incident response and communication with the regulator, including inter-agency coordination and cross-border supervision.

Resilience – discipline, not an accident

Over the years I have learned: a reliable fintech company grows from discipline in the details, from choosing a jurisdiction to configuring transaction monitoring systems and board reporting. Yes, regulation changes and becomes more complex. But with a sound governance architecture, a clear RBA and thoughtful automation, regulatory requirements become an ecosystem where it is easier for a business to grow and earn trust.

The COREDO team has delivered dozens of projects in the EU, the UK, Singapore, Estonia, Cyprus and Dubai: and each time our approach has remained the same: transparency, measurability, risk manageability and respect for the logic of supervision. If you are building a payment service, an e-money provider, a crypto service or a neobank, I have a simple recommendation. Start with a requirements map and an honest assessment of operational maturity, then step by step build processes that will withstand inspection in any jurisdiction. This is how a business that is trusted by customers, banks and regulators is created, and how it scales steadily without unexpected regulatory “brakes”.

Since 2016 the COREDO team has implemented dozens of projects for registering companies in the EU, Asia and CIS countries, obtaining financial licenses, setting up AML and launching operational processes for fintech. In this article I have compiled the experience that helps clients move from the idea of a payment service to an international scalable model with passporting, a transparent compliance function and a sustainable economic model.

PI or EMI: license or partnership

The first fork: EMI license vs PI license. Licensing of an EMI and a payment institution differs in essence: an EMI may issue electronic money and hold customer balances in wallets, while a PI provides payment services without issuing e-money. These are different business risks, capital requirements and safeguarding procedures for customer funds in the EU, so the choice should be driven by the product roadmap.

The second fork — license vs partnership with a bank. A partnership model (sponsored BIN, white-label, agency agreements) speeds up an MVP launch and reduces CAPEX, but adds dependence on another party’s compliance policy and limits international scalability. Registering your own payment institution in the EU requires time and resources, but provides control, pricing flexibility and direct access to schemes and correspondent banks. Our team often builds a hybrid: a quick start through a bank partner, followed by opening a payment institution in the EU for key markets.

The legal structure is also important. Legal models — branch vs subsidiary — for entering the EU market offer different levels of substance and risk manageability. A subsidiary simplifies passporting and interaction with regulators, whereas a branch is suitable for testing hypotheses or limited presence. For non‑EU groups you need to consider passporting limitations and the lack of full equivalence: often the right move is to create EU substance with independent management and local compliance.

EU regulators: PSD2, EBA and discretions

PSD2 regulation of payments in the EU and the EBA’s guidance on payment services have formed the basic layer of requirements. But within this framework national PSD2 discretionary rules and differences in EU regulators’ requirements for payment institutions apply. Our experience at COREDO has shown that properly aligning national approaches saves months and reduces the amount of correspondence in the licensing process.

• regulatory requirements of BaFin for payment institutions place greater emphasis on IT security and outsourcing (MaRisk, BAIT), thorough management checks and clear segregation of duties. This is a market with intensive supervision and a high quality of dialogue, but expectations regarding substance and operational maturity are above average.
• ACPR’s regulatory requirements for payment institutions focus on consumer protection, safeguarding and incident management. In an application, clarity of governance, third‑party contracts and a measurable staff training programme are valued.
• DNB’s regulatory requirements for payment institutions have traditionally been strong on integrity risk and the management of outsourcing chains. In the Netherlands they pay close attention to control models, the independence of the compliance function and the realism of financial plans.
• Banco de España’s regulatory requirements for payment institutions add an emphasis on local presence and reporting. The regulator expects a well‑thought‑out implementation of transaction monitoring requirements and scenario‑based risk analysis.
• The Central Bank of Ireland’s (CBI) regulatory requirements are known for the strict “fitness and probity” threshold, the structure of PCF roles and the requirement for detailed operational resilience plans. It is one of the most consistent review practices in the EU.
• CSSF and Banca d’Italia demonstrate high expectations for capital, IT controls and AML. In Italy it is important to carefully describe ring‑fencing and liquidity buffers, whereas in Luxembourg — to demonstrate the maturity of risk management when outsourcing actively.

The ECB’s roles and supervision in payment infrastructure concern the oversight of clearing/settlement systems and systemically important operators. For PI/EMI the main contact is the national regulator, but ECB standards form the backdrop of expectations regarding resilience and incident reporting. Ongoing supervision versus preferential procedures across EU countries vary in inspection intensity, but the general trend is greater focus on operational risks and cyber resilience.

Capital, safeguarding and liquidity

Capital requirements for payment institutions in the EU depend on the range of services and are calculated under PSD2 methodologies (Methods A/B/C), and the minimum initial capital for PI is usually in the range of €20–125 thousand. For EMI it is higher, typically from €350 thousand, taking into account electronic money issuance and the specific risks of holding balances. Capital requirements: minimum amounts and buffers are combined with capital reserve requirements and capital adequacy based on stress‑tests and growth plans.

Safeguarding via segregated accounts vs trust accounts: a key choice of operational model. In some jurisdictions insurance/guarantee alternatives apply, but segregation of funds in accounts at credit institutions predominates. Differences in reserve and ring‑fencing requirements appear in the details: the timeframe for daily segregation, permissible custodian banks, reconciliation mechanics and independent audit checks.

AML/KYC: policy and metrics

AML requirements for payment institutions are built on the AML Directives (AMLD5, AMLD6) and the recommendations of FATF. They require assessing risks, applying KYC/KYB, beneficial owner (BO) verification procedures for PI, monitoring transactions and establishing reporting on suspicious operations. The solution developed at COREDO often includes risk matrices by jurisdictions, products and channels, as well as the design of an escalation “ladder” and exception handling.

SCA/RTS, GDPR and resilience

Outsourcing and fraud prevention

Outsourcing and third-party management in payment institutions are an area of increased inspection scrutiny. Management of business partners and Due Diligence of vendors should include assessment of financial stability, security controls and the compliance of their subcontractors. Requirements for third-party risk management and SLAs imply metrics for availability, response times, quality of investigations and a documented escalation procedure.

Regulatory frameworks affect both permitted and prohibited business models for payment institutions, including restrictions on holding funds outside safeguarding and mixing client and own funds. Regulatory restrictions on FX and cross-border payments vary by country, especially regarding correspondent chains and exotic currencies. Regulation of interbank settlements and clearing (SEPA) sets standards for formats and timelines, and connection to schemes requires mature processes and a reliable IT architecture.

Documents, timelines, and the economics of compliance

The documents and the package for applying for a payment institution license include a business plan, financial models, policies and procedures, a description of the IT architecture, outsourcing agreements, safeguarding mechanics, a BCP/DR plan, compliance matrices, and management questionnaires. The COREDO team carefully synchronizes the operational and legal parts so that no “gaps” arise between the business and compliance vocabularies in correspondence with the regulator. This reduces the number of request rounds and speeds up the process.

Scalability, M&A and reputation

Requirements for internal control and the compliance function should be strengthened as growth occurs: independence, direct access to the board of directors, regular reports and improvement plans. Requirements for audit and external reporting and regulatory reviews and inspections: preparation and response are organized through a pre-approved “playbook” and a set of KPIs/evidence. Managing reputational risks in case of non-compliance includes transparent communication, a corrective action plan and documenting progress.

MiCA and tokenized assets

Crypto payments regulation and the intersection with MiCA is becoming a new reality for payment companies that want to accept or convert digital assets. Rules for e-money and the issuance of tokenized assets differ, and custodial vs non-custodial models in payments carry different risks and expectations regarding controls. At COREDO we help separate the flows: payment services under PSD2, e-money under EMI, and crypto services under national and pan-European MiCA regimes, so as not to “mix” risks and licences.

COREDO case studies – from application to growth

Another example – a fintech company’s entry into the German market targeting open banking services. We mapped BaFin’s IT and outsourcing requirements against the existing cloud architecture, strengthened change control and implemented an independent pen‑testing process. At the same time an approach to safeguarding via segregated accounts at a tier‑one bank was agreed and transaction monitoring scenarios were configured, which reduced operational risks and sped up integration with partners.

Payment institution launch checklist

• Licensing strategy and geography. Determine where local substance is critical and how quickly passporting is required, and build a PI vs EMI and bank‑partnership vs own‑license model over a 24‑month horizon. This approach reduces regulatory duplication and unnecessary costs of rebuilding the architecture.
• financial resilience and safeguarding. Calculate capital and buffers, choose a segregated vs trust account model, prepare agreements with custodian banks and descriptions of reconciliations. Ensure that ALM metrics and stress scenarios are available “at the push of a button”.
• Compliance and AML. Set up KYC/KYB, BO checks, OFAC/EU sanctions screening, PEP procedures and transaction monitoring with ML scenarios. Implement SAR/detection metrics and a false‑positives reduction program with feedback from investigations.
• Technology and security. Implement SCA/RTS, an API policy for open banking TPPs, GDPR controls and a data processing register. Conduct an independent pen test and document BCP/DR plans under DORA with incident reporting procedures.
• Outsourcing and third parties. Conduct supplier due diligence, agree SLAs, audit rights, exit plans and control subcontractors. Verify that the cloud architecture complies with local regulator requirements.
• Reporting and inspections. Prepare a regulatory calendar, report templates, a playbook for inspections and a change‑notification process for business‑model changes. Regularly train staff and maintain a culture of compliance.

COREDO’s scalable regulatory growth

Registrations, licences and AML are not “paperwork”, but a risk-management system that underpins the international payments business. When the foundation is strong – capital requirements are met, safeguarding is transparent, SCA/RTS are implemented, the AML framework is measurable and technological, growth happens faster, and the dialogue with regulators becomes constructive. At COREDO I insist on sequence: first strategy and architecture, then documentation and evidence, and only then the submission.

If your plan is to enter the EU and use passporting while keeping processes transparent and saving time, start with a well-considered roadmap. COREDO’s practice confirms: a strategy backed by measurable controls and attention to detail turns regulatory requirements into the foundation of long-term partnership with the market and regulators.

Company registration in the EU, Asia and the CIS, obtaining financial licenses and building a reliable AML framework are not separate projects, but interconnected elements of a resilient strategy. When an entrepreneur gains the ambition to operate simultaneously in the Czech Republic, Slovakia, Cyprus, Estonia, the United Kingdom, Singapore and Dubai, complexity grows exponentially. My task as a leader is to propose a path that preserves control, speed and transparency, and at critical points relies on technology, including artificial intelligence in AML.

In recent years the team COREDO has implemented dozens of projects where legal design, licensing and AML monitoring reinforce each other. Our experience at COREDO has shown: the earlier you account for AML and AI regulatory requirements and design KYC/KYB processes, the easier it is to scale the business, open accounts, integrate payment gateways and pass audits. In this article I have compiled a practical guide that connects strategy, procedure and technology, and also answers common questions of owners and chief financial officers.

Choosing jurisdiction and structure

The right jurisdiction: it’s not about “the fastest register”, but about alignment with the business model, the license and traffic sources. In the EU this is primarily compliance with the EU AML Directives (AMLD5/AMLD6), GDPR requirements and local supervisory authorities. In Asia and the Middle East we take into account the MAS in Singapore and UAE regulators, including DFSA/VARA in Dubai, as well as the recommendations of FATF. COREDO’s practice confirms: investing time in a preliminary AML gap analysis reduces risks when opening accounts and interacting with banks.

Companies working with payments, forex or digital assets feel the difference in levels of evidential basis. For example, in the United Kingdom the regulator expects a mature risk model and transparent case management, whereas in Cyprus the emphasis is more on governance and an independent AML audit. The solution developed at COREDO,, is country regulatory map templates that show requirements for capital, key functions (MLRO, compliance), reporting and SLAs with KYC providers.

When choosing a structure, I recommend the compliance-by-design principle. This means that the ownership chain, substance, local directors and operational flows are pre-aligned with the future license and AML model.

Differences and priorities of EU countries

In the Czech Republic and Slovakia we see a stable legal environment and clear substance requirements. Cyprus remains popular for payment services and forex companies, with a focus on CySEC and detailed AML policies. Estonia is useful for digital companies, including virtual asset operators, while the regulator is demanding regarding real presence and AML systems.

United Kingdom: it’s about mature practices and close scrutiny of governance, as well as the need to demonstrate the explainability of models if AI is used in AML. The COREDO team often moderates dialogue with banks, explaining hybrid rule+ML AML solutions and false positive control.

Singapore and Dubai – Asia and the Middle East

Singapore via MAS sets a high bar for risk management, data quality and independent model validation. In Dubai, including DIFC and virtual assets in VARA, clear boundaries between the front office, the AML function and independent audit are important. Our experience at COREDO has shown that local adaptation of KYC/KYB and sanctions screening speeds up onboarding of partners and clients in these markets.

Compliance by-design: AML and licenses

I proceed from the assumption that each license is a set of procedures and metrics that must be embedded into the architecture from day one. Automation of client verification (KYC/KYB), real-time sanctions screening, adverse media screening using NLP and NER, as well as a documented data ownership line (data lineage), are not “optional” but a basic outline.

Financial licenses: forex, crypto

Licenses for payment services, forex activity, crypto services and even limited banking operations require varying depths of capitalization, internal policies and staffing roles. We use COREDO checklists for the document package, including the business plan, risk appetite, description of AML processes, training plans and disaster recovery. We separately document AML monitoring, alert criteria and their triage process.

Regulatory requirements and FATF

EU AMLD5/6 insist on beneficial owner transparency and sanctions screening; FinCEN is strengthening requirements for SARs and quality assurance. COREDO’s practice confirms that explainable AI for AML (XAI) is becoming an expectation of regulators, not just a technological trend.

Documentation and timelines: common bottlenecks

The main bottlenecks are unclear sources of funds (SoF/SoW), weak data governance and inconsistent KYC profiles. We offer structured templates for SoF, external data enrichment sources and entity resolution procedures for complex corporate structures.

COREDO licensing cases

Recently a solution developed at COREDO helped a Europe‑focused payment provider structure an EMI licensing package taking into account a hybrid AML architecture. We implemented graph-based transaction analysis to detect circular patterns and symmetric peers and prepared XAI reports for the regulator using SHAP. The result: an accelerated dialogue with the regulator and a smooth launch of real‑time AML monitoring.

AI and AML in real practice

AML for international business is often perceived as an obligation. I prefer to talk about a competitive advantage: reduced operating costs, faster onboarding and increased payment conversion. artificial intelligence in AML allows shifting the focus from manual review of “noisy” alerts to investigating truly risky scenarios.

The COREDO team implemented projects where AML automation reduced false positives by 30–60%, while increasing recall on known patterns. ML-based transaction monitoring combined with a rule engine provides stability in known areas and flexibility for new anomalies. Importantly, we always preserve human-in-the-loop and transparent decision traceability.

Why businesses need AI in AML

• Reducing false positives in AML: targeted feature engineering and graph embeddings allow filtering out “white noise” without increasing false negatives.
• Optimizing AML alert triage: prioritization by risk score and cost per alert speeds up the response to genuinely dangerous events.
• Reducing the cost of AML investigations with AI: automatic context gathering, entity resolution and linkage reduce MTTI.
• Speeding up onboarding: KYC and artificial intelligence help complete checks in minutes while maintaining the quality of PEP and sanctions controls.

Hybrid rule-based and machine-learning AML solutions

The hybrid approach combines rule playbooks for known scenarios and anomaly detection models for “grey areas”. Real-time AML monitoring relies on streaming buses (Kafka/Kinesis/Pub/Sub), online scoring and low-latency stores (for example, Key-Value + an analytics lake like Snowflake/Databricks). Our architectures support API-first integration with core systems and case management, allowing flexible scaling during peak loads.

KYC/KYB, transactions and data quality

Data is the foundation. For international companies these are KYC/KYB profiles, transaction logs, device footprint, geolocation and external sources (sanction lists, PEP, adverse media). Improving data quality for AML models includes record linkage, fuzzy matching, data lineage and controls at the ETL/ELT stage. COREDO’s practice confirms: investments in data quality pay off first because they directly affect precision/recall and the number of alerts.

AML system models using machine learning

We use a combination of tree-based models (XGBoost), autoencoders for anomalies, isolation forest and clustering (DBSCAN/HDBSCAN). For graph scenarios, Neo4j/TigerGraph, graph embeddings (node2vec, DeepWalk) and, where appropriate, GNNs for complex network motifs.

AI/AML Roadmap

We start with the business case: where the losses are, which KPIs matter, what TCO is acceptable. Then we document regulatory requirements for AML and AI, and define the architecture and change management plan. I personally insist on a phased rollout: pilot, limited production, scaling, with a ModelOps loop and risk controls.

KPI and metrics: precision, recall, PR-AUC

We measure not only model quality but also operational metrics. Precision/recall and PR‑AUC for key scenarios; precision@k for priority alerts; alerts per 1000 customers; mean time to detect (MTTD) and mean time to investigate (MTTI).

ModelOps and XAI: model governance and drift

Explainability is mandatory: SHAP/LIME, counterfactual explanations and XAI reports for regulators. Managing model drift in AML requires continuous evaluation, backtesting and versioning models in a registry, with audit trails. The COREDO team implements model validation procedures and independent controls to eliminate the ‘black box’ in critical steps.

on-premises vs cloud: core banking, SIEM

Integration must be seamless. We connect AML scoring with core banking, payment gateways and orchestration systems, as well as with SIEM and event logging for a complete trace. The choice of on‑premise vs cloud vs hybrid depends on data localization requirements, latency and costs; often hybrid wins thanks to the balance of control and scalability.

Data privacy and GDPR

Legal aspects are a separate layer. For the EU this is GDPR and local personal data laws; in Asia and the CIS there are their own rules for cross-border data transfer. In some cases we used privacy‑preserving ML: federated learning, differential privacy and MPC, to train models without moving sensitive data across borders.

COREDO cases and results

I prefer to speak with facts. Below are three examples where AI and AML methods turned from a project into operational value with clear economics and compliance.

Reducing false positives at an EU provider

The client was a mid-sized international payments provider with offices in the Czech Republic and Slovakia, a growing merchant base, and fines for payout delays. The problem was a high level of false positives and an overloaded investigations team. The COREDO team implemented a hybrid rule+ML solution, including graph embeddings and adaptive thresholds; they introduced alert prioritization and automatic context collection.

XAI and crypto-provider checks

A virtual assets operator licensed in Estonia and Cyprus faced a requirement to increase the explainability of AML models. The solution developed at COREDO included SHAP reporting at the individual alert level, a backtesting and stress-testing framework on “synthetic laundering patterns”. At the same time we enhanced adverse media screening, applying BERT/transformer for NLP and entity resolution.

Scaling fintech in Singapore and Dubai

A fintech company from Singapore was entering Dubai with a new payments product line. The key challenge was scaling the AML-ML system and managing cross-border data within MAS and local UAE regulations. COREDO’s practice confirms the effectiveness of a hybrid architecture: data localization with federated learning, a centralized model registry and unified KPIs.

We implemented continuous training with model drift monitoring and auto-alerts for compliance officers. Operational metrics throughput/latency met the SLA, and precision@k for alerts at the top priority levels reached target values.

Frequently asked questions from clients

Frequently asked questions from clients about applying AI to combat money laundering reflect growing uncertainty: should a small international payments provider invest in such solutions and how to assess their effectiveness? Below we’ll review the key concerns, potential benefits and practical steps to make a well‑informed decision.

Is it worth investing in AI for AML?

Yes, if there is a clear business case: a high percentage of false positives, rising investigation costs, SLA pressure and plans to scale into new markets. For small providers we recommend a modular approach: start with automating KYC/KYB, sanctions screening and alert prioritization. The COREDO team has implemented lightweight pilots that pay back in 6–12 months through OPEX savings and improved onboarding conversion.

KPIs and metrics after deploying AI in AML

Minimum set: precision/recall for key scenarios, PR‑AUC, precision@k for top alerts, alerts per 1000 customers. Operationally: MTTD, MTTI/MTTR, cost per alert and cost per investigation, share of auto‑classification and escalation rate. Financially – TCO and ROI, expressed in reduced OPEX and losses from delays/penalties.

When will an AI project in AML pay off?

Typically 9–18 months, but much depends on the initial level of automation, data quality and regulatory constraints. Projects focused on reducing false positives and automating triage pay back faster. Longer payback occurs with complex graph analytics and strict data localization requirements; a phased rollout helps here.

Compliance risks of the machine-learning black box in anti-money laundering

The risk of decision opacity and the inability to defend them before a regulator. Mitigated by XAI: SHAP/LIME, counterfactual explanations, model cards, audit trails. We also apply human‑in‑the‑loop in the final decision, separating model assistance from the officer’s responsibility; this aligns with regulator expectations in the EU and Asia.

Human-in-the-loop for alert triage

Optimal is a three‑level scheme: auto‑closing low‑risk alerts, semi‑automatic triage for the mid‑range and manual investigation for high‑risk cases. Active learning helps direct labeling to where the model “is uncertain”, speeding up training. COREDO’s practice shows that such a scheme reduces MTTR and improves SAR quality.

AI regulators for AML in the EU, Asia, and the CIS

In the EU: AMLD5/6, EBA Guidelines, GDPR; in the UK: local guidelines on model explainability; in Singapore: MAS and AI governance guidelines; in the UAE: DFSA/VARA.

Data for cross-border ML in AML

The key is localization, minimizing transfers and pseudonymization. We use federated learning and differential privacy to train models on local data, transmitting only aggregates and gradients. Data lineage and data provenance are documented for audit and compliance demonstration.

On-premise vs cloud vs hybrid for AML AI

Hybrid most often wins: sensitive data and online scoring locally, training and analytics in the cloud. This balances security requirements, latency and cost. In critical markets we build an on‑premise stack with containerization (Kubernetes, Docker) and microservices, maintaining compatibility with cloud MLOps.

Reducing false positives for ROI

• Hybrid rule+ML AML solutions where ML enriches signals and refines context.
• Graph methods: graph embeddings and GNNs to reveal “hidden” connections.
• Adaptive thresholds and alert prioritization, supported by precision@k.
• Improving data quality, including entity resolution and external enrichment.

How to choose an AI vendor for AML

We look at explainability, experience in your industry, completeness of integrations (case management, SIEM, core), SLA for latency/throughput and model governance.

How COREDO works: approach, stages, SLA

I value process predictability. That’s why at COREDO we split the project into clear stages, define success criteria and support the client’s team at every step.

Diagnostics and design project

We start with legal and operational diagnostics: company structure, licenses, AML policies, data and IT landscape. We form a target architecture that includes AML monitoring, KYC/KYB flows, sanctions screening and integrations. We prepare a roadmap with KPIs, a TCO assessment and a change management plan.

Implementation and integration

We implement customer verification automation, connect external lists and adverse media with NLP, configure streaming scoring and case management. We introduce MLOps/ModelOps: model registry, continuous training/evaluation, backtesting and drift monitoring. At the same time we prepare XAI reports and a model governance framework for regulatory dialogues.

Support, audit and team training

We train analysts and MLROs, set up human-in-the-loop and active learning. We conduct regular AML audits, stress tests, regulatory simulations and playbook updates. We maintain a KPI dashboard: precision/recall, PR‑AUC, MTTD/MTTI, cost per alert and operational SLAs.

Key takeaways

International growth: it’s a combination of the right jurisdiction, timely licensing, and mature AML. Artificial intelligence in AML strengthens each element of this triad: it reduces operational costs, accelerates onboarding, and makes risk management predictable.

The COREDO team has implemented solutions that operate in the EU, the UK, Singapore and Dubai, and shows how integrating AI into existing AML processes leads to measurable results. If you are seeing an increased compliance burden, planning new markets, or preparing for licensing, it makes sense to turn AML into a source of advantage, not a compromise.

Limitations of traditional AML monitoring

Classic AML monitoring relies on rule-based systems, sanctions screening and threshold rules that raise alerts when fixed values are exceeded. This approach is supplemented by manual triage and investigations, where analysts gather context on the customer, transactions and external sources, including OFAC/EU sanctions lists and local registers. It is understandable, reproducible and familiar to regulators, but does not scale well as volumes grow and laundering patterns become more complex.

Key weaknesses: high false positive rates, poor resilience to changing schemes and difficulties with record linkage and fuzzy matching. Entity resolution often breaks on name variations, typos, transliteration and the «splitting» of entities across systems. As a result SARs are initiated late, MTTD/MTTI increase, and the costs of investigations and escalations rise.

Even a small reduction in alerts per 1000 customers and the false positive rate quickly converts into a lower cost per alert. These shifts also reduce the team’s workload, improving the quality of investigations and the proportion of truly relevant SARs.

AI in AML: when and how to apply

They are appropriate with mature labeling and stable investigation processes, especially in transaction monitoring and when assessing clients’ risk profiles. The key condition: a sufficient volume of quality labels and stable business processes.

Semi‑supervised and active learning combine limited labeling and iterative label collection through human‑in‑the‑loop. Hybrid rule+ML solutions provide the greatest controllability: rules capture known patterns, and ML surfaces “non-trivial” signals and refines context.

The choice of approach depends on data maturity, tasks and regulatory constraints. For PEP/sanctions screening, improvements in fuzzy matching, NER and match prioritization are effective, whereas for adverse media NLP/transformer models with vector search work better. In any scenario, data quality, clear definition of business cases and model drift monitoring are critical.

Anti-money laundering systems using machine learning

For an AML system with machine learning, a well-thought-out architecture that ensures scalability, reliability and rapid model integration is critical. In the following sections we will examine architectural patterns and key algorithms that determine the accuracy and speed of risk detection.

Architectural patterns

The production architecture is built around stream processing of transactions and batch analytics for training. Online scoring via API/webhook provides low-latency decisioning, and the feature store synchronizes features between online and offline. The MLOps loop includes a registry, automated tests, backtesting and canary deployments to safely roll out updates.

Algorithms: applicability

• Tree‑based (XGBoost, Random Forest): interpretable scoring of transactions and customers, strong on tabular data and ‘medical’ features.
• Neural networks: useful for complex nonlinearities and multimodal data, but require XAI pipelines.
• Autoencoder and Isolation Forest: unsupervised anomaly detection where there are no labels or patterns drift rapidly.
• Clustering (DBSCAN/HDBSCAN, k‑means): segmentation of customer risks, identification of atypical behavioral clusters and outlier groups.

Combining multiple methods increases robustness, and stacked models (ensembles) help balance precision/recall. Probability calibration and threshold tuning tied to KPIs and regulatory escalation policies are important.

Reducing false positives through GNN

Graph analysis combined with GNN helps reduce false positives by explicitly accounting for relationships between entities and transactions. In the following subsections we’ll examine what advantages graphs provide in AML and how these connections become informative features.

Graphs in AML: what do they offer?

Graph analysis in AML reveals hidden links between counterparties, devices, addresses, and beneficiaries.

Entity resolution on the graph merges duplicates and partial matches, reducing noise and improving accuracy.

Methods and technologies

Graph databases (Neo4j, TigerGraph) provide fast queries for motifs and subgraphs, and graph embeddings (node2vec, DeepWalk) translate topology into vectors for ML scoring. GNN (GraphSAGE, GAT) learn from the structure of connections and node/edge features, reducing false positives by contextualizing behavior.

Integrating graph features into the overall scoring improves precision@k and speeds up triage. This is especially useful in international networks where links span multiple jurisdictions and currencies, and sanctions matches require additional context.

NLP/transformers for KYC and adverse media

Using NLP and transformers enables automating and scaling checks in KYC, adverse media analysis and processing of transaction descriptions, increasing the accuracy of matching and risk detection. In the following subsections we will examine key use cases, from monitoring negative publications and identifying connections to normalizing and classifying transaction descriptions.

Use cases

NLP‑models increase the accuracy of adverse media screening, extract entities (NER) from documentary KYC/KYB flows and classify transaction descriptions.

Technology stack

The BERT/transformer family and specialized multilingual models work in tandem with OCR and data normalization. Relevance ranking, news deduplication and sentiment/stance analytics reduce manual work and improve the quality of signals.

Metrics and KPIs after AI implementation

Key model metrics – precision, recall, F1, PR‑AUC, precision@k and false positive rate – are linked to operational ones: alerts per 1000 customers, MTTD, MTTI, cost per alert and throughput/latency. For executives it is important to tie these metrics to economics, including TCO and ROI. Proper visualization of metrics in dashboards increases transparency and manageability.

Basic ROI formula: ROI = (OPEX savings + avoided losses/penalties + additional margin from accelerated onboarding − TCO) / TCO. Sensitivity is assessed by three parameters: reduction in false positives, reduction in MTTI and the share of automated solutions in the low‑risk zone. We recommend performing sensitivity analysis over ranges rather than points to account for regulatory and seasonal fluctuations.

Scenario template for assessment:
– Conservative: −20% false positives, −15% MTTI, +10% auto‑close low‑risk; payback period 15–18 months.
– Realistic: −40% false positives, −30% MTTI, +25% auto‑close; payback period 9–12 months.
– Aggressive: −60% false positives, −45% MTTI, +40% auto‑close; payback period 6–9 months.

Integration of AI into AML processes and the IT landscape

A practical integration plan begins with building reliable data pipelines (ETL/ELT) and a DataOps discipline. Streaming buses (Kafka/Kinesis) provide real‑time ingestion, and the feature store synchronizes online/offline features. API‑first integration and webhooks enable online scoring and automatic triage without heavy rework of core systems.

On‑premise is appropriate when strict localization and low tolerance for external dependencies are required, cloud – when rapid elasticity and accelerated R&D are needed, hybrid – for a balance of control and scalability. Integration with core banking, payment gateways, case management and SIEM creates a unified audit trail and accelerates investigations.

Model governance and explainability

Model governance relies on versioning, model registry, reproducible training and audit trails. Backtesting and independent validation check robustness, bias and stabilize thresholds relative to risk appetite. We recommend a three-line defense model: development, independent validation and internal audit.

Explainable AI (XAI) is implemented through SHAP/LIME, counterfactual explanations and “model cards” describing purpose, limitations and data. Regulatory XAI reports include feature attribution, sensitivity to parameters and examples of cases that have undergone human review. Drift management is built on monitoring distributions, PSI/KS metrics and retraining schedules.

Legal and ethical aspects of AI in AML

In the EU, AMLD5/6, EBA Guidelines and the GDPR are important; in the US, FinCEN requirements; in Asia, MAS and local regulators; in the CIS — national personal data and AML laws. Regulators expect explainability, a clear human role in final decision-making and full auditability. Documentation should include model objectives, test cases, limitations and escalation procedures.

Legal risks concern the ‘black box’, cross-border data transfers and localization. They are mitigated by transparent models, pseudonymization, privacy-by-design and local training environments. Vendor due diligence is mandatory: we look at the hosting jurisdiction, subprocessors, incident policy and security SLAs.

privacy-preserving ML for AML

Federated learning, differential privacy, MPC and partially homomorphic encryption help train models without transferring raw data.

Synthetic data helps expand datasets and test “rare” patterns without disclosing personal data.

Checklist: vendor selection, pilot, implementation

Vendor selection criteria: model transparency and XAI, experience in your industry, completeness of integrations (case management, sanctions, adverse media), SLA for latency/throughput and support for on‑prem/cloud/hybrid. Backtesting capabilities, model registry, audit trails and a clear total cost of ownership are important. Legally, check licensing terms, subprocessors and compliance with GDPR/local laws.

PoC must have clear objectives, a baseline (rule‑based), a set of success metrics and a limited but representative dataset. A 6–12 week timeline is realistic with ready data and integrations; the outcome is a go/no‑go decision and a TCO/ROI plan. The project team includes an MLRO, compliance, data scientists, integration engineers and a product owner, and human‑in‑the‑loop is documented in playbooks.

Mini checklist for PoC:

• Data: sources, volume, quality, anonymization/localization.
• Metrics: precision/recall, PR‑AUC, precision@k, MTTD/MTTI, cost per alert.
• Integrations: API, webhooks, case management, sanctions provider.
• XAI: methods, report format, case examples.
• Governance: registry, versioning, backtesting, decision log.

Scaling AML-ML in Europe and Asia

Regulatory requirements and data formats vary from country to country, as do local PEP/sanctions lists. Localization processes are needed: separate pipelines, dictionaries, thresholds and language models for adverse media. Multi‑currency and time‑zone differences require careful normalization of features and time-series.

Technically, scaling relies on horizontally scalable queues, stateless services and sharding of the feature store. Streaming scoring must withstand peaks, and replication and geo‑routing reduce latency. Practical recipe – local PoCs, adaptation of thresholds and retraining of models on local data with federated/transfer learning.

Implementing AI in AML for Executives

Step 1 – Readiness assessment: conduct a data audit, inventory sources and pain points, align KPIs (precision@k, cost per alert, MTTD/MTTI). Define regulatory boundaries (GDPR, localization, explainability expectations) and target business cases. Document TCO constraints and a risk checklist.

Step 2: PoC: choose 1–2 priority scenarios (e.g., reducing false positives in transaction monitoring), prepare a baseline and dataset. Establish success criteria and an integration plan, ensure XAI reporting and a human-in-the-loop protocol. Make a go/no-go decision based on metrics and stress tests.

Step 3, Integration and governance: deploy MLOps, a model registry, backtesting and drift monitoring. Set up API/webhooks, integrate case management, SIEM and sanctions providers, and agree SLAs. Prepare regulatory documentation: model cards, XAI reports, escalation procedures and a decision log.

Step 4, Scaling and monitoring: start continuous training and regular threshold reviews, optimize triage and load distribution. Expand coverage to new products/countries with local adaptations and transfer learning. Conduct quarterly audit sessions with ROI/TCO analysis and playbook updates.

Conclusions for the business owner and C-level executives

• AI and AML deliver the greatest effect in reducing false positives and accelerating investigations, but require high-quality data and clear KPIs.
• Hybrid rule+ML solutions are the optimal start: they quickly improve metrics while preserving manageability and explainability.
• Graph analysis and NLP for adverse media: two ‘multipliers’ of ROI in international networks and multilingual environments.
• Model governance and XAI are not options but prerequisites for regulatory resilience and the trust of banks/partners.
• Privacy-preserving ML helps overcome localization barriers and cross-border restrictions without sacrificing quality.
• A realistic payback period is 9–12 months when focusing on triage and noise reduction, given mature DataOps.
• Start with a PoC and a clear baseline; otherwise it’s impossible to prove the effect and protect the investment.
• Team and processes are more important than the tool: human-in-the-loop, regular audits and metric discipline determine the outcome.

A recommended table for evaluating vendors and PoC includes columns: functional coverage, explainability/XAI, integrations, SLA, security/localization, TCO, pilot results by metrics. Such a matrix speeds up decision-making and makes dialogue with regulators more substantive.

How to write a conclusion and CTA

Artificial intelligence enhances AML-monitoring, turning it from a cost center into a manageable framework for reducing risk and accelerating the business. Success depends on data quality, well-thought-out governance, XAI reporting and careful integration into existing processes.

If you are planning international expansion or see an increasing compliance workload, start with a readiness audit and a PoC checklist. Upon request we will provide templates: an RFP for vendor selection, a supplier comparison matrix, a PoC metrics matrix, and an ROI/TCO calculator.

Real-time banking transaction checks have ceased to be a “regulator’s last-mile requirement” and have become an element of business strategy. When a system promptly detects anomalies, stops a fraud attempt, and automatically generates reports, a company not only complies with regulations — it saves time, retains customers, and reduces operating expenses.

The COREDO team has carried out dozens of projects in the EU, the UK, Singapore and Dubai, from company incorporations and licensing to launching real AML processes and integrating transaction monitoring into payment infrastructure. In this article I examine in detail how real-time transaction monitoring works, which regulatory expectations currently dominate, and which solutions work in practice. I will show case studies, performance metrics, approaches to reducing false positives, and highlight the questions you should ask technology providers.

Why businesses need transaction monitoring

transaction monitoring in real time, it’s not just about AML. Real-time fraud detection protects revenue, and compliance monitoring of payments reduces the risk of fines and blocking by correspondent banks. Under PSD2 and open banking the customer expects instant transaction approval, and the bank expects explainability and auditability of decisions. Without real-time AML systems a company loses speed and flexibility, and the risk of undetected schemes increases.

What is monitored when checking transactions?

Which parameters do banks monitor?

Temporal payment patterns

Sanctions screening of payments and PEPs

Sanctions screening of payments is based on matching against the sanctions lists of OFAC, the UN and the EU, as well as local regulators’ lists. SWIFT screening and sanctions checks of correspondent banks are important for international transfers, especially when operating through the correspondent account network.

Monitoring transaction chains and TBML

Analysis of transaction chains and graph analysis reveal complex schemes, including trade-based money laundering (TBML). Clustering transactions to identify schemes and graph analysis of transfer chains help reveal “bridges” between groups of companies and shadow counterparties.

Requirements in the EU, the UK and Asia

In different jurisdictions — the EU, the UK and Asia — regulatory requirements set the compliance framework for financial and crypto-asset services. Below we examine in detail the key international standards and European rules, including the recommendations of FATF, the AMLD5/AMLD6 directives and EBA guidance.

FATF and EBA recommendations on AMLD5/AMLD6

The FATF legal standard sets the foundation: a risk-based approach, continuous monitoring, data governance and independent assessment. In the EU, the AMLD5 and AMLD6 directives have strengthened requirements for UBO identification, internal controls and liability for facilitating money laundering.

PSD2 and open banking: monitoring

GDPR, privacy-preserving analytics and eIDAS

FCA and sanctions lists

The FCA and regulatory expectations on AML in the UK emphasize the importance of model explainability and the reliability of sanctions screening. Banks and PSPs are required to match sanctions lists and PEPs in real time, taking into account fuzzy matching and the counterparty’s context.

How to build a real-time AML system

The architecture of real-time AML requires measured approaches to data processing if you want to actually build a system without headaches and ensure stable operation as volumes grow. The choice between batch and stream comes down to a trade-off between latency and throughput.

Batch vs Stream: latency and throughput

The batch approach is suitable for retrospective analytics and periodic analysis, but it does not catch instantaneous risks. The stream approach provides minimal latency and high throughput, which is critical for merchant flows, payroll, and instant payments.

Stream processing: Kafka, Flink, Storm

Tools for real-time transaction monitoring typically include Apache Kafka as an event bus and Flink or Storm for computations. Such a stack supports complex time windows, aggregates, deduplication, and stateful processing for transaction scoring.

Integration of Core Banking and PSP Enrichment

API integration with Core Banking and PSP allows pulling transactions, sessions, KYC/CDD data, and authorization context. Data enrichment — geolocation, BIN, AML watchlists, corporate directories, sanctions lists — improves scoring quality.

Scaling for peak loads

Scaling for peak loads, for example during holiday payrolls or sales, requires elasticity and prioritization. Flow control in multi-currency and cross-border payments takes into account FX volatility and correspondent account limits.

On-prem vs cloud: SIEM log storage

On-prem solutions increase control and are suitable for banks with strict regulations on log retention in the EU and Asia. Cloud speeds up deployment and reduces CAPEX, but requires clear data boundaries and encryption.

Monitoring triggers: database and context

Effective monitoring begins with clear rules and properly configured triggers that translate raw data from the database into actionable insights. Next, we’ll examine how rule-based scenarios and contextual rules use information from the database.

Rule-based scenarios and contextual rules

Scenarios for AML automation (rule-based) include threshold amounts, frequency, country-risk lists and merchant blacklists. Contextual rules for AML add a “healthy” behavioral baseline and customer links: usual IP addresses, devices, counterparty types and time windows.

Bank limits and limit checks

Onboarding and KYC/CIP/EDD

How to manage false positives and KPIs

Practices for reducing false positives include customer segmentation, contextual features, adaptive windows and feedback from analysts. Performance metrics for AML systems — precision, recall and false positive rate — help balance sensitivity and accuracy.

Hybrid machine learning approaches

Machine learning helps reveal hidden patterns in large volumes of data, and hybrid approaches allow combining expert rules with models for greater robustness and explainability. Below we consider how these methods are used for anomaly detection and behavioral monitoring.

Machine learning for anomaly detection and monitoring

Machine learning for transaction anomaly detection adds depth on top of rules. Behavioral monitoring of customers’ transactions uses clustering, graph features and gradient boosting for complex patterns.

Explainability and regulatory requirements

Explainability of ML models in AML and regulatory requirements prescribe understandable reasons for each alert and auditing and traceability of ML decisions. Case management systems for investigations should store the model version, the feature set and escalation steps.

Privacy and risks of third-party models

COREDO Case Studies: the Path to AML Monitoring

COREDO case studies demonstrate the path from obtaining a license to real implementations of an operational AML monitoring system in financial market products. Using the example of a PSP in the EU, we show how the licensing stage smoothly evolves into building a real-time platform and an operating system for AML.

PSP in the EU: from licensing to real-time

In Estonia, the COREDO team assisted a PSP in obtaining a license and implementing real-time AML. We integrated Kafka and Flink, configured SWIFT screening, the OFAC/UN/EU sanctions lists, and contextual rules for the merchant flow.

Fintech and Open Banking in the UK

Payment Company in Singapore and Dubai

In Singapore and Dubai, COREDO built payment compliance monitoring with a focus on cross-border and multi-currency flows. We applied hybrid scoring, enriched data with geolocation, and implemented TBML controls based on documentary inconsistencies.

Mass Merchant Transactions

Performance metrics: cost and ROI

Assessment of implementation cost, projected ROI and a set of key performance metrics — essential elements when planning digital projects in a bank. Below we will examine in detail what makes up the budget for an average bank.

Implementation cost for an average bank

How much does it cost to implement a real-time transaction monitoring system for an average bank? In our experience, TCO over 12–18 months ranges from 0.9 to 2.5 million euros, including licenses, implementation, integrations and team training.

Accuracy and speed metrics

Which metrics demonstrate ROI from real-time monitoring? Reduction in false positive rate, increase in precision/recall, average time to investigate (MTTR), share of automated SARs, proportion of fraud losses prevented and cost per case.

ROI: where the business value comes from

Questions for vendors regarding the SLA

Preparing your business for bank monitoring

Businesses should prepare in advance: bank monitoring implies transparent reporting, proof of sources of funds and tidy registration documentation. Below are practical steps for opening an account and registering in the EU.

How to open an account in the EU and register

Monitoring for the registration of legal entities in the EU is not a formality but a real criterion for bank onboarding. How to prepare a company for banks’ AML checks before opening an account?

Policies, playbooks and reporting

Incident management and playbooks for AML operations should describe escalations, priorities, actions for mass payments and payroll, as well as rules for operating on weekends and holidays.

Validation and log storage

End-to-end data validation and reconciliation eliminate discrepancies between transactions and balances and increase confidence in alerts. Log retention policies in the EU and Asia specify retention periods and requirements for protection and access.

What do banks expect from licenses?

When obtaining financial licenses (crypto, forex, payment services) regulators evaluate not only policy but also operating processes: KYC/CIP/EDD, sanctions screening, international transfer controls and false positive management.

International transfers

How to choose a provider and tooling

The right tooling when selecting a provider defines what analytical and operational tasks can be solved quickly and reliably. This is especially important for graph visualization capabilities.

Graph visualization and AML-as-a-Service

Questions for providers on SLA and GDPR

Reducing investigation costs

How to reduce operational costs for AML investigations? Adopt lean investigation and triage models, automate enrichment, use prioritization by risk score, implement case templates and active feedback training.

Strategic partnership with COREDO

When a business prepares for international expansion, company registration and Licensing: only the first chapter. Real transaction monitoring becomes the operational backbone that supports risk management, the trust of partner banks, and stable unit economics. If you combine rules and ML, build a transparent data architecture and explainable models, the system not only meets AML standards – it helps the business grow.

COREDO combines legal and financial expertise with strong engineering practice. We support registration in the EU, the United Kingdom, the Czech Republic, Slovakia, Cyprus, Estonia, Singapore, and Dubai, help obtain licenses and launch compliance processes that withstand scrutiny from regulators and banks. If you are building an international payments business or scaling corporate payments, the COREDO team prepares a roadmap, implements real-time monitoring and configures metrics that show real ROI.

The COREDO team has implemented dozens of projects to register legal entities in the EU, the Czech Republic, Slovakia, Cyprus, Estonia, the United Kingdom, Singapore and Dubai, and obtained financial licenses for crypto platforms, forex brokers and payment companies. Our experience at COREDO has shown that results are achieved not when another checklist is closed, but when the legal model and corporate governance are built as a single system of control and decision-making, supported by transparent ROI and TCO metrics and a methodology for evaluating control effectiveness.

What is a company’s legal model?

The legal model of corporate governance must take into account GDPR requirements, features of cross-border data transfers, local regulations, as well as regulatory expectations for reporting and transparency.

For financial organizations I recommend considering the legal model and compliance management as part of GRC (governance, risk, compliance). This approach links the company’s risk appetite, key risk indicators (KRI), compliance key performance indicators (KPI) and testing & sampling procedures, so as not only to declare rules but also to prove their control effectiveness. COREDO’s practice confirms: where the legal model and regulatory risk management are integrated into the operational cycle, the likelihood of legal consequences of non-compliance with regulations and regulatory fines is reduced.

How to build a legal model

We start every project with an analysis of the regulatory and legal environment and by creating a regulatory map of jurisdictions. At this stage a regulatory Due Diligence is carried out on licensing requirements and permitting documentation, criteria of international standards are compared (FATF recommendations on AML/CTF, EBA and EU regulatory requirements, Basel Committee recommendations for financial companies), sanctions regimes and rules of international cooperation are assessed. For companies with cross‑border operations this is the basis of an inter‑jurisdictional legal model.

At this stage it is important to define the risk appetite, carry out an analysis of residual risk after implementing controls and agree on monitoring metrics: KRI, KPI and alert handling indicators for transaction monitoring systems (TMS). The solution developed at COREDO allows to transparently link KYC procedures/EDD, sanctions screening of counterparties and beneficial owner (UBO) checks with the client profile and product type.

This includes privacy by design, preparation of a protection impact assessment (DPIA) for significant data flows, settings for data governance, management of privacy policy and data localization requirements, as well as contract lifecycle management to minimize risks (CLM). Through CLM we record legally significant obligations, SLA for suppliers, mechanisms for managing contract risk and vendors, and a system of controlled documents and versions.

Implementation of the legal model: risks

Implementation always follows a roadmap. First we agree on the target corporate structure and ring‑fencing for company groups, to limit the transfer of risks between legal entities, determine centralization vs decentralization of legal functions, and the allocation of licenses and permits across the perimeter. Then we configure AML/KYC processes, TMS and CASE systems for investigations, RMS for risk metrics, register regulatory reporting and the SAR/STR report for suspicious transactions. I separately set out an incident response plan with escalation triggers, as well as a business continuity plan and regulatory compliance for critical services.

To mitigate them, the COREDO team establishes a process of continuous updating of regulatory maps, conducts staff training and develops a culture of compliance. This approach simplifies interaction with regulators and prepares the company for regulatory inspections without emergencies.

Metrics of ROI and TCO for the legal model

The key to management is measurability. I assess the total cost of ownership of the legal model through direct costs for licensing and maintenance, the cost of automation (CLM, RMS, CASE, TMS), and the cost of people and external advisers. ROI for compliance initiatives is calculated from reduced probability/regulatory expected loss (the probability of an incident multiplied by the expected damage), time savings on KYC/AML and reduction of cost leakage in accounts payable and suppliers thanks to CLM.

This method of calculating the economic effect of the legal model makes it possible to manage regulatory burden and make investment decisions about automation.

Regional Accents: Europe, Asia, CIS

In the following sections we will examine practical legal models and requirements for businesses in each of these regions, starting with Europe.

The legal model of business in Europe

European projects often rely on the GDPR, EBA requirements and local regulators. For payment organizations we build the legal model when registering legal entities in the EU taking into account PSD2 rules, access to payment infrastructure and risk management requirements. In Cyprus I recommend aligning the corporate structure with CIF licensing for forex brokers, and in Estonia: considering the updated rules for virtual asset providers and the upcoming harmonization with the MiCA framework. COREDO’s practice confirms: when the legal model and Financial services licensing are designed simultaneously, time to market is noticeably reduced.

This reduces the risk of penalties for privacy breaches and simplifies regulatory inspections.

Legal model for entering Asian markets

In Singapore we take into account MAS expectations regarding AML/CTF and governance for fintech players, as well as requirements for managing technology risks. The legal model for a startup in the Asian market is built as a flexible legal model for a fast-growing business: emphasis on scalable KYC/EDD, outsourcing part of legal ops and regulatory sandboxes (regulatory sandbox) for testing new products. In Dubai we align the framework with VARA practice and free zone rules, plan sanctions screening of counterparties and beneficial ownership transparency. Such a design facilitates cross-border operations and preparation for international compliance audits.

Cross-jurisdictional legal model

At COREDO we design the corporate structure and ring-fencing to separate risky assets, manage reputational risks and build scenarios for scaling business in Africa through partnership models. The legal model and protection against sanctions risks include UBO transparency, sanctions filters, contract adaptation and regulatory resilience stress tests.

Licensing and built-in compliance

Licensing is not a checklist, but a test of the viability of the legal model and internal control. We have supported licenses for crypto services, payment companies, forex providers and specialized financial firms in several jurisdictions. The solution developed at COREDO links licensing and permit documentation with AML processes, transaction monitoring systems (TMS) and the SAR protocol to meet regulators’ expectations and operational realities.

This creates a common language with the regulator and facilitates compliance audit support. For innovative models we use a regulatory sandbox and a phased rollout, where the legal model and automation of legal processes (CLM, RMS, CASE) are tested on a limited volume of operations.

AML in the legal model

AML‑services are not only KYC/EDD, but a blend of risk assessment, monitoring and culture. We build KYC processes on a risk‑oriented principle, configure EDD for countries/segments of elevated risk, implement sanctions screening of counterparties and UBO checks. AML transaction monitoring should be proportionate to risk and support effective alert handling. At COREDO we apply automation and AI tools to manage regulatory risks: behavioral analytics, alert prioritization, case management and quality control of investigations.

It is important to maintain anti‑corruption policies and procedures, integrating them into staff training and compliance culture. We carry out testing & sampling methodologies, assess the effectiveness of controls, form KRI at the process and team levels, and also build the process for managing regulatory changes. This reduces residual risk and strengthens trust from partner banks and investors.

Data governance and GDPR by design

I view data governance as a system: a registry of processing activities, data owner roles, sensitivity classification, retention rules, cross-border transfers and DPIA. For the EU and the United Kingdom, mechanisms for international data exchange are critical, taking into account local requirements and contractual safeguards. We document regulatory requirements for reporting and transparency to easily pass audits and respond to supervisory authority requests.

In projects with an Asian and Middle Eastern perimeter we take localization requirements and the specifics of consent into account, and build contract lifecycle management to ensure supplier and contractor compliance. This approach makes the legal model a tool of corporate control rather than a formality.

Legal operations and automation

Automating the legal function is not an end in itself but a way to reduce TCO and increase the scalability of the legal model. I use CLM to manage the contract lifecycle and obligations, RMS for risk assessment and KRI/KPI, CASE for investigations and regulatory requests, and TMS for transactions. Legaltech solutions for regulatory monitoring fill the gap in regulatory change management and prevent policies from falling behind reality.

In corporate groups we often choose a hybrid: a centralized methodological framework, unified document standards and a versioning system, while local legal entities are responsible for regulatory practice. COREDO helps establish outsourcing of legal functions (legal ops outsourcing) where it accelerates launch and preserves control.

Company structure and reputational risks

The legal model for a group of companies must take into account the management of beneficial ownership, UBO transparency, delegation of authority and independence of control. We design ring‑fencing so that a high‑risk element does not “infect” the entire group, and we establish rules for information barriers. The legal model and reputational risk management include a matrix of crisis scenarios and a response plan, a mechanism for reporting via SAR in suspicious situations, as well as procedures for interaction with auditors and regulators.

This regime maintains the trust of banks, payment partners and clients.

Inspections and interaction with regulators

I always operate under the principle of “no surprises”. Engagement with regulators begins long before a request: we transparently maintain records and manage licenses and permits, prepare reports, keep change logs for policies and procedures, and also training logs. When preparing for an inspection we assemble an evidence package: from KYC/EDD records and CASE investigations to TMS logs and DPIA registries. The COREDO team supports communications, helps disclose information correctly, and close findings on time.

This reduces the likelihood of escalation and maintains predictability in dialogue with regulators.

M&A: Migration and Integration of the Legal Model

M&A deals pose a complex challenge: migrating the legal model during M&A and integrating the legal model after the deal. I recommend starting with mapping GRC frameworks and licenses, reviewing contracts in CLM, aligning AML/CTF policies and data governance. Often it is necessary to transfer licenses, agree on new UBO structures and update TMS/CASE settings. COREDO’s experience shows that early planning reduces the risk of operational stoppages and accelerates synergies.

Implementation Plan

At the same time, privacy by design and a DPIA are developed, and data governance is configured.

Next, we move the model into the operational environment: we document internal controls, standard policies, a document versioning system, an incident response plan and a business continuity plan. At the launch stage we organize staff training and foster a compliance culture, implement regulatory monitoring and change management, and prepare for interaction with regulators and compliance audits. This approach reduces the total cost of ownership of the legal model and ensures its scalability.

COREDO case studies: legal model

First case – a group of payment companies headquartered in Cyprus with operations in the EU and the UK. The COREDO team built the legal model and financial services licensing as part of a CIF and European authorisations, designed ring‑fencing between processing and marketing, implemented CLM and RMS, and also a TMS with alert prioritisation. Performance assessment showed a 37% reduction in false positives and a 28% reduction in KYC time, which directly increased the ROI of compliance initiatives.

Second case, a crypto provider registered in Estonia and expanding to Dubai. The solution developed by COREDO combined the legal model and AML services: revision of EDD procedures, sanctions filters, CASE for investigations and regulatory sandboxes for testing a new product. We synchronised VARA requirements with the European framework and prepared the company for future MiCA regulations. As a result, the business safely expanded cross‑border operations and accelerated listing with payment partners.

Third case – a fintech from Singapore planning to scale in Africa through partnerships. We built an interjurisdictional legal model taking into account local KYC practices, requirements for data governance and cross-border data transfer, added privacy by design and DPIA, as well as regulatory change management. COREDO’s practice confirmed that a flexible legal model for a fast-growing business reduces legal and reputational risks and accelerates entry into new markets.

Innovation in the legal model

Contract lifecycle management reduces the likelihood of missing obligations, RMS manages the risk portfolio and metrics, CASE ensures manageability of investigations and interaction with regulators, and TMS, adaptive AML monitoring. We use blockchain and smart contracts in the legal model where it increases transparency, and we are testing the use of AI for managing regulatory risks — from alert classification to contract analysis.

An important requirement is manageability of changes. Regulatory monitoring and change management (regulatory change management) are integrated into daily work: controlled documents and versioning system, revision schedule, allocation of responsibilities and staff training. This reduces ‘regulatory debt’ and helps avoid accumulation of vulnerabilities.

Legal model: an instrument of control

It simplifies licensing, reduces the cost of compliance through automation and proper allocation of functions, enables building regulatory scenarios and making decisions faster. At COREDO I strive to ensure that the legal model and the use of legaltech are not a barrier, but a foundation for growth: from cross‑border operations to post‑M&A integration.

This approach builds trust and confirms the authority of our team in the eyes of regulators and partners.

Conclusions

When the legal model and regulatory risk management are built as a single compliance framework, business obtains licenses faster, complies with requirements more cheaply, and scales more confidently in Europe, Asia, the Middle East and the CIS.

If you are planning the registration of legal entities in the EU, expansion into Asian markets, financial services licensing or post-deal integration, rely on the legal model as the architecture of growth. The COREDO team is ready to discuss your project and offer a practical plan: from a regulatory map to the launch of processes and performance metrics. I believe in remote partnership, where expertise, experience and reliability will turn regulators’ requirements into your competitive advantage.