Blog

I welcome you as the CEO and founder of COREDO. Since 2016 our team has accumulated deep experience in registering legal entities abroad, obtaining financial licenses, and AML consulting. Today I will share a practical approach to creating KYC policy for international groups that combines a unified KYC standard with local KYC adaptation to the requirements of the EU, Asia, and the CIS. This is not theory: these are solutions we apply for clients expanding business in the Czech Republic, Singapore, Dubai, or Estonia. In recent years we at COREDO have supported more than 120 cross-border structures where errors in KYC led to account blocks, license refusals, or repeated EDD reviews by banks. In most cases the problem was not “tough regulators” but the absence of a unified KYC logic at the group level – banks saw a fragmented picture of risks and shifted responsibility onto the client.

Why a unified KYC for scaling?

The key problem of the local approach is the absence of a single source of truth (single source of truth). As a result, the same UBO may be assigned different risk ratings in the EU and Asia, and when a bank requests information the group cannot quickly demonstrate the consistency of its AML position. For banks this is a direct red flag, especially in cross-border transactions and payment licenses.

The solution developed at COREDO is built on a global KYC risk appetite: we set common thresholds for PEP screening, sanctions lists (World-Check) and beneficiary checks. In practice the risk-based approach does not mean “checking everyone more strictly”, but differentiating control: low-risk clients pass fast-track CDD, medium-risk — standard onboarding with periodic review, high-risk — EDD with sources of funds, transactional logic and ongoing monitoring. This reduces the burden on compliance teams and speeds up scaling without increasing regulatory risk.

Key question: should a unified KYC standard be implemented or are local adaptations sufficient? The answer — a combination. FATF recommendations (40 principles) emphasize AML harmonization, but taking into account high-risk jurisdictions. Our experience at COREDO has shown: purely local approaches create desynchronization risks, especially during banks’ checks on the origin of capital.

Steps for implementing a global KYC framework

Start with an audit. The COREDO team conducts Customer Due Diligence (CDD) at the group level: mapping high-risk jurisdictions, analyzing the group’s capital structure and defining the global risk appetite. For a client from Asia registering an EU structure in Estonia, we integrated eKYC (electronic KYC) with eIDAS identification, providing remote verification without physical presence.

Step 1: Policy development. Create a KYC document for EU business (6AMLD requirements), KYC for Asian companies (Travel Rule IVMS) and a CIS adaptation. Important: KYC policy is not a static PDF “for the regulator”, but an operational tool. It must be embedded into onboarding processes, periodic review and escalation, with clear SLAs, responsible persons and decision logging. This is exactly what banks and licensing authorities expect during inspections. Include KYT monitoring, the shift from one-off KYC to continuous Know Your Transaction (KYT). COREDO practice: for a fintech group we set up RegTech for automation, logging verifications and ensuring KYC cybersecurity with data access controls.

Step 2: Local adaptation. A unified KYC standard is the core, but with overlays. In the EU we apply Enhanced Due Diligence (EDD) for PEPs and sanctions under 6AMLD. In Singapore — MAS guidelines on substance. In the CIS — focus on the beneficial ownership registry. Example: the European COREDO group helped synchronize with eIDAS regulations by implementing digital identity systems for digital onboarding.

Step 3: Appointment of an independent compliance officer. The role of an independent compliance officer is critical in international groups. They ensure compliance to the Board of Directors with veto power over onboarding and prepare independent reporting. For international groups it is essential that the compliance officer is independent from commercial pressure and has direct access to Board-level. EU regulators and those in Asia view this as an indicator of AML system maturity and trust in the group as a whole. In one project a COREDO officer blocked a high-risk client, saving the group fines under FATF recommendations.

Step 4: Transition to KYT and RegTech. The shift from KYC to continuous KYT monitoring pays off: ROI from a unified policy reaches 3–5x due to reduced fines (up to 10% of revenue under 6AMLD). KYT allows detecting deviations from the declared client profile: disproportionate turnovers, atypical counterparties, geographic shifts. These signals most often trigger SAR reports and bank investigations — and this is where RegTech delivers the greatest effect. We use regulatory technology (RegTech) for transaction logs auditing, Travel Rule compliance in EU-Asia transactions. For a client in Dubai we integrated Asian regulatory sandboxes for testing.

Cross-border KYC risk management

Unsynchronized procedures — the main headache. Risks: bank refusals, licensing delays (crypto, forex, payments). The COREDO team minimizes them through regulatory synchronization of KYC between the EU, Asia and the CIS. Example: when registering a payment company in Poland (NPI/SPI) we conducted CDD and EDD procedures, taking into account the Basel Committee and GDPR for cross-border data flows.

We determine the global risk appetite by target KYC markets: low-risk for EU retail, high-risk for Asian crypto. We implement sanctions-list screening and PEP (Politically Exposed Persons) checks. Plus internal system controls with logging of verifications. Frankly: there are challenges; the evolution of AMLD directives (the impact of 6AMLD on companies’ KYC procedures in 2025) requires annual updates. But with KYC/AML compliance from the COREDO group, they avoid 90% of problems.

Assessment of success and sustainability

Metrics: onboarding time (target <48 hours), % of successful bank verifications (>95%), ROI from compliance investments (30% reduction in operating costs). For CIS businesses the advantages of a global KYC framework are access to EU licenses without local mistakes. Our experience: a client with CIS roots opened a structure in the United Kingdom and Singapore, obtaining a banking license with harmonization of AML standards.

COREDO Practical Recommendations

• Group audit: Check KYC dossier storage for compliance with GDPR data protection.
• Automation: Implement eKYC with remote verification for high-risk jurisdictions mapping.
• Support: Provide Legal outsourcing for licenses – from crypto in Lithuania to forex in Switzerland.
• ROI calculation: Compare costs of duplicates (local KYC) vs. a unified framework, payback in 6–12 months.

In 2026 KYC ceased to be an auxiliary function — it is a strategic asset for the group. It affects time-to-market, cost of capital and banks’ trust. Companies that invest in a unified KYC framework scale faster and with lower regulatory costs.

When entrepreneurs from Europe, Asia and the CIS countries come to me for a consultation, almost always the same combination appears in their questions: where to register the company, how to obtain the required financial license and how to design AML so that regulators trust it and compliance doesn’t strangle the business.

Over the years that I have been leading COREDO, our team has gone with clients through the full cycle, from the idea of entering the EU or Singapore to a licensed and sustainable financial institution with a functioning risk-based AML model. In this article I want not just to list COREDO’s services, but to show how I think about the strategy of an international business structure and why the integration of registration, licensing and AML gives an entrepreneur a strategic advantage.

Logic of an international business structure

I always start the conversation not with jurisdictions, but with three questions:

1. What is your target market and product (fintech, forex, crypto, payments, B2B services)?
2. Which regulators and banks should trust you in 1–3 years?
3. How ready are you for formalization and transparency – from KYC to regular reporting?

The answers determine:

• where to register the head company (ES, UK, Czechia, Cyprus, Estonia, Singapore, Dubai, etc.);
• where to obtain financial licenses (payment, EMI, forex, investment, crypto licenses);
• how deeply to build the AML function and risk-based approach from the outset.

Registration of legal entities

The COREDO team has for many years been registering legal entities in the EU, Asia and the CIS: both individual companies and entire holding structures. It may seem like a basic service, but it is here that the architecture of the future model is laid down:

• tax consequences;
• substance requirements (office, employees, directors);
• potential regulatory requirements when licensing;
• the banks’ attitude toward your jurisdiction and ownership structure.

Which areas I cover

• Legal form
  For fintech and payment solutions, forms such as private limited / s.r.o. / OÜ and their equivalents are most often chosen, with a clear division of liability and a transparent capital structure.
• Role of particular jurisdictions
  Czechia and Slovakia are convenient for operational centres and local activities in the EU.
  Cyprus, Estonia, Latvia, Lithuania, Poland are often used for financial services, IT, payment solutions and licensed activities.
  United Kingdom: a good platform for international B2B‑services and financial infrastructure, especially in combination with licensing.
  Singapore and Dubai: key points for entering the markets of Asia and the Middle East.
• Practical setup of the process
  The COREDO team takes on the preparation of corporate documents, interaction with registration authorities, support for opening bank and EMI accounts, obtaining information about beneficiaries and their proper disclosure.

Financial licenses: how to build a strategy

obtaining a financial license, one of the most challenging stages. This concerns:

• payment and electronic money (PI/EMI, payment institutions);
• forex and investment services;
• crypto and VASP licenses;
• specialized authorizations for asset management.

COREDO focuses on licenses in EU jurisdictions (Czechia, Cyprus, Lithuania, Latvia, Poland, Germany, France, Switzerland, etc.), as well as in the United Kingdom, Singapore and a number of other countries.

Why Licensing without AML does not work

• risk-based AML model;
• real governance (directors, MLRO, internal controllers);
• the KYC/KYB system, transaction monitoring;
• the quality of internal policies and procedures.

AML and the risk-based approach in practice

In AML regulation, the risk-based approach (an approach based on risk assessment) has long been key. EU regulators, the UK, Singapore and other jurisdictions expect that:

• you understand your own risk profile (countries, products, clients, distribution channels);
• you have a formalized methodology for assessing risks;
• the compliance function’s resources are proportionate to actual risks;
• policies and procedures not only exist, but are applied.

How COREDO builds the AML framework

AML consulting at COREDO: not about “writing a policy just for the sake of a checkbox”. A typical project includes:

• Enterprise-wide risk assessment (EWRA) – a comprehensive risk assessment of the company taking into account countries, client types, products and channels.
• Development of AML/CFT policies and procedures tied to the requirements of the specific regulator (for example, in the EU: taking into account AMLD directives, local laws and supervisory guidelines).
• Establishing processes:
  • client identification and verification (KYC/KYB);
  • classification by risk levels;
  • transaction monitoring and detection of suspicious activity;
  • internal investigations and filing reports with the financial intelligence unit.
• Employee training and setting up regular knowledge updates.
• Support in dialogue with regulators and banks.

Legal and operational support after launch

COREDO was originally created as a company for long-term business support, not just for a “launch”. Today we cover the entire cycle:

• Legal services and protection: from the contractual framework to corporate changes and disputes with counterparties.
• Legal outsourcing – when it is uneconomical for a company to keep an in‑house legal department, but regular support is required in several jurisdictions.
• Legal support for financial institutions and resolution of disputes with banks and payment service providers.
• Registration and protection of trademarks in the EU, the UK and other countries, often in connection with market entry and licensing.
• Accounting outsourcing and financial reporting in accordance with the requirements of the jurisdiction of registration.

Comprehensive project at COREDO: from idea to business

To make it clearer how I organize the work, I will present a typical scenario of a comprehensive project.

Diagnostics and strategy

• Analysis of the business model, geography, and target audience.
• Determining target jurisdictions for registration and licenses (EU, UK, Singapore, Dubai, selected CIS countries).
• Map of regulatory requirements, expectations regarding AML and banking compliance practices.

Registration of legal entities

• Choosing company forms and names, preparing articles of association and corporate agreements.
• Registration in the chosen countries (for example, a parent structure in the EU, an operational fintech center in one of the jurisdictions with a developed regulatory framework).
• Support for account openings (banks, EMIs, payment systems).

Stage 3. Business licensing

• Preparation of a business plan and financial model in accordance with regulator requirements.
• Development of internal policies (including AML/CFT, risk management, IT security if necessary).
• Formation of the key persons team (directors, MLRO, compliance officers), preparation of their profiles and job descriptions.
• Communication with the regulator at all stages.

Building the AML function and operations

• Implementation of KYC/KYB procedures and risk-scoring.
• Setting up transaction monitoring, sometimes using third-party AML platforms, sometimes through the client’s internal solutions.
• Incident management procedures, case management for suspicious transactions.
• Staff training and testing procedures using real scenarios.

Long-term support of the site

• Updating policies and procedures taking into account regulatory changes.
• Support during regulator inspections and audits.
• Legal support for corporate changes and transactions.
• Registration of new trademarks, entry into additional markets, adaptation of the structure.

What to consider when choosing a partner

Entrepreneurs often ask me how to evaluate a consultant when everyone’s website says roughly the same thing. I recommend looking not at slogans but at four things:

1. Depth of expertise in target jurisdictions
   At COREDO the team works every day with company registration and licensing in the EU, Asia and the CIS, not just occasionally.
2. Real experience in the financial sector and AML
   If a consultant has no projects involving payment, crypto-, forex- and other licenses, it will be difficult for them to build a proper risk-based AML model. COREDO’s portfolio is built precisely around such tasks.
3. Integration of the legal, financial and AML units
   When different consultants are responsible for registration, licensing and AML, the client often becomes a hostage to inconsistency. The COREDO team aligns everything within a single logic, from group structure to reporting to regulators.
4. Ability to speak honestly about risks
   I always openly discuss limitations, risks and alternatives. It isn’t always pleasant in the moment, but this approach builds long-term trust.

How to use the article in practice

• registering a company abroad;
• obtaining one or more financial licenses;
• restructuring the AML‑function to align with current regulatory expectations;
• finding a long-term partner for legal and financial support.

• Clearly list your current and target client geographies and products.
• Determine which of the jurisdictions and license types described in the article are relevant to you.
• Assess how formalized your AML system is today and whether it aligns with a risk-based approach.
• Formulate 5–7 key questions you want answers to from a consultant.

I have been leading COREDO since 2016, and during that time hundreds of structures have gone through our projects: from European fintech startups and crypto platforms to Asian holdings with multi-level chains of owners. The more regulation becomes complex, the clearer one thing: beneficiary checks by banks and other financial organizations have long ceased to be a formal checkbox. It is a key element of risk management and access to the international financial infrastructure.

In this article I want to show how OSINT beneficiary checks work in practice, how banks view ultimate beneficial owners (UBO), and how an entrepreneur should arrange their structure and documents so as not to get stuck on compliance when opening an account, obtaining a license, or taking part in a deal.

Beneficiaries: the central point of risk

Today any bank, payment institution, crypto exchange or electronic money issuer builds AML/KYC processes around three questions:

1. Who actually controls the business (identification of beneficial owners, UBO)?
2. What is the source of funds and the value of assets?
3. What reputational and sanctions risk do the owners and related persons carry?

Therefore:

• KYC and beneficiaries are complemented by a full Due Diligence of beneficiaries, including analysis of affiliations, ownership chains and reputation.
• Most European and Asian regulators explicitly require a risk‑based approach: the more complex the structure and the higher the industry risk (crypto, forex, payment services, gambling, high-risk e‑commerce), the deeper the review should be.
• Banks are moving from “a tick-box for the regulator” to a model where OSINT as a bank risk management tool is embedded into credit risk, sanctions screening and even pricing.

In practice this means: if your beneficiaries and structure raise questions, you not only take longer to open an account – you lose access to key markets, licenses and investors.

How banks verify beneficial owners

Understanding what the verification of beneficial owners by banks is really built on starts with the basics: who exactly is behind the client and what formal data about them exists in documents and registries. At the KYC/KYB and formal identification level banks first build the “skeleton” of the check: they collect the minimally necessary information, confirm identity and ownership structure, and then move on to a deeper risk assessment and actual control.

Basic KYC/KYB level: formal identification

At onboarding the bank addresses the following tasks:

• identification of the legal entity (KYB): articles of association, registry, ownership structure;
• identification of beneficial owners: who owns or controls ≥ a certain threshold (usually 25%, sometimes 10%);
• checking documents and sanctions lists (OFAC, EU, UN, etc.), PEP‑status, basic AML client screening.

At this stage the classic set is used:

• corporate registries as a source of data on beneficial owners;
• international company and beneficial-owner databases (commercial providers);
• sanctions and PEP databases, negative news (negative news screening).

But for international structures and complex cases that’s not enough.

When EDD is triggered: verification of beneficial owners

EDD (enhanced due diligence) for beneficial owners is triggered when:

• complex verification of the ownership chain (multiple layers, holdings in several jurisdictions, offshore links);
• high-risk industry (crypto, fintech, forex, payment services, gambling);
• presence of PEPs, sanctioned jurisdictions or countries with weakened AML supervision;
• there are already negative signals from the media, court rulings, or the industry.

At this level OSINT becomes a mandatory tool in AML/KYC processes.

What is OSINT in compliance, and why is it needed?

• forming hypotheses (who the real controlling persons are, where the risks lie);
• link analysis, analysis of connections and affiliations;
• preparing an analytical dossier on the beneficiary with a risk assessment.

In the COREDO team’s work I roughly divide OSINT into:

• passive OSINT – collecting information without interacting with the subject (registries, media, social networks, databases, website archives);
• active OSINT – requests to relevant organizations, checks through industry communities, correlating data using indirect indicators.

OSINT sources for verifying beneficiaries

Key OSINT sources for verifying beneficiaries not only allow confirming the officially declared ownership structure, but also reveal hidden links, nominee owners and chains of organizations. In practice, registries and corporate databases become the main support, providing initial legal and financial data for further in-depth analysis.

Registries and corporate databases

Here the “skeleton” of the client’s corporate structure review is created:

• national corporate registries as an OSINT source:
• OSINT sources for identifying UBOs in Europe: company registries, sometimes separate UBO registries;
• OSINT sources for beneficiary checks in Asia: in some countries data are partially available, requiring combining several registries and commercial databases;
• international databases for beneficiary checks help see connections between companies in different countries and assess the group’s structure;
• comparative analysis: public registries vs. commercial databases and OSINT sources – we often see discrepancies in dates, ownership shares, positions, and this becomes a trigger for EDD.

In practical COREDO projects, analysis of corporate registries often helps uncover hidden beneficiaries through related companies and nominee owners.

Court judgments and enforcement proceedings

This is a goldmine for EDD:

• court judgments as an OSINT source when assessing beneficiaries: disputes with regulators, creditors, tax authorities, partners;
• databases of enforcement proceedings and bankruptcies – long-term behavior patterns, attempts to evade responsibility;
• recovery cases and forensics: how owners behaved in crisis situations.

Media and social networks

This is where the picture of reputational risks is formed:

• news and industry media: using news and media resources to check beneficiaries, negative news screening, investigative materials;
• media monitoring and negative publications about beneficiaries: not only high-profile scandals, but also local conflicts, accusations, regulatory claims;
• social networks as an OSINT source on beneficiaries: confirmation of biography, connections, involvement in projects, and SOCMINT (social media intelligence) to assess affiliation and behavioral patterns.

How to identify hidden and nominal beneficiaries

Hidden beneficiaries and nominal owners: a topic that banks and financial institutions face constantly, especially in international holding structures.

Analysis of affiliations and related parties

Here OSINT operates at the intersection of:

• matching addresses, directors, phone numbers, e-mail domains;
• the participation of the same individuals in multiple entities (often in different countries);
• cross-references in media, court decisions, industry publications.

Advanced search and OSINT Framework

Practical tools:

• using advanced search (Google Dorks) when checking UBOs — searching old press releases, cached pages, presentations where beneficiaries were mentioned before the ‘optimization’ of the structure;
• using the OSINT Framework when checking beneficiaries, systematizing sources by type (registries, social networks, media, technical data);
• analysis of domain histories, WHOIS, old versions of sites via web archives.

OSINT in banking, EDD, and AML systems

OSINT in the bank’s EDD process and AML systems is turning from an auxiliary tool into one of the key sources of information about a client’s risks and their environment. Proper integration of OSINT into the bank’s AML processes allows strengthening EDD checks with data from open sources, supplementing the results of commercial databases and internal systems.

Integration of OSINT into the bank’s AML processes

The bank cannot afford “manual” OSINT at an industrial scale. Therefore important:

• integration of OSINT into the bank’s AML systems: connecting external sources via API, automatic negative news screening, alerts for sanction changes;
• OSINT tools for financial institutions: web-scraping systems, media monitoring, SOCMINT, platforms for link analysis;
• continuous monitoring: regular dossier updates and monitoring of key beneficial owners.

OSINT in risk scoring and fraud detection

In mature models, OSINT data is fed not into a separate report, but directly into risk scoring:

• assessment of clients’ creditworthiness using OSINT: taking into account legal disputes, histories of defaults, conflicts with counterparties;
• OSINT in the investigation of financial crimes and money laundering – forensics, reconstruction of transaction chains, identification of nominee owners;
• OSINT as a tool for bank risk management: early detection of problematic beneficial owners before defaults occur.

As a result, the bank better understands who it is working with, and can more precisely adjust limits, pricing and terms.

How to prepare an OSINT check of beneficiaries

When I discuss with clients opening an account or obtaining a license in the EU, the UK, in Cyprus, Estonia, Singapore or Dubai, I always say the same thing: you need to prepare not only the documents but also your digital footprint.

What makes sense to do in advance:

• Transparent structure
  • minimize unnecessary intermediaries, especially in offshore jurisdictions without clear registries;
  • provide documented explanations of the ownership-chain verification: why the structure is the way it is, where added value is created, and where management is located.
• Data consistency
  • cross-check corporate registers, statutory documents, media profiles and the company’s website;
  • avoid situations where in one place the beneficiary is “advisor”, and in another, “founder and 100% owner”.
• Reputational audit using OSINT
  • conduct a preemptive check of beneficiaries’ reputational risks: media, court databases, professional communities;
  • if necessary – prepare explanations for contentious cases (for example, a conflict with a former partner, or a legal dispute that has been closed).
• Documentary support
  • prepare a package that meets not only formal requirements but also the logic of AML/EDD: business model, source of funds, key contracts;
  • for international structures: logically connect all parts from a business and tax perspective.

OSINT, company registration and licensing

OSINT, company registration and Licensing: a practical perspective helps businesses not only understand who they are dealing with, but also foresee legal and reputational risks when working with foreign jurisdictions. By analyzing public registers, licenses and corporate links, it is possible to build a safer strategy for registering a company abroad, minimizing the likelihood of mistakes and regulator claims.

Company registration abroad and OSINT

When registering companies in the EU, the UK, in Cyprus, in Estonia or in Asian centers (Singapore, Dubai), checking the client’s corporate structure and beneficiaries has become a standard part of the process:

• registrars and banks use OSINT to vet counterparties and partners, especially when the structure is international;
• regulators expect licensees to be able to conduct OSINT during client compliance checks;
• when licensing (crypto, payment, forex, investment services) the decision often depends on how transparent the UBO appears from an OSINT perspective.

Crypto and fintech licensing

• OSINT‑approaches to checking beneficiaries in high‑risk sectors (crypto, gambling, forex) include in‑depth analysis of media, industry investigations and business connections;
• sanctions checks and beneficiaries in such projects are supplemented by assessment of indirect links (countries, counterparties, sources of capital);
• OSINT in cross‑border transactions and foreign‑economic deals is becoming a mandatory part of AML policy/CTF.

Strategic questions for the owner and top executive

If you manage a banking group, a fintech company, or a large corporate business, I would ask myself the following questions:

• How integrated is OSINT screening of beneficiaries into the standard onboarding process?
• Do we have a unified standard for an analytical dossier on a beneficiary and its regular updating?
• What portion of the work is automated (web-scraping, API, alerts), and what is performed manually and at risk of “getting lost”?
• Do I understand which mistakes banks most often make when using OSINT: excessive trust in commercial databases, ignoring local sources, weak documentation of conclusions?
• Are our clients and their beneficiaries prepared for such depth of screening, or does every EDD case turn into crisis management?

Why OSINT is about management, not apprehension

From an entrepreneur’s perspective, OSINT‑checks are often perceived as a barrier. In practice it is a tool for:

• anticipating regulatory and sanctions risks;
• protecting the business from toxic partners and counterparties;
• improving the quality of decisions in M&A transactions, lending, and investments.

When entrepreneurs ask me what has changed most radically in international business in recent years, I answer with one word: sanctions. Sanctions restrictions are no longer just “background” – they shape the architecture of international holdings, determine access to banks, licenses, capital markets and even basic cross-border payments.

Since 2016 the team COREDO has been helping international companies build and restructure corporate structures in Europe, Asia and the CIS, obtain financial licenses, set up AML and sanctions compliance, pass bank KYC and maintain business resilience under the sanctions regimes of the EU, the US and the UK. In that time I have seen one thing: sanctions risk for business has become as fundamental a parameter as taxes or operating expenses.

How sanctions change the structure of business

The sanctions landscape has become multilayered:

• sanctions regimes of the EU, the US, and the UK with different listing criteria and different approaches to enforcement;
• secondary sanctions and risk to counterparties, when not only the sanctioned beneficiary but also the bank, exchange, or supplier serving them is targeted;
• financial sanctions and restrictions on payments, closure of correspondent accounts, bans on transactions in certain currencies;
• export controls and restrictions on the supply of technologies and dual-use goods.

At the level of ownership structure, this is reflected in three key effects:

1. Change in business ownership structure due to sanctions
   When a beneficiary or a key group company falls under EU or US sanctions, regulators and banks begin to view the entire ownership chain as potentially sanction‑tainted. This increases the risk of blocking sanctions and asset freezes even in friendly jurisdictions.
2. Shift of focus from tax optimization to sanctions resilience
   International tax planning continues to play a role, but the priority shifts: first sanctions resilience of the business model and corporate structure, then tax efficiency, then operational flexibility.
3. Restructuring international holdings under sanctions pressure
   Classic chains with a single central holding in a nominally “neutral” jurisdiction no longer always work. More often we move to multi-level architectures: master-holding, regional sub-holdings, separation of sanction-sensitive and “clean” business lines (spin-off, carve-out of sanctioned assets).

How to assess sanctions risks in a group

When an owner or CFO comes to me with the phrase «we need to do something with the holding, banks have started blocking payments», I never start by choosing a jurisdiction. The first step is an audit of the sanctions resilience of the corporate structure.

The project usually starts with three blocks:

1. Mapping the structure and ownership chains
   The COREDO team requests:
   • the current diagram of the international holding;
   • a list of beneficiaries (UBO), controlling persons and directors;
   • a list of all jurisdictions of presence: holdings, operating companies, SPVs, funds, trusts;
   • intragroup agreements: loans, guarantees, IP licenses, allocation of functions and risks.

   At this stage it is important not just to draw the «company tree», but to understand actual control and operational substance: where key decisions are made, where the directors are located, where actual activity is carried out.

2. Sanctions screening of beneficiaries and companies
   We conduct sanctions screening of beneficiaries, directors, key counterparties and banking partners against EU, US (OFAC SDN/Sectoral), UK lists, as well as local lists in jurisdictions of presence.

   At this stage it is important not only whether someone is present/absent on the lists, but also the assessment of:

   • the degree of risk under the «50% rule» (when aggregate ownership by sanctioned persons is ≥50%);
   • the probability of individual shareholders and top management being included in sanctions lists in the coming years;
   • the degree of contamination of ownership chains.
3. Modeling sanctions scenarios

   For significant groups we model sanctions scenarios:

   • what will happen if one of the key beneficiaries is sanctioned;
   • how inclusion on the SDN list will affect access to correspondent banking in euros and dollars;
   • which assets will be frozen and in which jurisdictions;
   • how the expansion of EU and US sanctions in 2026 will affect current supply chains, licenses, IP and the capital market.
   We then use such a sanctions risk matrix as a basis for designing the new corporate architecture.

Restructuring of international holding structures

Once the risk picture is clear, the main question arises: targeted adjustments or a complete restructuring of the international holding.

Case logic: from cosmetic fixes to redomiciliation

In COREDO’s practice, I conventionally divide situations into three levels:

1. Cosmetic adjustment
   Example: a holding in the EU, beneficiaries are not under sanctions, but banks have tightened sanctions compliance and started regularly requesting UBO disclosure, source of funds, and transaction documents.

   The solution developed by COREDO here usually includes:

   • adjusting the group’s sanctions policy and the KYC package to the requirements of international banks;
   • reworking standard contracts to include sanctions clauses;
   • implementing a formalized sanctions screening of counterparties and documenting the economic substance of transactions.
2. Structural fine-tuning
   Example: an international holding with operating companies in the EU and Asia, some shareholders are located in a sanctions-sensitive jurisdiction, and banks have begun blocking certain transactions.

   Here we are already talking about:

   • changing ownership chains to reduce sanctions risk for subsidiaries;
   • possible separation of individual assets into a separate holding structure (ring‑fencing sanctions risks);
   • diversification of jurisdictions for holding and operating companies (Europe + Asia, using neutral jurisdictions with a stable legal system).
3. Deep restructuring / redomiciliation
   Example: a beneficiary is listed on sanctions lists, the existing holding in Europe has some assets already at risk of freezing, banks refuse to service it and close correspondent accounts.

   In such cases, the COREDO team has carried out projects including:

   • redomiciliation of the international holding to a jurisdiction that is more resilient to sanctions;
   • re-registering the holding in a friendly jurisdiction while retaining control, complying with substance requirements, and minimizing tax risks;
   • a possible spin‑off and separation of the business into a sanctions-sensitive part and a “clean” segment to protect investment appeal and the ability to work with global partners.

Choosing a Jurisdiction for a Holding Company After Sanctions

The question I hear most often: “Which jurisdiction is currently the safest from a sanctions perspective?” There is no universal answer, but there is a set of criteria we follow at COREDO.

Key Selection Criteria

When choosing a jurisdiction for a new holding company under sanctions pressure, I look at:

• sanctions policy and international obligations
  Participation in EU, US, UK sanctions regimes, historical enforcement practice, tendency towards extraterritorial effect.
• stability of the legal system and protection of property rights
  Including access to international arbitration, predictability of the courts, availability of investment protection agreements (BITs).
• tax regime and double taxation treaties
  It’s important not only the nominal tax burden but also the real ability to apply DTTs without a risk of accusations of treaty shopping.
• substance and real presence requirements
  The role of business purpose (substance): presence of an office, resident directors, employees, head‑office functions in an international holding.
• banks’ and regulators’ approach to sanctions risks
  The level of “over‑compliance”, banks’ tendency to proactively refuse service, practice of UBO disclosure and sanctions screening.

Diversifying Jurisdictions and Neutral Hubs

COREDO’s experience confirms that, under sanctions, diversifying jurisdictions for holding and operating companies often yields better results than relying on a single holding center.

• One or two key holding jurisdictions for asset ownership (EU and/or Asia);
• Regional sub-holdings (Europe, Asia, sometimes the Middle East) to separate sanctions and operational risks;
• Choosing jurisdictions perceived by the market as maximally “neutral” and predictable in terms of sanctions, while having a functioning banking system and access to international payments.

Important: de-offshorization and sanctions are closely linked. Structures built solely on offshore companies without real substance appear vulnerable on the sanctions agenda — both to regulators and to banks.

Banks, cross-border payments and sanctions

Even a perfectly structured corporate structure stops working if bank compliance views the group as a sanctions risk.

• banks refusing to provide services and account closures;
• payment rejections due to sanctions screening of the counterparty or beneficiary;
• sanctions and closure of correspondent accounts, which make settlements in certain currencies impossible;
• increased levels of «over‑compliance»: banks sometimes block transactions that do not formally violate the sanctions regime but appear risky to them.

Relations with banks

Our experience at COREDO has shown: when working with international banks under sanctions, the groups that succeed are those that:

• formalize a sanctions compliance policy and can show the bank not only declarations but also procedures that actually work;
• conduct sanctions screening of counterparties and UBOs, retaining records and logs of checks;
• have a ready legal opinion on sanctions law for complex transactions and can promptly provide it to the bank.

When a bank refuses payment because of sanctions risk, three types of arguments work best:

1. A complete package of KYC/AML documents for the counterparty and beneficiaries.
2. A detailed description of the transaction chain and a documented business purpose (economic substance).
3. A legally vetted opinion (legal opinion) on the operation’s compliance with the sanctions regimes of the EU/US/UK.

Alternative payment solutions and cash management

Given restrictions on cross-border loans, traditional lending and cash‑pooling, we increasingly use:

• diversification of banking infrastructure across regions and currencies;
• alternative settlement centers and clearing systems where permissible and not violating the sanctions regime;
• rethinking intra-group financing: intercompany loans, guarantees, cash‑pooling taking into account thin capitalisation and sanctions restrictions.

Redomiciliation, M&A and sanctions due diligence

Sanctions pressure is increasingly a trigger for:

• re-registration of business in a new jurisdiction;
• redomiciliation of holding companies;
• M&A transactions aimed at selling sanctions-sensitive assets or spinning them off into separate structures.

How to redomiciliate a holding company

A typical redomiciliation project that we handle includes:

1. Assessment of tax risks when relocating the holding
   Exit taxes (exit tax), potential triggers of CFC regimes, impact on the applicability of double taxation treaties.
2. Sanctions analysis of the new jurisdiction
   How involved it is in the sanctions regimes of the EU, the US and the UK, enforcement practice, banks’ readiness to work with the group’s profile.
3. Documenting the business purpose (substance)
   Why the group is relocating: political risk, sanctions risk, the need to protect assets — all of this should be properly documented to avoid allegations of abuse of regimes and treaty shopping.
4. Changes to corporate governance and documents
   Articles of association, shareholder agreements, policies & procedures on sanctions compliance and working with high‑risk counterparties.

Sanctions due diligence in M&A transactions

In M&A transactions, the sanctions factor has become a separate block of Due Diligence:

• beneficiary checks, directors and key counterparties of the transaction target;
• assessment of deal‑breaker sanctions factors that prevent banks from financing the transaction or servicing the group after the deal;
• analysis of sanctions clauses (representations & warranties, indemnities, limitation of liability) in the SPA;
• setting up escrow mechanisms and carve‑out schemes for sanctions‑sensitive assets.

The COREDO team supports such transactions not only at the legal level but also in terms of AML and sanctions compliance, which is important when engaging banks or investment funds.

Internal sanctions compliance in a corporation

True resilience to sanctions is achieved not by schemes, but by a system.

Components of a working sanctions system

In successful projects implemented by the COREDO team, there are recurring elements:

• group sanctions policy
  A formalized document understandable to the board of directors, top management and operational teams.
• KYC procedures/AML and sanctions screening of counterparties and UBO
  Regulation: whom, how and to what depth we verify, how we document the results, how we make decisions on high‑risk clients and partners.
• sanctions risk‑based approach
  A risk map by jurisdictions, transaction types, counterparties, business units; a defined risk appetite and the board of directors’ sanctions tolerance.
• internal controls and control points
  Who and at what stage of the transaction is responsible for the sanctions function: legal, finance, compliance, business units.
• training & awareness
  Training key employees: how to identify sanctions risks, when to involve lawyers, how to communicate with banks when payments are blocked.

Personal and corporate responsibility

Under sanctions the director’s responsibility and top management have become personal: sanctions violations can lead not only to fines for the company, but also to personal restrictions.

How to approach changes in a holding company

If to summarize COREDO’s project experience, the practical roadmap for an international holding under sanctions restrictions and the tightening regimes of the EU, US and the UK looks like this:

1. Diagnosis
   • a complete map of the corporate structure and ownership chains;
   • sanctions screening of beneficiaries, directors, key counterparties and banks;
   • modeling sanctions scenarios.
2. Strategic decision
   • whether targeted fine‑tuning or deep restructuring is needed;
   • selection of jurisdictions for holding companies and regional sub‑holdings;
   • designing the target corporate architecture with regard to sanctions resilience and tax planning.
3. Legal and tax implementation
   • redomiciliation, reregistration, spin‑off, corporate restructuring;
   • updating corporate agreements, governance, policies & procedures;
   • setting up intragroup financing taking into account sanctions and banking restrictions.
4. Banking and payment infrastructure
   • setting up relationships with banks, preparing KYC/sanctions packages;
   • diversification of banks, currencies and settlement channels;
   • creating internal protocols to respond to freezes and rejections.
5. Integration of sanctions compliance into management
   • implementation of a risk‑based approach;
   • training of management and key employees;
   • regular monitoring of changes in sanctions legislation and updating policies.

When an entrepreneur asks me which is faster: to set up a new entity or to buy a ready-made financial company in the EU, I always answer the same: the speed of the deal means nothing without quality Due Diligence. This is where those who treat the review not as a formality but as an investment in their future business win.

And conversely: where the COREDO team conducted a comprehensive company review, the client entered the deal knowingly, with a clear understanding of the risks, a fair price and workable guarantees from the seller.

Due Diligence when purchasing a financial company in the EU

Ready-made financial companies in Europe are not just a “shell with a license”. They are:

• existing obligations to regulators and tax authorities;
• transaction history, clients and counterparties;
• executed contracts and legal risks;
• internal control systems and AML procedures;
• reputation in the market and with supervisory authorities.

When acquiring a company in Europe you buy all of this at once, along with the potential problems of the previous owner.

That is why I view financial due diligence, legal due diligence and tax due diligence not as three separate services, but as a single comprehensive review of the company in which the components are closely connected.

Express analysis or full due diligence: how to choose?

At COREDO we conventionally divide checks into two levels:

Express due diligence analysis

I use the express format when:

• the client needs to quickly assess the feasibility of the transaction;
• there are several targets for purchasing a ready company in the EU and a preliminary ranking is required;
• the budget at the first stage is limited, but it is necessary to weed out clearly problematic options.

As a rule, express due diligence analysis includes:

• basic review of corporate documents;
• initial check for ongoing litigation and public sanctions;
• review of licenses and permits;
• overview of key financial statements and indicators;
• initial assessment of the company’s legal cleanliness and obvious tax risks when buying the company.

When due diligence is unavoidable

I consider full due diligence mandatory if:

• the target is a licensed financial company (payment institution, electronic money institution, investment firm, crypto company CASP/VASP, etc.);
• the buyer intends to use the company as a strategic asset — developing it, scaling it, attracting investors;
• the deal size is significant, and an error would be critical for the business.

In a full due diligence we include:

• detailed financial due diligence;
• in-depth legal due diligence;
• a separate tax analysis block;
• review of the internal control system, AML/KYC procedures, governance;
• assessment of market position and business model.

Structure of due diligence for a financial company

When the COREDO team gets involved in a project to review a ready-made company in the EU, I look at it across several key areas.

Legal due diligence: verifying the transaction’s integrity

What’s included:

• Review of corporate documents
  • charter, articles of association, resolutions and minutes of governing bodies;
  • ownership and control structure, beneficiaries;
  • existence of restrictions or encumbrances on shares/stakes;
  • history of changes in members/shareholders and directors.
• Analysis of the company’s contracts and liabilities
  • agreements with key clients and counterparties;
  • agreements with IT infrastructure providers, PSPs, banks;
  • leases, outsourcing, white label, agency agreements;
  • pledges, guarantees, sureties.
• Review of the company’s history and litigation
  • current and past legal disputes;
  • administrative cases, regulatory fines;
  • investigations in AML/sanctions, claims by supervisory authorities.
• Intellectual property and IT assets
  • rights to software, domains, trademarks;
  • license agreements;
  • confidentiality and trade secret regime.

The result of this section: an understanding of to what extent the company’s legal soundness meets the buyer’s expectations and what set of warranties and representations from the seller will be required in the SPA.

Financial due diligence: numbers and debts

Main elements:

• Review of the company’s financial condition
  • analysis of financial statements for 2–3 years;
  • revenue, gross and operating profit;
  • expense structure and margins.
• Assessment of working capital
  • level and composition of accounts receivable and payable;
  • policy for provisioning doubtful debts;
  • presence of problematic or “stalled” positions.
• Net debt and debt burden
  • loans, borrowings, financial leasing;
  • intragroup obligations;
  • structure and cost of debt capital.
• Adequacy of reserves when acquiring a company
  • reserves for legal disputes;
  • reserves for disputed taxes;
  • assessment of potential “off‑balance” risks.
• Analysis of the actual operational activity
  • consistency of turnover with the business model;
  • relationship between actual cash flows and those reported in the financial statements;
  • check for “inflated” turnover or artificial profit before sale.

The task of this stage is to give the buyer an honest answer: how sustainable the current financial picture is and whether there are any “time bombs” in the form of concealed liabilities.

Tax due diligence: main risks

Tax risks when acquiring a company in the EU are often underestimated, especially when it comes to cross-border structures involving multiple jurisdictions.

In the tax section we include:

• analysis of tax returns and calculations for main taxes over several years;
• reconciliation of the tax base and financial statements;
• checks of correct application of exemptions and special regimes;
• assessment of cross-border transfer pricing schemes and intra-group services;
• identification of potential unrecognized tax liabilities.

In practice, three instruments are used:

• adjustment of the deal financing structure (debt/equity, earn‑out, deferred payments);
• tax-optimized structuring of ownership (holdings, jurisdictions in the EU and third countries);
• inclusion in the SPA of specific tax warranties and representations by the seller and compensation mechanisms.

AML and internal control in financial companies

The COREDO team regularly provides AML consulting and support to financial institutions, so in such transactions we always check:

• existing AML policies/CFT, KYC, sanctions control;
• risk‑based approach procedures, client categorization;
• work of the compliance officer and the internal audit function;
• quality of client files and completeness of KYC documentation;
• existence and content of reporting to regulators;
• cases of blocks, refusals to provide services, regulator inquiries.

This section allows us to assess:

• how compliant the company is with regulatory requirements;
• whether there is a risk of sanctions or license revocation;
• how easily the company can be integrated into your existing compliance system.

personnel management in the organization

I always pay attention to:

• management structure and allocation of functions;
• key employees: directors, MLRO/AML officer, heads of departments;
• motivation system and the risk of critical personnel leaving after the deal;
• presence of internal regulations and KPIs.

Market position and business model

For financial companies in Europe, especially with EMI/PI or CASP/VASP licenses, I always look at:

• assessment of the target company’s market position;
• structure of the client base;
• dependence on individual providers or partners;
• sustainability of the business model and its scalability.

Two-stage process: data collection and negotiations

Stage 1. Initial collection and rapid analysis

At this stage I:

• compile the list of documents to be analyzed;
• organize access to the data room (electronic document archive);
• conduct an initial screening for red flags: litigation, sanctions, regulatory risks, major tax inconsistencies.

• either walk away from the deal;
• or radically revise its structure and price.

In-depth analysis and conclusions

After the initial filter, the COREDO team proceeds to detailed examination:

• all material contracts;
• financial metrics and calculations;
• internal procedures and control systems.

The result is a due diligence report:

• a detailed opinion for each section;
• a list of identified risks and their likelihoods;
• an assessment of investment risks and possible consequences;
• recommendations for minimizing the impact of risks and mitigating them.

How to use due diligence to your advantage

Revising the price and terms of the deal

• adjust the transaction price and guarantees;
• request additional guarantees and seller’s representations;
• require withholding part of the payment in escrow until certain risks are remedied;
• initiate a review of payment terms based on the DD findings (deferment, earn‑out, partial buy‑out).

Structure of deal financing

Based on the review:

• the financing structure of the deal changes (balance of equity and debt);
• covenant terms for banks and investors are determined;
• a tax‑efficient ownership structure is formed.

Enter the deal or walk away

Due diligence for financial companies in the EU

Unlike classic M&A in the real sector, due diligence of financial companies in the EU has its own specifics:

• mandatory verification of licenses and compliance with regulator requirements;
• analysis of interactions with correspondent banks and payment providers;
• review of the history of regulatory inspections and any enforcement orders;
• assessment of reputation in the market and in the professional community.

The COREDO team regularly supports clients in obtaining financial licenses in EU countries, the United Kingdom, Singapore, and also supports transactions for the sale of companies. This experience helps us see which requirements are particularly sensitive for specific jurisdictions and segments (EMI/PI, investment firms, crypto companies).

How to prepare for due diligence

Based on my experience, I will outline a few recommendations that help entrepreneurs and chief financial officers navigate the acquisition of an established company in the EU in an informed manner:

1. Engage experts early. The ideal time is before signing the LOI or at its stage, with clear provisions preserving the right to withdraw from the deal based on the results of the due diligence.
2. Decide on the format: express or full. For initial target screening an express analysis is sufficient; for the final selection and price negotiations, only a full due diligence.
3. Discuss access to data with the seller right away. A transparent, well-structured data room is a good indicator of the seller’s good faith.
4. Focus on critical risk areas. For financial companies these include: licenses, AML/KYC, taxes, litigation, debt burden, client structure.
5. Use the findings of due diligence in negotiations. A quality report is an argument, not just a box-ticking exercise.
6. Plan integration in advance. Based on the review results, you should immediately develop a plan: changes to governance, updating policies, revising contracts, strengthening compliance.

How COREDO helps you navigate the process

Since 2016 COREDO has supported international business in company formation, licensing and legal Due Diligence in Europe, Asia and the CIS.

• understands the specifics of financial licenses and regulatory requirements;
• combines legal, financial and tax due diligence within a single team;
• is able to integrate the review with the subsequent deal structure and post-sale support.

In a typical due diligence project for a financial company in the EU the COREDO team:

• analyzes the legal status and corporate structure;
• conducts a financial review of the company and its financial statements;
• assesses the tax risks of the transaction target and options for their mitigation;
• checks the internal control system of the target company and its AML procedures;
• prepares a clear report for owners and investors, prioritizing risks;
• helps use the findings in negotiations and in the contract structure.

When a manager sees not only a list of risks, but also a clear plan for how to mitigate them, how to structure financing and which seller guarantees to request: the deal stops being a lottery and becomes a manageable process.

Over the years of COREDO‘s work with international banks in Europe and Asia I have seen that the key mistake businesses make is to treat a refusal as the final point. In fact, it is a signal: your profile in the bank’s eyes and your internal compliance system do not match its risk appetite. That means this can and should be managed.

In this article I will explain how to:

• interpret a bank’s refusal to open a company’s current account and a subsequent refusal by the bank to service the business;
• prepare for initial and repeat onboarding at the bank;
• reduce the risks of a company’s account being blocked in the long term;
• build systematic AML support for companies and an internal compliance that banks perceive as an asset rather than a problem.

Reasons a bank might refuse a loan

The phrase “refusal without explanation” protects the bank from disputes and from revealing risk-management methodologies. But there are almost always reasons. In COREDO’s practice, five blocks are most common.

Jurisdictional and industry risks

The bank assesses:

• the country of company registration;
• the country of tax residency of the beneficiaries;
• the countries of counterparties and the geography of payments;
• the industry (fintech, crypto, gambling, forex, PSP, cross-border e-commerce, etc.).

In one COREDO case we structured a group where the holding was located in a neutral European jurisdiction, the operating companies were in Asia, and the clients were worldwide. Without explaining the logic of the structure and documenting the economic rationale of the operations for the bank, it looked like a set of “shell” companies. After preparing a detailed diagram of business processes, substance and tax logic, the bank not only approved the account but also expanded the limits after several months of operation.

Ownership and beneficiary structure

The bank considers important:

• whether there is a clear ultimate beneficial owner (UBO);
• whether there is an excessive number of ownership layers;
• whether trusts, foundations, or nominee structures are present;
• whether there are PEP / sanction risks, negative news.

In such cases the COREDO team often adjusts the ownership structure for bank onboarding: we simplify levels, bring the UBO “into the light”, and document connections and sources of funds.

Business model and transactional profile

A bank’s scoring of a corporate client today relies not only on the industry but also on the expected transactional pattern:

• payment volumes and frequency;
• share of cross-border transfers;
• currencies;
• types of counterparties and jurisdictions.

In COREDO’s practice there was a client: a payment intermediary with a history of high chargebacks and disputed transactions at the previous PSP. We conducted a legal audit of the company before submitting the bank application, rebuilt the contractual base with merchants, implemented an anti-fraud policy and prepared an evidence base to justify the legality of revenues. After that, reopening an account after a compliance refusal became possible at another European bank.

Client history and external signals

Banks widely use:

• negative news screening and reputational risk;
• public registers, court cases, media;
• internal and external watchlists/blacklists.

We encountered the case “client on another bank’s blacklist: what to do”: we collected documents explaining the past case (an erroneous alert on a transaction, incorrect interpretation of a counterparty), and prepared a separate memorandum for the new bank, minimizing the risk of inclusion in the bank’s internal blacklist already at the application stage.

Bank risk appetite and scorecard

Even a legally perfect structure may not pass a bank’s internal scorecard for assessing corporate clients.

What to do in case of a bank refusal?

If a bank refusal occurs without explanation, the company has three key tasks:

1. record the consequences (and not worsen the situation);
2. understand what exactly triggered it;
3. set up a repeat onboarding after the bank refusal – either with the same bank or with another bank.

Maintaining control of the situation

Practical minimum:

• do not argue emotionally with the bank and do not ‘press’ for disclosure of reasons;
• request a written notice of refusal/account closure (if the bank issues one);
• clarify the account closure timeframe and the procedure for withdrawing funds;
• record in your system the date and circumstances of the refusal – this will be useful when analyzing the bank refusal and preparing for repeat onboarding.

Internal due diligence of the company

Before applying to a new bank, it is important to:

• conduct a legal audit of the company before submitting the application to the bank;
• assess how your company appears through the lens of AML/KYC:
  • beneficiaries;
  • contractual framework;
  • counterparty policy;
  • source of funds / source of wealth;
  • transaction and blocking history.

The COREDO team often models a bank’s risk assessment of a client: we apply an approach similar to the bank’s logic, analyzing jurisdiction, industry, reputation, media screening, structure, and transactions. This allows us to see in advance which alerts will be triggered in a bank’s scoring of a corporate client.

How to create a transparent picture of the business

Internal package to prepare before contacting the bank:

• corporate documents;
• ownership structure with a visual diagram;
• description of the business model and the value chain;
• key contracts;
• policy for working with counterparties;
• financial statements.

Strategy for repeat onboarding

After the internal audit, the question arises: where exactly to undergo secondary onboarding after a bank refusal. Options:

• the same bank (if the refusal is related to missing documents or incomplete disclosure of information);
• another bank in the same jurisdiction;
• a bank in another country, with a different risk appetite;
• a combination of a traditional bank and EMI/fintech solutions (as part of a ‘multibanking’ strategy).

How to prepare for onboarding at a foreign bank

Onboarding of corporate clients in Europe and Asia today is not just filling out a form. It is a comprehensive check of KYC/KYB, transactional logic, substance and reputation.

Documents for bank onboarding

Standard package:

• incorporation documents;
• register of shareholders / UBO;
• documents of directors and beneficial owners (ID, proof of address);
• description of activities and business plan;
• key contracts;
• financial statements and tax filings (if there is a history).

For companies with elevated risk: additionally:

• confirmation of economic substance (office, employees, real operations);
• company policy & procedures on AML/KYC;
• internal policies on counterparties and transactions;
• description of transaction monitoring systems / transaction monitoring within the company.

The COREDO team regularly prepares KYC packages for clients for foreign banks: from corporate document templates to business description phrasing that is clear to a compliance officer.

KYC for legal entities and KYB

In KYC for legal entities and KYB procedures the bank checks:

• who the ultimate beneficial owners and controlling persons are;
• whether there are nominee shareholders without a real economic role;
• whether the stated activity corresponds to the contract base;
• whether there is confirmation of source of funds / source of wealth.

Therefore one of the key areas of COREDO’s AML consulting is the adjustment of contracts and business processes to AML requirements/KYC, so that the business appears to the bank exactly as it operates in reality.

How to prepare for digital onboarding

With the growth of digital onboarding / remote onboarding, banks’ requirements for the quality of data and documents have tightened. Automated systems:

• analyze documents for forgeries;
• cross-check data with external registries;
• immediately run screening against sanctions lists and PEPs;
• apply pre-configured risk scoring models based on transaction patterns.

To reduce the risk of rejection during remote onboarding, at COREDO we:

• prepare documents in advance in formats that are easily read by systems;
• fill out questionnaires so they are consistent with each other and with corporate documents;
• prepare the client for possible re-identification by the bank, video interviews and follow-up questions.

Bank’s refusal to serve a company

Bank refusal to serve an operating company and the subsequent offboarding of the client (bank delisting) is one of the most painful scenarios.

Reasons for blocks and offboarding

Typical triggers:

• a sharp increase in turnover without prior notice;
• a change in the geography of payments (for example, a mass entry into new markets);
• an increase in the share of cross-border payments;
• transactions atypical for the previously observed profile.

How to communicate with the bank after a refusal

If a refusal has nevertheless occurred, at COREDO we almost always recommend that the client develop a communication strategy with the bank after the refusal:

• record exactly which questions compliance raised;
• prepare a structured package of responses and documents;
• if possible, request a formal reconsideration (if there are grounds).

How to reduce the risk of compliance rejections

Mature businesses today perceive banking compliance support services not as «additional expenses», but as an investment in access to the financial infrastructure.

Which internal policies do banks need?

From COREDO’s practice, the minimum looks like this:

• AML policy and procedures (KYC/KYB, handling high-risk counterparties, sanctions lists);
• transaction monitoring policy;
• procedure for responding to requests from banks and regulators;
• a documented policy on sources of funds and confirmations of beneficiaries’ incomes;
• a retention policy for documents and the evidentiary record.

How to manage a bank’s reputational risk

Banks pay special attention to:

• beneficial owners’ public profile;
• media mentions;
• litigation and regulatory cases.

Multibanking strategy and choice of jurisdictions

One of the most practical takeaways we advise our clients is: don’t build your business relying on a single bank. Especially when it comes to an international group of companies.

Why do businesses need multibanking?

How to choose banks in Europe and Asia

Our experience at COREDO has shown that for companies from the CIS operating in the EU and Asia, it’s important to consider:

• real economic substance in the chosen country;
• transparency of the tax model;
• the presence of a direct and clear beneficial owner;
• the bank’s sector policy.

How to minimize rejections during COREDO onboarding

I’ll outline, in practical terms, how the COREDO team typically gets involved in projects where there is already a refusal to open a corporate bank account or a risk of delisting.

Site audit and strategy

1. Legal and compliance audit: structure, contracts, beneficiaries, transactions.
2. Modeling bank scoring for a corporate client across different jurisdictions and types of banks.
3. Developing a strategy:
   • we adapt the business model and structure to the requirements of target banks (restructuring the business model to meet the bank’s requirements);
   • or we choose financial institutions whose risk appetite better matches the company’s current profile.

KYC dossier and onboarding: preparation

The COREDO team has carried out dozens of projects where the key to success was the careful preparation of the KYC package for a foreign bank:

• we prepare a package of documents and business descriptions;
• we work out responses to standard and complex questions from compliance officers;
• we prepare a guide for an in-depth compliance interview with the bank;
• we manage communications until a decision is reached.

AML support for companies

A separate area: support after account opening:

• assistance in responding to regular queries about transactions and counterparties;
• documenting changes (change of beneficiaries, changes to the structure, expansion of payment geography);
• preparing for limit increases or the addition of new products.

To summarize my experience since 2016, resilience to bank rejections is not about “finding the one right bank”, but about building your business, structure and processes so that banks see you as a predictable, manageable and understandable partner.

To summarize my experience as the founder of COREDO, most questions and problems for international businesses today arise not from company registration or even from obtaining a license, but from how to move forward in a world of continuous transaction monitoring and strict AML compliance requirements.

An entrepreneur sees one thing: “the payment was delayed again”, “the bank requested a package of documents”, “the client’s wallet is blocked pending investigation”.
But here’s what’s happening behind the scenes: a complex AML transaction monitoring system, hundreds of AML rules, dozens of AML scenarios, thousands of AML alerts daily and a constant struggle between risk and customer experience.

1. which typical suspicious transaction monitoring scenarios most often trigger alerts;
2. how these scenarios look from the perspective of a bank/fintech/licensed company;
3. what an owner or chief financial officer can do to reduce the number of unnecessary alerts without exposing the business to regulatory risk.

I base this on COREDO’s real-world practice: company registration in the EU and Asia, obtaining financial licenses, setting up AML functions and supporting clients in the Czech Republic, Slovakia, Cyprus, Estonia, the United Kingdom, Singapore, Dubai and other jurisdictions.

Why a payment ends up in AML monitoring

Any bank, fintech, payment institution, crypto exchange or virtual asset service provider is required to have a functioning anti-money laundering monitoring system. This is not “desirable”, but a direct requirement of regulators in the EU, the United Kingdom, Singapore, the UAE, and many countries in Asia and the CIS.

Inside such a system there are always three layers:

• KYC and transaction monitoring
  Customer profile, customer risk rating, customer behavior profile, expected turnover and expected transaction pattern. It is precisely through the combination KYC + transaction monitoring that the system determines whether this transaction is normal for a specific customer.
• Rule-based / scenario-based transaction monitoring
  A set of aml scenarios and aml rules that catch unusual transaction patterns, high-risk transactions, cross-border transactions with increased risk, operations with high-risk jurisdictions, PEPs and sanctions alerts, etc.
• Alert handling & investigations
  Generation of transaction monitoring alerts, their prioritization, investigation, escalation, and, if necessary, submission of a suspicious activity report (SAR) to the financial intelligence unit (FIU) and a full aml transaction monitoring audit trail.

Common scenarios that trigger AML alerts

Typical scenarios that most often trigger AML alerts are recurring patterns of client behavior and transactions that automated systems recognize as potentially suspicious operations. By breaking down scenarios such as structuring / smurfing and payment fragmentation, it is easier to understand why alerts fire on them more often and how the compliance team responds.

I am designed to:

• Synthesize information from search results
• Answer users’ informational questions
• Provide analytics based on factual data

• the client regularly makes many small payments,
• each of them just below formal AML transaction thresholds,
• in total over a short period this is a significant volume.

Systems see such smurfing / structuring alerts as:

• frequent operations for similar amounts;
• splitting a single logical payment into a chain of small ones;
• fragmentation between related accounts or related-party transactions.

Key to reducing false positives:
clearly document transaction profiling, the business rationale for structuring, and agree this with the bank/provider.

Rapid turnover of funds in the account

Rapid movement of funds alerts occur when money:

• arrives and leaves almost immediately;
• moves quickly through several accounts;
• pass through complex chains (back-to-back, round-tripping funds, mirror transactions).

Common triggers:

• intra-group transactions monitoring between related companies;
• rapid turnover through corporate accounts with a small balance;
• a sudden increase in turnover without a clear explanation.

What helps:

• a documented customer behavior profile and a description of business cycles;
• transparent contracts, invoices, and supply chain payment risk logic;
• pre-configuring scenarios for the client type: trade, fintech, payment provider, etc.

Unusual geography and high-risk jurisdictions

One of the most frequent questions from clients:
“Why does a payment to a new country immediately trigger an alert?”

The system monitors:

• the sender’s and recipient’s countries;
• correspondent banks (correspondent banking risk, nested relationships risk);
• links to sanctioned or offshore jurisdictions;
• sharp changes in geography (yesterday – only the EU, today – payments to several high-risk jurisdictions simultaneously).

The right strategy:

• adapt AML scenarios in advance taking into account regional typologies Europe / Asia / Africa;
• conduct an AML risk assessment for new directions;
• update the customer risk rating taking into account new countries and products.

Dormant account reactivation: sudden reactivation

Dormant account reactivation alerts: one of the most underestimated yet dangerous scenarios:

• the account was unused for a long time;
• then large or numerous transactions occur in a short period;
• especially if the nature of the transactions or the geography changes.

This can be inconvenient for the business: the company “unfroze” one of its old accounts in Europe, started new operations – and received a series of AML alerts and requests for documents.

• pre-notification of the planned account reactivation;
• description of the new expected transaction pattern;
• if necessary – updating KYC and enhanced Due Diligence (EDD).

Large transactions and high risks

Large value transaction alerts trigger when value-based thresholds are exceeded, often in combination with:

• non-standard counterparties;
• high-risk industries (gaming, gambling, certain MCCs, cash-intensive businesses);
• an unusual currency or jurisdiction;
• an unusual frequency of large transactions.

For a corporate client it is critical here:

• describe limits and typical amounts in advance;
• provide transparent documents for key contracts;
• monitor so that one-off large transactions nseemed like an inexplicable “bulging” of the turn.

Crypto and virtual assets in banking

A topic that has come up more frequently in COREDO’s practice in recent years – cryptocurrency transaction monitoring, virtual asset service provider aml monitoring and on-ramp / off-ramp transaction monitoring.

Triggers:

• regular transfers to crypto exchanges and back;
• fiat payments to unknown VASPs;
• transactions involving stablecoins and DeFi monitoring through custodial wallets;
• transfers related to high-risk exchanges or anonymizing services.

• virtual assets and crypto exchanges risk;
• source of funds and beneficial ownership transparency;
• risks of layering and the integration stage of money laundering through crypto instruments.

• specialized scenarios for crypto-related transaction monitoring;
• device and channel analysis in AML (web, mobile, API);
• integration with blockchain data providers and high-risk address lists.

Customer behavior in AML alerts

With modern regulatory expectations, a single simple set of rules «if amount > X, generate an alert» is no longer enough. The following come into play:

• customer behavior monitoring AML;
• transaction frequency analysis and velocity checks in transaction monitoring;
• behavioral analytics in transaction monitoring and anomaly detection in AML monitoring.

The system looks not only at absolute amounts, but also at:

• deviations from the customer behavior profile;
• out-of-pattern transactions;
• seasonality and cyclicality of transactions;
• correlation with new products or markets.

How the AML transaction monitoring system works

An entrepreneur needs to understand not only the scenarios themselves but also how the system operates as a whole.

Rule-based or machine learning?

In COREDO’s real projects for implementing and configuring systems for banks, fintechs and payment institutions, a hybrid model is most often used:

• rule-based transaction monitoring
  Classic rules and scenarios: thresholds, country lists, structuring patterns, specific trade-based money laundering red flags, invoice fraud transaction patterns, mule account detection scenarios, scam-driven transfer detection.
• machine learning in transaction monitoring
  Anomaly detection algorithms, supervised vs unsupervised AML models, behavioral analytics, recommendations for alert prioritization and reduction of false positives.

• how AML model risk management is implemented;
• whether there are procedures for AML model validation for transaction monitoring;
• what audit trail and AML documentation exist;
• how data quality issues in transaction monitoring are addressed.

Calibration and threshold testing

The second critical area is AML transaction monitoring calibration:

• AML alert thresholds optimization;
• tuning suspicious transaction monitoring scenarios;
• above the line / below the line testing AML;
• AML scenario effectiveness testing.

• thresholds and scenario parameters do not match a real risk-based approach;
• there is no regular scenario library management and scenario coverage assessment;
• there is no functioning AML continuous learning feedback loop from analysts to rule owners.

Governance, KPIs and working with the business

A working AML transaction monitoring function is not only about technology and scenarios, but also about proper governance:

• AML alerts governance framework;
• the three lines of defence model in AML;
• governance of the financial crime function and financial crime committees;
• regular internal audits of transaction monitoring and independent validation of AML systems;
• regulatory inspections and reviews, preparation for inspections and addressing findings.

For the board and senior management, the following are important:

• key risk indicators (KRI) for AML;
• management information (MI) for AML;
• service level agreements (SLA) for alert handling;
• team workload and resource planning for AML teams;
• AML transaction monitoring ROI and cost of compliance vs cost of non-compliance.

What entrepreneurs and CFOs can do now

I’ll list practical steps that significantly reduce the “pain” of AML monitoring for operating businesses and are almost mandatory when launching new projects in Europe and Asia.

How to map your business model to AML

For a bank, your business is a set of risks, not just revenue. The task is to help the compliance team understand you.
I recommend preparing:

• a description of the business model with a focus on payment flows;
• customer segments, customer risk rating by groups;
• typical volumes, currencies, geography, expected transaction pattern;
• a list of high-risk industries if you work with them (gaming, gambling, cash-intensive, high-risk MCCs);
• group structure, ultimate beneficial owner (UBO) screening, complexity of corporate structure and use of virtual office / co-working addresses.

Transparency of banks and providers

Even large international banks often hide the logic of scenarios behind the formulation “required by the regulator”.

• discuss transaction monitoring common red flags and typical scenarios that trigger for your business;
• ask for examples of frequent AML alert scenarios in transaction monitoring for your type of business;
• clarify how the bank uses name screening vs transaction screening, sanctions screening and transaction monitoring, adverse media screening and PEP checks.

Invest in an internal AML function

For licensed companies (payment institutions, EMI, forex, crypto platforms, neobanks) this is a mandatory requirement of regulators in Europe and Asia.

• an in-house department + external COREDO support for complex issues;
• partial outsourcing of AML monitoring, where an internal compliance officer manages the provider;
• managed services for transaction monitoring, if the business is not ready to build a large team.

Data and IT landscape quality

Even the most expensive AML platform is powerless if:

• data sources are not synchronized;
• there are gaps in KYC, UBO, geodata, IP, device;
• there is no control over data quality issues in transaction monitoring.

• analysis of data ingestion and data mapping;
• checking data quality controls and completeness checks;
• the need for data enrichment (IP, device, geo), device fingerprinting in fintech, IP address risk indicators, geolocation risk scoring.

How to choose a jurisdiction and a license

choosing a jurisdiction for a holding or a financial license directly affects which AML transaction monitoring regulatory expectations you will have to meet.

• the EU (including the Czech Republic, Slovakia, Cyprus, Estonia, Latvia, Lithuania, Poland, the United Kingdom, etc.);
• Singapore, some Asian and Middle Eastern jurisdictions;
• CIS countries.

• local typologies from regulators and industry bodies;
• expectations for transaction monitoring in cross-border payments;
• requirements for governance of the financial crime function and the resource intensity of the AML function;
• scalability prospects: AML monitoring for multi-jurisdictional business, synchronization of rules across different countries.

How does COREDO help in practice?

• support for the launch of fintech projects and payment institutions in the EU;
• registration and support of crypto platforms and VASP;
• configuration of AML monitoring for neobanks, including real-time transaction monitoring alerts;
• optimization of existing monitoring systems for international holdings operating in Europe and Asia.

The approach is always the same:

1. We understand the business model and the real risk exposure.
2. We build the architecture of the AML/CTF function and a risk-based approach.
3. We help select and implement a technological solution (including cloud-based AML platforms, API-based integration with core banking, data lakes for AML analytics).
4. We configure scenario design, threshold setting, above/below the line testing.
5. We build governance, MI/KRI, escalation processes and interactions with the regulator.
6. We stay close as a long-term partner: we update scenarios, support during audits, and help adapt to new markets and products.

When I launched COREDO in 2016, the main task was not simply to register companies abroad, but to build stable structures for clients that could withstand any tightening of regulation, updates to the FATF lists and revisions of banking policies. Over the years it has become clear: the FATF grey list is not an abstract “country risk”, but a factor that directly affects business bank accounts abroad, access to financing and even strategy for entering new markets.

FATF grey list: what it is and what it means for businesses

• high‑risk jurisdictions subject to a call for action, a de facto FATF black list (maximum restrictions, effective financial isolation);
• jurisdictions under increased monitoring, FATF grey list — countries under increased monitoring that formally cooperate with the FATF but have not yet brought their AML/CTF regime up to the required level.

When a country enters the FATF grey list, it is not a ban on business, but:

• banks and financial institutions strengthen their risk‑based approach to clients connected with that jurisdiction;
• the likelihood of de‑risking increases: a targeted refusal to serve higher‑risk clients;
• greater scrutiny of correspondent accounts, which affects cross‑border payments and transaction times.

How FATF grey list status affects corporate accounts

Changes to banks’ compliance requirements

• increase the company’s risk profile;
• move servicing to the enhanced Due Diligence (EDD) category;
• increase the frequency of file reviews (rechecking beneficiaries, sources of funds, structure).

• opening a company’s account in a high-risk country takes longer, requires more documentation and often separate approval by the compliance committee;
• servicing non-residents in EU banks becomes noticeably more difficult – especially if the structure includes companies from jurisdictions under increased FATF monitoring;
• a properly functioning account can be temporarily blocked until additional evidence of the economic rationale of the transactions is provided.

Blocking and closure of bank accounts

• targeted blocking of transactions, the bank requests explanations for a specific payment related to a counterparty from a high-risk AML country;
• temporary blocking of the account until completion of an internal investigation or EDD;
• planned de-risking, the bank notifies of the closure of the corporate account due to an update in its policy on dealing with clients from «grey» jurisdictions or connected to them.

FATF grey list and black list: risks for businesses

Registration of companies in the EU and Asia

How this affects company registration in the EU, Asia and other regions: no longer a theoretical question but a practical factor that directly influences the choice of jurisdiction, ownership structure and access to banking services. The tightening of sanctions and AML controls is changing the rules: requirements for beneficiary transparency, source of funds and genuine business activity are becoming key when registering companies in the EU, Asia and other regions.

Company registration in the EU and banking risks

When we assist clients with registering legal entities in the EU — in the Czech Republic, Slovakia, Cyprus, Estonia, the United Kingdom and other countries — one of the first topics discussed is the jurisdictional risk of beneficiaries and key counterparties.

• a bank in the EU may be relatively lenient toward a local company, but significantly stricter toward a group if the holding or part of the assets are located in a FATF grey list country;
• corporate accounts in countries on the FATF grey list often face difficulties with cross‑border payments to the EU due to correspondent‑bank level restrictions;
• company registration in Europe without a sound banking strategy is almost pointless: an account may open, but ongoing service will be unstable.

Asia and Africa: high-risk AML jurisdictions

• access to local banks;
• the ability to open accounts in the EU;
• the structure of cross‑border financing.

Consequences for banks of being placed on the FATF grey list

Immediate consequences for the organism

• review of limits and fees on existing accounts, increase in commissions, especially for international payments;
• increase in transaction processing times, especially to/from high‑risk AML countries;
• additional KYC/KYB requests for already serviced clients, document updates, confirmation of structure, disclosure of beneficiaries.

Medium-term consequences of de-risking and financial isolation

• reduce limits, restrict types of operations (for example, trade finance, complex cross‑border deals);
• refuse new clients linked to «grey» jurisdictions;
• initiate correspondent de‑risking: closing or restricting correspondent accounts with banks from those countries.

KYC and EDD for clients from grey jurisdictions

How banks strengthen KYC/EDD for clients from grey jurisdictions is primarily about moving to a stricter risk‑based approach: such clients are automatically assigned an elevated risk profile, and disclosure requirements become deeper and more detailed. As a result, the standard set of documents is no longer sufficient: banks expand the list of requests, enhance transaction monitoring and expect much greater transparency from clients regarding structure, beneficiaries and sources of funds.

What is most often required

• a detailed ownership structure listing all beneficial owners and controlling persons;
• confirmation of the source of funds and origin of capital (source of funds / source of wealth);
• documents for key counterparties, especially if they are from AML high‑risk jurisdictions;
• explanations of the business model and the economic rationale of transactions.

• board resolutions, corporate agreements, trust declarations;
• a legal opinion (legal opinion) on the AML risks of the structure;
• the company’s internal AML policies and procedures, including the appointment of an MLRO.

Requirements for beneficial ownership transparency

• banks’ near‑total rejection of complex, opaque structures lacking an obvious business purpose;
• a stricter approach to trusts, funds, and multi‑level SPV chains;
• attention to links with politically exposed persons (PEP).

Strategy for companies in countries on the FATF grey list

A strategy for groups with companies in countries on the FATF grey list requires more than one‑off measures “after the fact” — it needs a thoughtful approach to managing risks, reputation and access to international settlements. To avoid living in a constant “firefighting” mode, such groups need a systemic compliance strategy instead of a spontaneous reaction to ever‑new requests from banks and regulators.

Compliance strategy instead of reaction

• tracking updates to the FATF grey list and national lists of high‑risk countries;
• regular assessment of country and jurisdictional risk taking into account the group’s exposure;
• scenario analysis: what happens to banking relationships and financing if a specific client’s country/subsidiary is placed on the grey list.

When it makes sense to change jurisdiction

• if the cost of maintaining the entity (bank fees, compliance burden, transaction restrictions) grows faster than the economic rationale for staying in the current jurisdiction, relocation may have a positive ROI;
• if access to international financing and investors is critical (funds, SPV structures, investment projects), presence in grey jurisdictions seriously weakens the negotiating position;
• if the group targets EU banks and developed financial centres, maintaining a beneficial ownership link with a high‑risk country will continuously reduce banks’ risk appetite.

How to reduce the impact of the FATF grey list on business

I will gather in one place the practices that actually work for our clients.

Business structure and choice of jurisdictions

• Avoid concentrating key companies in FATF grey list countries, especially if you plan to work with EU banks or international financial institutions.
• Use holding companies and SPVs in low-AML-risk jurisdictions, keeping presence in ‘grey’ countries at the operational level and minimizing their role in the funding chain.
• When entering new markets (including Africa and parts of Asia), incorporate country risk into your model and include scenarios for changes in FATF status.

Internal AML/CTF system

• Implement formalized AML policies, KYC procedures/KYB and transaction monitoring: banks appreciate when a business “speaks the same language” as them.
• Appoint an AML/CTF officer (MLRO) and set up a regular training cycle for employees involved in international payments.
• Digitize processes – automated collection and updating of KYC documents, a log of counterparty checks, and sanctions risk monitoring.

How to work with banks and payment providers

• Don’t rely on a single banking partner: diversifying accounts across jurisdictions and types of institutions reduces the risk of sudden financial isolation.
• When choosing a bank, openly discuss the country and jurisdictional risk of your group; this will immediately reveal their appetite for clients with a presence on the FATF grey list.
• Consider alternative payment solutions, licensed fintech providers and payment institutions where correspondent banking is significantly limited.

How COREDO helps navigate high AML risk

• Registration of legal entities in the EU, Asia and the CIS taking into account AML risks and banks’ requirements, from choice of legal form to ownership structure.
• Obtaining financial licenses (crypto, forex, payment, other licenses in EU countries, the UK, Singapore, etc.) with a focus on AML compliance/CTF standards.
• AML consulting: development of an internal AML system/CTF, preparation for audits, support in interactions with banks and regulators.
• Comprehensive business support: Legal outsourcing, transaction support, preparation of Legal Opinion, structuring of holding and investment schemes.

If you see that:

• the country of registration of your company or a beneficiary is at risk of being placed on the FATF grey list;
• a bank has increased KYC/EDD requests or has notified of a review of the relationship;
• you are planning to register a company in the EU, Asia or another jurisdiction and want to take AML risks for international business into account already at the structuring stage,

When an entrepreneur today hears from a bank or regulator “please provide source of funds and source of wealth“, it’s no longer a formal checklist but a real filter: will your business be accepted into the international financial system, will you be able to open an account in Europe or Asia, will you close an M&A deal or raise investment.

As the founder of COREDO I see this every day: strong or weak handling of SOF/SOW directly affects deal speed, the risk of account freezes and, overall, whether your international project will operate sustainably or constantly ‘burn’ on compliance.

In this article I’ll cover:

• how source of funds differs from source of wealth in practice;
• how businesses can build AML compliance around SOF/SOW;
• which best practices we apply at COREDO when working in the EU, Singapore, Dubai, the Czech Republic, Slovakia, Cyprus, Estonia and other jurisdictions;
• real cases and typical mistakes that cause clients to lose time, deals and reputation.

Source of funds vs source of wealth: what’s the difference?

The definition is well known in theory, but problems arise in practice.

• Source of funds (SOF) is the specific money in a specific transaction.
  Where exactly the funds came from that you use to pay for a company, contribute capital to a European company, or transfer money to an investment platform.
• Source of wealth (SOW) is the history of the client’s wealth formation.
  How the beneficial owner (UBO) or an individual accumulated their wealth: through business, investments, inheritance, options, crypto assets, etc.

Banks, licensed financial companies, crypto providers, payment institutions, forex brokers, electronic money issuers are required within customer Due Diligence (CDD) and enhanced due diligence (EDD) to understand both SOF and SOW: especially in Europe and developed Asian jurisdictions.

In practice:

• for a single large transaction: emphasis on AML source of funds;
• when working with high-risk clients, UBOs, PEPs, large business owners: focus on AML source of wealth.

Why SOF and SOW Are Needed for Businesses and Regulators

Regulators in the EU, the United Kingdom, Singapore, Cyprus and other countries that the COREDO team works with view SOF/SOW through the lens of anti-money laundering / counter-terrorist financing (AML/CFT).

Objectives:

• prevent the use of the financial system for money laundering and terrorist financing;
• reduce sanctions risks and the risks of dealing with prohibited persons and entities;
• ensure tax and corporate transparency (CRS, FATCA, UBO registers).

For businesses this means:

• without a clear history of the origin of funds and origin of capital, delays, refusals to open accounts, blocks on high‑value transactions, difficulties with M&A and attracting investment;
• without established AML compliance for SOF/SOW, the risk of fines, reputational loss, de-risking (when banks and providers terminate relationships ‘just in case’).

SOF vs SOW: what’s the difference?

I answer simply: the regulator and the bank look not only at legality, but also at logic and proportionality.

• SOF – we demonstrate why these funds logically belong to you and why they are the ones involved in this transaction.
• SOW – we demonstrate why your level of wealth realistically corresponds to your business career and financial history.

The COREDO team often starts a project with financial due diligence of the beneficiaries:
analyzes the corporate structure, the beneficiaries, the economic rationale of transactions, tax history, public information, and the client companies’ financial statements.

Sources of Capital

Sources of origin of funds

Typical sources of a client’s funds:

• profit and turnover of an operating company (invoice‑based);
• dividends from business;
• sale of a stake (SPA/share purchase agreement);
• loan repayment (loan agreements);
• investment income (capital markets, funds);
• crypto income (after conversion to fiat through regulated providers);
• refinancing or lending (facility agreements, bank loans).

Documentary evidence of source of funds:

• contracts, invoices, acceptance certificates, specifications;
• bank statements confirming receipt;
• tax returns and company financial statements;
• deal documents (SPA, loan agreements, security documents).

Sources of Wealth (SOW)

Sources of the client’s wealth:

• long-term business profits;
• sale of a business/holding (exit, IPO);
• investment portfolio (stocks, bonds, funds, private equity);
• inheritance;
• employer stock options and shares (especially in IT and the digital sector);
• crypto-assets, early investments in projects, online business.

Documentary evidence of source of wealth:

• financial statements and audited company reports;
• share purchase agreements, valuation reports, closing documents;
• inheritance documents;
• reports from brokers and investment platforms;
• digital traces (work history in large IT companies, data about startups, public deals, media);
• socio-economic biography: career, positions, participation in governing bodies.

Risk-based approach: how deep the checks go

Regulation in the EU, the UK, Singapore and other countries requires a risk-based approach when vetting clients.
This means: the depth of customer due diligence and enhanced due diligence depends on:

• the client’s jurisdiction and that of its counterparties (high-risk jurisdictions);
• the industry (cash‑intensive business, gambling, crypto, financial services);
• the status (PEP, high-risk customers, UBO of a complex structure);
• the size and nature of transactions (high-value transactions, M&A, large tranches).

If the client:

• is the owner of a large holding company,
• has a multi-level structure,
• has cross-border transactions through several jurisdictions, they will almost certainly be subject to enhanced due diligence on source of wealth, not just on SOF.

Cases from COREDO practice

Source of funds when purchasing real estate in the EU

Task:
a corporate client is purchasing commercial real estate in an EU country. Price: high‑value transaction.

Problem:
the bank requested AML source of funds. The client provided only the purchase agreement and internal management reporting. The bank intensified its requests, and delays began.

Solution developed by COREDO:

• analyzed the company’s business model, its transaction flow vs economic origin of funds;
• structured the SOF/SOW documentation:
  • contracts with key buyers,
  • invoices,
  • bank statements for incoming payments,
  • tax filings,
  • a brief explanation of the economic logic (economic rationale of transactions);
• prepared an explanatory letter to the bank on behalf of the client, linking:
  • the company’s turnover,
  • margins,
  • accumulation of profits,
  • movement of funds prior to the purchase of the property.

Source of wealth of a fast-growing IT business owner

Task:
opening an account in a European bank for the holding company of an IT group owner with assets in several countries in Asia and the EU.

Problem:
the bank questioned the realism of the declared source of wealth:
over a relatively short period the entrepreneur showed a significant increase in net worth, some income came from the sale of stakes in startups and crypto assets.

Solution:

• collected digital traces as confirmation of source of wealth: participation in well-known IT projects, public transactions, mentions in the media, profiles on professional networks;
• documented the transaction history: SAFEs, convertible notes, SPA, valuation reports;
• for crypto assets – wallet exports, reports from verified crypto providers, KYC confirmations on exchanges;
• prepared a structured dossier on lifetime wealth analysis: how the client’s capital changed year by year, linked to specific events (project launches, share sales, investor exits).

Mistakes in verifying source of funds and wealth

Over the years the COREDO team has seen dozens of recurring mistakes.

For businesses and beneficiaries

• Confusion between SOF and SOW: the same documents are sent “for all occasions”, without focus on the specific transaction.
• Ignoring ownership structure: multi-level holdings, trusts and funds without clear UBO documentation.
• Mismatch between source of wealth and income/lifestyle level:
  lives like an UHNWI, but documents show average income.
• Attempt to “overwhelm” the bank with documents instead of a structured package:
  compliance officers care about logic, not the volume of paperwork.
• Underestimating cross-border specifics: different jurisdictions in the flow of funds, lack of explanation of tax / legal rationale.

client checks for fintech and banks

• Unclear internal company policy on collecting SOF/SOW data.
• Formal risk-based approach: clients are assessed by checkbox, without regard to the business model.
• Lack of automation of transaction monitoring and SOF/SOW checks where justified.
• Insufficient integration of KYC / KYB compliance processes, customer due diligence and ongoing due diligence.
• Poor recording of decisions: no one plans in advance how to document source of wealth check results for the regulator.

How to prepare for an SOF/SOW review

For the business owner / UBO

1. Your wealth map (SOW)
   – where the business originated,
   – what the key transactions were,
   – how capital changed year by year.
2. Document portfolio for primary sources
   – business (financial statements, audit, contracts, dividends);
   – sale of shares (agreements, valuation, closing documents);
   – inheritance (notarial documents);
   – investments (broker statements).
3. Readiness to explain “non-standard” cases
   – crypto assets;
   – online business;
   – rapid growth over a short period.
4. Consistency between lifestyle and SOW
   If your standard of living is clearly higher than the documented source of wealth, be prepared for additional questions.

For businesses that perform client checks themselves

1. Approve at the board level internal AML policies & procedures for SOF/SOW.
2. Set up a risk-based approach: who is subject to SDD, CDD, EDD; which triggers require enhanced due diligence.
3. Describe regulatory expectations for SOF/SOW in the jurisdictions where you operate (EU, Asia, CIS).
4. Define the data you collect at stages:
   • onboarding of high-risk clients;
   • ongoing monitoring;
   • for high-value transactions.
5. Decide what you do manually and where automation of processes for source of funds / source of wealth checks is appropriate (RegTech, screening, transaction monitoring).

Client at risk: discrepancies and indicators

• mismatch of source of funds with the client’s profile:
  for example, large payments from an industry unrelated to the declared business;
• discrepancy between source of wealth and income level:
  significant assets with minimal documented income;
• complex multi-level structures without economic rationale;
• frequent cross-border transactions without a clear business rationale;
• use of companies from high-risk jurisdictions without a logical explanation;
• sudden appearance of large amounts without a history of their formation (no lifetime wealth analysis);
• client’s unwillingness to disclose information about the UBO and their SOW.

Automation of SOF/SOW: manual work and RegTech

For financial companies, crypto platforms, payment providers and licensed entities in the EU and Asia the challenge is:
how to scale AML compliance without drowning in operational manual KYC.

The approach that the COREDO team applies in projects:

• digital onboarding and eKYC: collection of basic KYC/KYB‑data and initial information on SOF/SOW online;
• integration of screening and sanctions compliance (sanctions lists, PEP, adverse media);
• transaction monitoring tied to typical SOF‑scenarios:
  • operational revenue,
  • investment transfers,
  • loan repayments;
• risk triggers and alerts tailored to SOF/SOW:
  • a sharp increase in transaction volume;
  • changes in counterparties’ jurisdictions;
  • emergence of unusual sources of funds;
• KYC remediation: periodic updating of SOW data as part of ongoing due diligence.

At the same time, the key is the balance:

• what can be automated,
• where human judgement is essential,
• how to record in the system the decision taken and its justification to confidently pass a regulatory review.

How COREDO builds the SOF/SOW system

We often start with the basics:

1. Audit of the current AML framework for SOF/SOW.
2. Mapping risks by jurisdiction (EU, United Kingdom, Singapore, Cyprus, Estonia, Dubai, etc.).
3. Setting up governance: who is responsible for what (business, compliance, internal audit, MLRO), how the three lines of defence model works.
4. Training key employees to understand the difference between transaction flow and the actual source of funds, where the money really comes from.

• opening accounts,
• obtaining financial licenses,
• scaling into new jurisdictions,
• M&A deals and attracting investment.

And the fewer surprises owners and senior managers will face in the form of sudden compliance requests or freezes at a critical moment.

For the tenth year now I have been observing the same picture: when companies enter new jurisdictions they calculate taxes in detail but hardly consider regulatory risk and compliance risk. As a result some lose months negotiating with the regulator, others lose licenses and reputation. And a third come to us already in crisis mode: accounts are blocked, the license is under threat, the business model needs urgent restructuring.

In this article I will explain how I myself view regulatory arbitrage in international structures, how it differs from healthy regulatory optimisation, which strategies are permissible for transnational business and where the line is beyond which the risks of non-compliance with regulator requirements and enhanced supervision begin.

I rely on the practice of COREDO: registration of legal entities in Europe, Asia and the CIS, licensing of financial services, AML consulting and legal support for business in the EU, the United Kingdom, Singapore, Dubai, Cyprus, Estonia, the Czech Republic, Slovakia and other jurisdictions.

Regulatory arbitrage in simple terms

Simply put: when a group of companies chooses a country not only for taxes but also for where:

• it’s easier to obtain a license;
• capital requirements are more lenient;
• less stringent AML/KYC procedures;
• consumer protection or disclosure requirements are lower.

The line between optimisation and arbitrage

In practice I always divide clients’ approaches into three zones.

Lawful regulatory optimisation

Here the company:

• structures corporate organisation taking regulation into account but does not hide the actual business from supervision;
• chooses a jurisdiction where rules are clearer, procedures more transparent, and timelines more predictable;
• uses passporting regimes in the EU for cross-border financial services, but honestly complies with the requirements of the license’s home country;
• builds corporate compliance and AML compliance not at the minimum level but taking the group as a whole into account.

The grey zone of regulatory arbitrage

• a payment startup is licensed in a jurisdiction with light supervision but conducts its main activities effectively in a stricter country without obtaining a local license there;
• a group splits the business into affiliated MFIs (microfinance companies) to remain “below the thresholds” of prudential requirements;
• a crypto project formally places the parent company in one country and key operations and clients in another, hoping that “no one will notice”.

Aggressive high-risk regulatory arbitrage

This is when a company deliberately:

• masks the actual country of business and the centre of management;
• uses “thin” schemes with affiliated companies to circumvent capital and supervision requirements;
• moves high-risk operations to jurisdictions with minimal regulation, leaving only a front in the “white” part.

Regulatory supervision in the financial sector

The most common models I encounter:

• regulatory arbitrage in payment services: an e-money or payment institution license in a jurisdiction with laxer requirements and an actual focus on clients from stricter countries;
• regulatory arbitrage in cryptocurrencies: placing a crypto exchange or broker in countries with a more flexible virtual assets regulatory regime while serving a global audience;
• regulatory arbitrage in fintech: using the status ‘sandbox’ or experimental regimes for full commercial activity that goes beyond pilots;
• arbitrage between licenses bank vs MFI: moving high-risk retail lending to an MFI with more lenient capital and consumer protection requirements, while the brand and ecosystem are associated with a large player.

Regulators in the EU and Asia increasingly respond to this through:

• risk-oriented supervision and consolidated group-level review;
• the principle “same business – same risks – same rules” for banks, fintech and ecosystems;
• tightening rules for retail investors and users of high-risk instruments (CFDs, binary options, margin trading).

Why regulatory shopping is dangerous

In tax planning, companies are used to

and work with long-term rules of the game. In regulating finance and technology, the situation is different:

• regulatory risk often materializes abruptly: today a business model is legal, tomorrow a circular or guideline is issued, and part of the operations end up in the ‘red zone’;
• regulatory arbitrage and reputational risks are directly linked: investors and banks increasingly evaluate whether growth is being built on exploiting ‘grey zones’;
• risks of non-compliance with regulatory requirements manifest not only in fines, but also in restrictions on working with non-residents, limits on transactions, and account freezes.

Choosing a jurisdiction: taxes and the banking system

• What cross-border financial services do you plan to provide?
• Do you need a financial license – payment, investment, crypto, forex?
• Where will the clients and the key team actually be located?
• What are your compliance risks (sanctions, AML, industry-specific restrictions)?

Then a systemic jurisdictional analysis kicks in. Our experience at COREDO has shown that sustainable models are born not from the ‘easiest’ jurisdiction, but from a combination of:

• predictable regulation of business in the EU or in Asia;
• adequate regulatory burden;
• the presence of clear licensing and supervision procedures;
• availability of bank accounts and payment infrastructure.

Regulatory arbitrage: COREDO cases

I’ll change the details but keep the essence of the models.

# Case 1. A payments startup between the EU and Asia

Task: launch a payment service for e-commerce with clients in the EU and Asia, minimize time to market and regulatory risks.

What the market proposed: find a ‘soft’ jurisdiction in the EU, obtain a payment license there and serve all of Europe and part of the Asian clients through it via passporting.

What the COREDO team did:

• conducted an assessment of regulatory risks for the business taking into account scaling plans and the client segment;
• set up a separate licensed company in the EU and another in Asia, where payment services regulation was more flexible but with clear AML requirements;
• developed a compliance strategy for the transnational business: unified KYC/CDD standards across the group, regardless of the minimum requirements of individual countries;
• planned in advance for scenarios of regulatory tightening and potential restrictions on passporting in the EU.

# Case 2. A crypto project and a light license

Task: obtain a crypto license in a jurisdiction with minimal time and capital costs in order to serve clients globally.

Actual model: the majority of clients were from EU countries and the UK, marketing and key executives were also there, but the license was planned in a third jurisdiction with lighter supervision of crypto-service providers.

AML compliance: common company mistakes

At the group level, owners sometimes try to exploit differences in AML/CFT requirements between countries:

• set looser limits and checks in jurisdictions with low regulatory burden;
• build a customer-facing front office in one country and risk functions in another where regulations are looser;
• apply different KYC standards/CDD procedures depending on the client’s jurisdiction of registration rather than on their actual risk.

Sanctions risks and regulatory arbitrage

For owners of international holdings, the issue of sanctions has become one of the key drivers of structural changes. Somewho are trying to use regulatory arbitrage within the structure of international holdings to:

• transferring assets to jurisdictions with a softer or different sanctions regime;
• structuring affiliated chains of ownership and control to reduce the likelihood of directly falling under restrictions.

• many sanctions regimes are applied extraterritorially;
• banks and financial institutions often apply standards stricter than formal requirements;
• regulatory arbitrage and sanctions against beneficiaries ultimately lead to access to banking services becoming significantly more expensive or altogether impossible.

Regulatory arbitrage: how to build it into strategy

Map of jurisdictions and licenses

• which licenses already exist;
• where the actual business is conducted;
• where clients, teams, and infrastructure (including data) are located.

Regulatory risk assessment by scenarios

• risk of tightening regulation in key jurisdictions;
• risk of retroactive application of certain rules;
• risk of consolidated supervision over the group.

Classification of arbitrage decisions

• decisions in «green zone» (lawful optimization);
• decisions in «yellow zone» (depends on the regulator’s stance);
• decisions in «red zone» (high risk of claims and loss of licenses).

Compliance strategy and risk appetite

• what level of regulatory arbitrage the business is willing to tolerate;
• what processes and policies are implemented for control;
• what metrics are used (for example, share of transactions in jurisdictions with elevated regulatory risk, number of regulator inquiries, compliance cost as part of expenses).

Restructuring and exit plan from risky models

• conditions under which the group abandons certain arbitrage decisions (regulatory shock, changes in FATF, Basel, IOSCO standards);
• steps for transferring licenses, changing data routes, reallocating business functions.

When it’s more advantageous to strengthen compliance than to change jurisdiction

• strong corporate compliance;
• transparent ownership structures;
• high-quality AML and sanctions control;

What can be done now

If you already manage an international structure or plan to scale, I recommend at least:

• carry out a jurisdictional analysis and a license audit from the perspective of regulatory risk (not just taxes);
• check whether there is hidden cross-border regulatory arbitrage between the group’s legal entities;
• assess how uniform your AML compliance standards are across the group, rather than being tailored to the «most lenient» country;
• prepare for dialogue with regulators: have a legally and economically justified explanation for why functions, licenses, and operations are allocated the way they are.

The COREDO team regularly supports clients at all these stages: from registering legal entities abroad and choosing a jurisdiction for a holding structure to licensing financial services and building a resilient international compliance system.

When an entrepreneur first comes to me with the idea of entering the payments services market in Europe, the same question usually reads in their eyes: “Where do you even start?” Regulation of payment institutions in the EU is not a single law or a single regulator, but a whole architecture of directives, national acts, supervisory practices and technical standards. And it is precisely how competent the first step is that determines whether a payment institution license will be your asset or a constant source of stress and constraints.

I have been developing COREDO since 2016 as a company that combines legal, regulatory and business vision in a single project. During this time the COREDO team has participated in the launch and scaling of dozens of fintech projects in the EU, the UK and Asia — from small payment institutions with a niche product to holdings combining the status of a payment institution and an e‑money institution in multiple jurisdictions.

In this article I will explain how regulation of payment institutions works in practice in the EU, what to look for when choosing a country, what the differences are between a payment institution license and an e‑money license, and what requirements for AML, governance and IT infrastructure need to be built into the model from day one. I will speak as a practitioner who is responsible not only for legal compliance but also for the profitability of such projects.

Regulation of payments: PSD2 and e‑money

1. EU Directive 2015/2366 (PSD2) – a framework document that sets out the general requirements for payment services in the EU: list of services, Licensing of payment institutions, third‑party access to accounts (open banking, XS2A), strong customer authentication and basic consumer protection requirements.
2. Directive 2009/110/EC (electronic money): defines the status of an electronic money institution (EMI), requirements for the issuance and circulation of electronic money, safeguarding of client funds and the minimum share capital for e‑money institutions.
3. National legislation of EU countries: each country implements PSD2 and Directive 2009/110/EC into its own laws, adding national specifics: requirements for substance, for the office, for top management, the level of IT security, reporting, etc.

The COREDO team constantly works at the intersection of these levels: we start with an analysis of the client’s business model under PSD2 and Directive 2009/110/EC, and then adapt it to a specific jurisdiction: Lithuania, Estonia, Ireland, Cyprus, Luxembourg or other EU countries.

Payment institution and e-money institution: difference

One of the first questions clients ask me is: “Do we need a payment institution license in Europe or immediately an electronic money license?”
Main difference

• Payment institution (PI) – grants the right to provide payment services listed in PSD2: acquiring, money remittance, execution of payment transactions, issuing of payment instruments, PISP/AISP, etc.
• Electronic money institution (EMI): additionally grants the right to issue electronic money and to hold clients’ funds in the form of an electronic balance (wallets, prepaid cards, stored-value services).

• the minimum share capital for a payment institution is lower than for an e‑money institution, especially if we are talking about a “small payment institution” or a limited license;
• EMIs have stricter requirements for safeguarding, prudential supervision, reporting and risk management.

Which PSD2 services require a license?

To avoid mistakes with the license, it’s important to honestly ask yourself: which specific operations do you want to perform?

• execution of payment transactions (including SEPA payments and cross-border payment services in the EU);
• issuing of payment instruments (cards, virtual cards, other instruments);
• acquiring of payment transactions (merchant acquiring, including online acquiring and payment gateways);
• money remittance (classic transfers without an account);
• services enabling cash to be placed on or withdrawn from a payment account;
• PISP and AISP (open banking).

Minimum statutory capital and supervision

For any payment institution and e‑money institution in the EU, it is critical to correctly assess capital requirements and the potential increase in supervisory burden as the business scales.
Capital: what is it?

In COREDO projects we always model a 3–5 year scenario: how growth in transaction volume will affect own funds requirements and, accordingly, the financial model. This helps avoid a situation where the business scales faster than the shareholders are willing to recapitalize the company.

Prudential supervision in the banking sector

Prudential supervision of payment institutions in the EU is built on a risk‑oriented approach. Regulators look not only at capital adequacy, but also at:

• risk management (operational, liquidity, compliance risk);
• internal control system;
• procedures for safeguarding client funds;
• IT and cyber risks.

Choosing an EU jurisdiction: strategy, not price

The COREDO team usually advises entrepreneurs to look at country choice from several angles:

1. Regulator: speed of communication, transparency of processes, willingness to innovate (regulatory sandboxes for fintech, attitude to new models, including paytech and embedded finance).
2. Requirements for substance:
   • requirement for a physical office;
   • local staff (board, MLRO, risk, compliance);
   • the depth of presence the regulator requires to recognize the company as genuinely managed from that country.
3. Requirements for safeguarding clients’ funds:
   • which banks/institutions accept funds;
   • whether insurance can be used;
   • specifics of account segregation and their oversight.
4. Reporting and supervisory burden: report frequency, complexity of forms, intensity of inspections.
5. Tolerance toward non-residents and cross-border models: an important factor for projects targeting clients from the CIS, Asia, Africa.

Single European passport for licensing

One of the EU’s key advantages: a single European passport for payment institutions and e‑money institutions.

• provide cross-border payment services in the EU without a separate license in each country;
• open a branch in other EU countries;
• build a network of agents and distribution across the territory.

• local consumer legislation;
• KYC/AML specifics for residents of different countries;
• local rules for marketing financial services;
• requirements for the language of documentation and customer support.

AML requirements for EU payment institutions

Any regulator in Europe today views AML/CFT as a key criterion for payment institutions and electronic money. If your anti‑money‑laundering procedures look formal, your chances of licensing success approach zero.

COREDO was originally formed as a team where AML‑consulting and Legal expertise in financial law work together. This has allowed us to build a practice in which we design the client’s AML model in parallel with the choice of jurisdiction and license, rather than after the fact.

• ownership structure and beneficiary requirements: transparency, no sanctions‑related risks, verification of source of funds;
• the appointment and actual status of the AML officer (MLRO): experience, independence, engagement;
• risk‑based approach: segmentation of clients by risk, enhanced Due Diligence where necessary;
• policies and procedures: customer due diligence, ongoing monitoring, transaction monitoring, sanctions screening, PEP policies;
• use of regtech solutions, but with the understanding that automation does not replace the responsibility of management bodies.

Governance: three lines of defence

In the work of the COREDO team we adhere to the concept of three lines of defence:

1. First line: the business units that create the product and interact with customers. They are responsible for compliance with procedures at the operational level.
2. Second line: the compliance and risk management functions that develop policies, monitor compliance, and analyse new risks (for example, when launching a new product or entering a new country).
3. Third line – internal audit, an independent assessment of the effectiveness of the entire system.

Regulators in many EU countries explicitly expect that, within the structure of a payment institution, the following will be visible:

• an independent compliance officer;
• a risk manager with an understanding of financial and operational risks;
• a plan and scope of internal audit (even if some functions are outsourced).

IT infrastructure and cybersecurity: PSD2 and SCA

For a fintech company, the IT platform is not only a product but also a regulated entity. Requirements for the IT infrastructure and cybersecurity of payment institutions in the EU include:

• compliance with PSD2 requirements for strong customer authentication (SCA);
• data protection in accordance with GDPR;
• resilience, redundancy, incident recovery plans;
• access control, operations logging, vulnerability management.

• API architecture (especially in the context of open banking);
• change management processes;
• outsourcing of critical IT functions and relationships with external providers.

The COREDO team is accustomed to involving IT architects and cybersecurity specialists already at the licensing preparation stage. This allows responding to regulator questions in advance, rather than reworking the platform at the last minute.

Outsourcing and agents: where is the line of what’s allowed

• critical functions (risk management, AML, key IT systems) cannot be completely ‘outsourced’ without losing control;
• necessary agreements, SLAs, monitoring mechanisms, and the regulator’s rights of access to information;
• the regulator assesses the payment institution’s ability to manage a network of agents and partners.

Common mistakes applicants make and how to avoid them

Over the years I have seen several recurring mistakes that significantly prolong or even block obtaining a payment license in the European Union:

1. Unclear business model: vague descriptions of services, inconsistencies between the product side and the legal part.
   • How we solve it at COREDO: we start with a product workshop, form a clear model, and then write the application pack to fit it.
2. Underestimating substance requirements: attempting to build a “virtual office” where the regulator expects a real presence.
   • We immediately explain what minimum office and key functions will be required in that specific country.
3. A formal approach to AML: copying template policies without taking into account the geography of clients and real risks.
   • The COREDO team adapts the AML model to the specific client base (including clients from the CIS and Asia, where risks are higher).
4. Weak management team: nominal directors without real experience in payments, risk, and finance.
   • In a number of cases we helped clients build a governance structure and select strong managers who satisfy the regulator.
5. Lack of a scaling model: the applicant does not show how they will manage risks as transactions grow, enter new countries, or launch new products.
   • COREDO’s practice confirms that having a scaling roadmap significantly increases the regulator’s confidence.

Strategic approach to a project: practical recommendations

If you are: a founder, chief financial officer, or head of a fintech division and are considering registering a fintech company in Europe under a payment license, I would recommend structuring the work in stages.

1. First: business model, then: jurisdiction.
   • Do not choose a country based on “where it’s easiest” or “where acquaintances have already obtained a license”. First describe the product: what payment services, which markets, which customers, how you monetize. The COREDO team often begins cooperation precisely with a product-/business-workshop.
2. Do an honest AML and risk self-assessment.
   • If you see clients from high-risk regions in your model, complex cross-border chains, work with crypto-assets or embedded finance, do not try to “hide” this from the regulator. Together with COREDO’s clients we develop realistic control measures that can be defended before the supervisory authority.
3. Model the ROI of your own license vs operating through a partner.
   • Having your own license: it’s not just freedom and margin, but also ongoing expenses for compliance, risk, reporting, IT security, and audit. Sometimes at the start it’s more sensible to build a hybrid model: operate through a partner while simultaneously preparing for licensing. Our experience at COREDO has shown that such strategic flexibility often yields a better result.
4. Plan passporting from day one.
   • If you target clients across the EU, it’s logical to think in advance about which countries will be key, which specifics need to be considered (language, local consumer law, taxes), and to embed this into the contract architecture, IT systems and compliance processes.
5. Don’t postpone organizational design.
   • The governance structure, allocation of compliance, risk management and internal audit functions are not a formality for the regulator, but the real resilience profile of the company. The sooner you establish it, the easier it will be to obtain a license and deal with subsequent supervision.

If you plan to create or scale a payment institution or e-money institution in the EU, the COREDO team truly has a lot to offer: from choosing a jurisdiction and license architecture to the operational setup of AML, governance and IT frameworks. And the earlier you involve experts, the more decisions you’ll be able to make from a position of strength, rather than under the pressure of deadlines and regulatory requirements.

MiCA: EMT or ART for stablecoins

MiCA divides stablecoins into two basic classes:

• e‑money tokens (EMT): essentially tokenized electronic money, 1:1 pegged to a single fiat currency, most often the euro.
• asset‑referenced tokens (ART) – tokens pegged to a basket of currencies and/or other assets (for example, a multi-currency stablecoin or a token backed by a mix of fiat+bonds+gold).

When it makes more sense to use EMT

For projects that target stablecoin use cases in payments, e‑commerce, B2B settlements and corporate treasuries, EMT most often becomes the default model.

When ART provides more flexibility

MiCA and algorithmic tokens: what’s prohibited

Stablecoin reserves under MiCA: architecture and audit

• obtain Licensing and regulatory supervision;
• withstand stress scenarios (withdrawal of 30–40% of assets over a short period);
• maintain acceptable project economics.

1. MiCA stablecoins with high-quality reserves will have a competitive advantage over ‘grey-zone’ tokens that European CASPs will sooner or later limit access to.
2. Large corporate users and financial institutions will look specifically at:

   • the reserve structure,
   • liquidity management procedures,
   • independent audit.

Redemption rights under MiCA: holder rights and issuer economics

MiCA enshrines a key principle: a stablecoin holder has the right to redeem the token for fiat (or the underlying asset) at par, within a reasonable time frame and on clear terms.

CASP, MiCA and passporting in the EU

Any issuer or platform working with stablecoins in Europe encounters the concept of crypto‑asset service providers (CASP).

Key idea: by obtaining a CASP license in one EU jurisdiction, you gain passporting for services across the Union. This significantly increases the value of choosing the right country for registration and licensing.

AML/KYC and the Travel Rule: practical compliance

DAC8 and reporting on stablecoins

MiCA and liquidity management

• whether MiCA-compliant regulated stablecoins can be used for daily settlements with counterparties in the EU;
• how stablecoins affect liquidity management and treasury strategies;
• what to choose for international settlements: CBDC, stablecoins, or traditional bank payments.

MiCA and regulation in Singapore, Hong Kong, the UK and the US

• stablecoin regulation in Singapore – a balanced regime with an emphasis on payments and enterprise solutions;
• stablecoin regulation in Hong Kong and the emerging Hong Kong stablecoin licensing regime;
• the UK’s approach, where stablecoins fall within the perimeter of financial regulation but with its own specifics;
• the debate in the US around GENIUS Act stablecoins and competing bills.

• reserves and transparency;
• consumer protection;
• systemic stablecoins and oversight by central authorities.

How we structure stablecoin projects at COREDO

What an entrepreneur and a CFO should take into account

• Design the stablecoin from the start for MiCA, even if the initial launch focuses on another region. Reworking the architecture afterwards in Europe is costly.
• Treat reserves and MiCA compliance as part of the unit economics, not just a regulatory burden: access to European platforms and large corporate clients depends on it.
• Embed AML and DAC8 readiness from the outset: many business models collapse not because of the token idea, but because of inadequate compliance and reporting.
• See MiCA as an opportunity for differentiation: regulated stablecoins with transparent reserves and a clear legal framework will outperform “grey” alternatives, especially in the B2B and enterprise segments.

In international groups the question of a KYC policy today sounds very direct: a single standard or local adaptation? As someone who has been developing COREDO since 2016 and sees live cases from the EU, Asia and the CIS every day, I will confidently answer: formally, a single framework is needed; practically — without thoughtful local adaptation the business simply will not survive.

Why the old KYC approach does not work

• payment systems,
• correspondent accounts,
• licenses (crypto, EMI, PI, forex, investment),
• marketplace ecosystems and fintech partners.

• Each jurisdiction requires it “a little differently”: forms, timeframes, documents, EDD levels.
• Payment partners and banks practice over-compliance: they check every client and every transaction, block accounts, and require KYC updates “more often than is written in the law.”
• Scaling into 5–10+ countries turns into chaos: different procedures, different IT systems, different interpretations of AML risks in subsidiaries.

Group-wide KYC standard: components and requirements

• Risk appetite and client typologies
  • retail, SME, corporate, financial institutions;
  • high-risk segments: CBI clients (investment migration), crypto brokers, PSPs, P2P platforms.
  • logic: whom you are willing to serve at all, and whom: not in any country.
• KYC classification and verification levels
  • standard verification,
  • enhanced due diligence (EDD),
  • enhanced checks for PEPs, sanctioned and CBI clients.
  Uniformity is important here: if EDD for a corporate client in one subsidiary includes an analysis of the origin of capital over 3 years, and in another: only a declaration, the global risk profile is distorted.
• Basic 15-step KYC process for legal entities
  At COREDO we often build a multistep process where, regardless of the country, the following mandatory steps are present:
  • company identification (registration documents, articles of association);
  • identification of beneficial owners and the control structure;
  • verification of directors and key controlling persons;
  • analysis of discrepancies between passports and tax residency;
  • proof of address;
  • checks against sanctions, PEPs, negative media;
  • verification of source of funds and sources of income;
  • assessment of the business model and transaction geography;
  • assigning a risk rating;
  • decision: onboard / reject / EDD / additional requests.
• KYT policy and transaction monitoring
  • rules for real-time monitoring of suspicious transactions;
  • trigger logic by countries and counterparties;
  • approach to blocking/holding transactions and requesting documents.
• Requirements for digital compliance and cybersecurity
  • use of digital identification systems and eIDAS (for the EU);
  • requirements for storing KYC files and activity logs;
  • basic cybersecurity standards: client data protection, access control, logging of verifications.
• Role of an independent compliance officer
  • uniform qualification requirements;
  • independent reporting to the Board of Directors;
  • veto power over risky onboardings.

Where local adaptation of KYC is mandatory
Even a perfectly built global standard does not negate the fact that EU KYC requirements, fintech regulation in Asia and the practices of CIS regulators differ.

I see three levels where local adaptation is not just desirable, but critical.

Requirements and timelines

• In a number of EU countries regulators are moving from “simplified verification” to a strict model of full KYC checks for almost all categories of clients.
• Verification timeframes are shortening: what used to take up to 10 days is now expected to be completed within 2–5 days: especially in fintech, so the client does not go to a competitor.
• For payment companies and crypto licenses, local regulators (for example, in Lithuania, Estonia, Cyprus) set separate requirements for the structure of AML/KYC policies, the content of reporting and data formats.

• EU directives, PSD2, eIDAS for payment and fintech companies;
• requirements of local Asian supervisory authorities, aligned with FATF Guidance;
• requirements for machine-readable AML reporting and online monitoring by regulators.

Substance and real presence requirements

• a real office and staff,
• local directors,
• risk management and on-site compliance,
• the volume of operations in the jurisdiction.

• reallocation of functions (risk, AML, IT) between countries;
• justification of why KYC functions are centralized or, conversely, localized;
• the argument for substance in the exact country where you want to obtain a license or a bank account.

Practice of banks and payment partners

• unclear beneficiary structure;
• mismatch between passports and tax residency;
• lack of transparent evidence of source of funds;
• weak group-level KYC policy and absence of local procedures.

KYC vs KYT and the Travel Rule: what’s changed

• implementation of the FATF Travel Rule: transmission of sender and recipient data between VASPs (Virtual Asset Service Providers) and payment institutions;
• real-time monitoring of sender and recipient against sanctions and risk lists;
• use of blockchain analyzers to assess the risk of addresses and transactions.

• restructure internal policy from “one-time KYC at onboarding” to continuous KYT monitoring;
• implement regulatory synchronization between countries: so that transactions passing through the EU and Asia comply with unified rules on data and reporting;
• prepare for online transaction monitoring by regulators and mandatory data exchange between countries.

KYC for corporate clients: structure

• Basic KYC (all jurisdictions)
  • standard set of company and beneficiary documents;
  • minimal screening for adverse factors;
  • initial risk scoring.
• Enhanced KYC / EDD
  • detailed analysis of structure and ultimate control;
  • in-depth verification of source of funds (bank statements, contracts, financial statements);
  • check of corporate history, M&A deals, changes of beneficiaries;
  • monitoring of PEP status and political risks.
• Special scenarios (CBI, high-risk clients)
  For CBI clients and investment migration, international banks and regulators treat them as high risk.
  • prepare a rationale for the client’s economic substance;
  • demonstrate the consistency of passport, residency, and actual center of interests;
  • document the veracity of the source of funds and the reasons for structuring assets through a particular jurisdiction.

Do KYC automation and digital compliance pay off?

• Reduction of onboarding times from 10 to 2–5 days for corporate clients thanks to digital identification systems and automated checklists.
• Reduced burden on compliance departments: some procedures move to automatic screening and machine-readable reporting for regulators.
• Increased trust from banks and partners: mature digital compliance and cybersecurity are already mandatory criteria when selecting partners.

• implementation of digital identification systems and integration with eIDAS for the EU;
• use of solutions for machine-readable AML reporting and automatic report generation;
• implementation of modules for real-time transaction monitoring and sanctions screening;
• building the internal architecture of embedded AML/KYC procedures into an IT or fintech company’s product.

How to avoid bank account freezes

• there is a single group KYC/AML standard, understandable to banks and PSPs;
• local procedures meet the expectations of the regulators of the specific countries;
• the company establishes KYT and Travel Rule processes in advance according to international requirements;
• a set of evidence of source of funds and justification of the group structure is prepared.

• analyzes exactly where the KYC processes did not satisfy the partner;
• refines the KYC policy and client dossiers;
• builds communication with the bank or payment institution, explaining the business model and compliance framework.

Single standard and local adaptation

For an international group it is not enough to “just adapt to the law”. A strategic KYC framework is needed that withstands scrutiny from regulators, banks and partners simultaneously in the EU, Asia and the CIS.

• Define global risk appetite and target markets
  Answer honestly: which clients you are willing to serve and in which jurisdictions this is permissible.
• Build a single group KYC/AML standard
  • policy structure,
  • KYC/KYT processes,
  • requirements for EDD and CBI,
  • digital perimeter and cybersecurity.
• Make local adaptation by country
  • take into account EU requirements, national laws, PSD2, eIDAS, FATF guidance;
  • embed substance and local regulatory expectations;
  • synchronize reporting and data formats.
• Integrate KYC/AML into the product and operations
  especially for fintech, payment companies, crypto services; ensure real-time monitoring and automation of key procedures.
• Regularly review the policy to meet new requirements
  • FATF and the EU update standards,
  • Asian regulators are increasingly aligning with them,
  • by 2026 the list of mandatory KYC and KYT elements will only growwiden.

When the founder of a fintech project comes to me with the question: “In which country is it best to obtain an EMI license and how can this be done without fatal mistakes?”, I always start not with the country, but with the business model. It is the business model that determines where you can operate sustainably, with understandable regulatory risks and a predictable ROI.

Over years of COREDO‘s work in Europe, Asia and the CIS, the team has taken clients through the entire journey: from the first idea “I want my own EMI license in the EU” to functioning payment institutions with passporting across the EEA, audits to international standards and a well-thought-out AML function. In this article I will distill that experience into a practical guide: how to choose a jurisdiction, which requirements are actually painful in practice, where the boundaries of regulatory risk appetite lie and how to reduce the likelihood of rejection at launch.

EMI license in the EU: what you need to know

EMI license in Europe: this is permission to operate as an issuer of electronic money and to provide payment services based on the PSD2 and EMD2 directives. Essentially, an EMI license in the EU allows you to:

• issue electronic money (wallet balances, prepaid solutions, stored value);
• open and maintain payment accounts for clients;
• provide payment and electronic money services for B2B and B2C models;
• build white‑label solutions for partners and scale a fintech platform across the EEA via passporting of the EMI license.

In any European country, the regulator looks at an EMI provider through three key areas:

• business model and resilience (business plan, profitability, risk management);
• compliance for the EMI provider (AML/KYC, governance, fit & proper management);
• IT and operational infrastructure (security, incident management, safeguarding of funds).

My practical advice: don’t treat an EMI as a ‘checkbox’ or a shiny status. It’s an infrastructure solution for business for the next 5–10 years. If you don’t expect to operate at least on that horizon, the partner-provider model might be more appropriate for now.

Full EMI license or small EMI/PI: where to start?

Many projects come with a strict request: “we need only a full EMI license.” In practice, it makes sense to consider three options:

• full EMI license
  Suitable if you plan to scale across the entire EEA, process significant volumes and work with different segments (B2B/B2C, cross‑border payments, wallets, cards, API integrations for open banking).
• small EMI license (restricted Electronic Money Issuer License)
  This is a compromise: local or volume‑limited operations, simplified requirements, but without passporting across the EEA. In some countries it is used as a “training ground”: to prove to the regulator, investors and yourself that the model works.
• PI (payment institution)
  PI license in the EU allows providing payment services without the status of an electronic money issuer. For some models — money remittance, acquiring or certain B2B solutions — a PI can be sufficient.

I strongly do not recommend choosing between EMI and PI “based on a feeling.” At COREDO we always start by analysing use cases: which products you offer, to whom, in which countries, what limits, where the client balance arises, how you earn money, and what the structure of fees and float is.

How to choose a country for an EMI license

The phrase “which country is best to obtain an EMI license” is incorrect by itself. More accurate is “which jurisdiction is optimal for my business model, risk profile and scaling strategy.”

I always recommend entrepreneurs look at a country through five areas:

1. regulatory risks of an EMI and the regulator’s risk appetite
   • How does the regulator respond to new business models?
   • How often do the rules change?
   • What is the supervisory practice (frequency of inspections, tone of communication, predictability of decisions)?
2. Minimum capital for an EMI and capitalization requirements
   • Initial capital: typically €350,000 for a classic EMI model in the EU.
   • Ongoing capital adequacy: methodology for calculating capital against transaction volumes and risks.
   • You need not only a formal amount but a deliberate model: where you will hold the capital, how to present it under IFRS, how the capital structure will change as you grow.
3. Substance requirements for an EMI (office, staff)
   • Real business presence: local office, employees, resident directors.
   • Role of the local team: who actually makes decisions, who is responsible for compliance, risk management, IT.
4. IT requirements for an EMI license
   • compliance with requirements for ICT and security risk management;
   • architecture, redundancy, disaster recovery plan;
   • management of cyber and operational risks of an EMI, working with outsourcing and cloud providers.
5. Tax aspects and the group’s overall structure
   • compatibility of the country with your flows (B2B, B2C, cross‑border payments);
   • double taxation treaties;
   • the jurisdiction’s impact on investors’ valuation of the project and future funding rounds.

COREDO’s task in such projects is not simply to “register” but to help build a structure that will withstand scrutiny from the regulator, the auditor and investors simultaneously.

Jurisdictions for an EMI license: where and for whom

Below: not a “country ranking”, but typical scenarios that I see in projects coming to COREDO.

EMI license in Lithuania

Lithuania has long become a magnet for fintech projects oriented to the EEA. For many international players, an EMI license in Lithuania is a practical way to enter the European market with predictable timelines and transparent requirements.

When this country makes sense:

• EMI license passporting across the EEA is critical for you;
• you are building a product focused on the EU, but the team is distributed across different countries;
• you are ready for serious work on IT and risk management: the regulator pays close attention to ICT, operational risks and safeguarding.

In practice, the COREDO team pays especially close attention to Lithuanian projects regarding:

• the three‑year business plan and stress‑testing of the model;
• IT architecture: redundancy, incident monitoring, logging, change management;
• AML/KYC model: how the risk‑based approach is reflected in procedures and IT systems.

EMI licence in Ireland

An EMI license in Ireland is most often considered by more mature projects and groups that are building a European hub.

Key features:

• high requirements from the Central Bank of Ireland for the governance structure, fit & proper management, and independent control functions;
• a strong focus on compliance for the EMI provider: AML, risk management, internal audit;
• increased attention to business model sustainability and long‑term viability.

I often see teams underestimating the cost of compliance in Ireland: this includes not only in‑house specialists, but also external consultants, auditors, and the schedule of regular checks. The reward for this is a high level of market and investor trust.

EMI license in the Czech Republic

Czechia appeals to those looking for a balance between operating costs, the level of regulatory oversight, and the ability to work with clients from different European countries.

Features:

• a straightforward infrastructure for company registration and establishing substance;
• reasonable requirements for local presence and governance;
• the possibility to combine an EMI license with operational activity in Central Europe.

Client case: the COREDO team supported a project that considered EMI in Lithuania versus EMI in Czechia. In the end the strategy split: Lithuania — for scaling a B2C product across the EEA; Czechia — for the operational back‑office, development and part of the B2B direction. This is a scenario when one country for an EMI license is not the only answer.

EMI license in the UK: FCA requirements

An EMI license in the UK is the choice of those who consciously accept a high level of regulatory supervision by the FCA, expecting in return a strong brand and access to the British ecosystem.

What is important to consider:

• the FCA’s requirements for governance, risk management, and transparency of the beneficiary structure are especially detailed;
• a lot of attention is paid to outsourcing and service providers for EMIs, including cloud solutions;
• requirements for cybersecurity, incident reporting and IT resilience are being strengthened.

For an international project focused on Europe and Asia, it makes sense to consider the UK as part of a broader structure rather than the sole entry point.

Mauritius: EMI license for an offshore setup

An EMI license in Mauritius raises many questions among entrepreneurs: «how reliable is it to build an international fintech business based on such a license?»

I’ve seen successful cases where Mauritius:

• was used as a hub for international settlements outside the EEA;
• was combined with a European structure (for example, Lithuania / Ireland) to serve clients in the EU;
• allowed optimizing tax burden and group structure while meeting substance requirements.

Problems of the original headline:

• Unnecessary jargon (‘Typical’, ‘bottlenecks’)
• Sounds like an academic paper, not a search query
• Contains 9 words, which exceeds the recommendation

Bottlenecks in EMI licensing

To reduce the risk of refusal to grant an EMI license, I always ask clients to honestly assess three areas before approaching the regulator.

Ownership structure and beneficiaries

The regulator pays close attention to:

• transparency of beneficial ownership;
• sources of funds (source of funds / source of wealth);
• the history and reputation of shareholders and directors (fit and proper test).

Complex multi-level structures without a clear economic rationale increase EMI regulatory risks in any country. At COREDO we often start with “clean-up” of the structure: removing unnecessary layers, putting corporate documents in order, and preparing justification for the ownership chain.

Business plan and revenue model

For the regulator it’s important not only to see a three-year financial plan, but also to understand:

• how you earn (subscription, commission, interchange income, FX margin, B2B fee);
• how you manage regulatory risk (for example, high-risk segments, cross-border payments);
• what will happen to the company under stress scenarios: loss of a key partner, an increase in chargebacks, regulatory changes.

The COREDO team practices stress-testing business models for an EMI license: we model several scenarios and see how capital, liquidity and compliance costs change.

AML/KYC and a risk-based approach

AML/KYC procedures for an EMI provider are where regulators most often raise additional questions. Typical issues:

• declarative policies without a description of the real process;
• lack of linkage between the client risk map and triggers in the IT system;
• an unreasonably lenient or, conversely, excessively strict approach to high-risk segments.

I see entrepreneurs worry that strong risk-based AML will “kill conversion”. In practice, a well-designed approach allows:

• to segment customers by risk and build different KYC pathways;
• to use data providers and automation to speed up the low-risk flow;
• to keep a “manual mode” and enhanced Due Diligence for high-risk.

IT architecture, cybersecurity and outsourcing from the regulator’s perspective

In European projects I increasingly see that the outcome of an EMI license application is decided at the level of IT and security architecture.

Key areas of regulatory focus:

• IT and security risk management for EMI: incident response policy, disaster recovery, business continuity;
• API architecture and operation logging;
• segregated environments (development / testing / production) and change management;
• use of cloud services and critical outsourcing.

When preparing for licensing the COREDO team goes through with the client in detail:

• the infrastructure diagram (servers, data centers, cloud providers, VPN, key services);
• data flows (including customer data, payment data, logs);
• backup model and RTO/RPO metrics.

Timeline and cost of an EMI license

To the question “how long does obtaining an EMI license in the EU take” I always answer with one word: it depends. But there is a realistic range.

With preparation taken into account:

• analysis of the business model and choice of jurisdiction;
• company structuring, substance, appointment of directors and key functions;
• preparation of the business plan, policies, procedures, IT descriptions;
• preliminary consultations with the regulator (where appropriate);

A full turnkey project in Europe typically takes 9–18 months, sometimes longer: if the model is complex or the group structure is non-trivial.

The cost of obtaining an EMI license consists of:

• minimum share capital (for example, the EMI minimum share capital of 350,000 euros for some EU countries);
• professional services (legal support for an EMI license, financial modeling, IT and AML design);
• expenses for substance: office, local team, directors, control functions;
• subsequent audit and an ongoing compliance function.

How to reduce the risk of refusal by the regulator

The regulator doesn’t want to stop you from operating. Its job is to ensure you operate safely. It’s important to remember that.

1. Early dialogue and transparency
   • It’s easier to explain a complex element of the model at an early stage than to defend it after the official submission.
2. Consistency of documents
   • The business plan, policies, IT descriptions, governance structure, and partner agreements should be logically consistent. The regulator quickly spots inconsistencies.
3. Realism
   • Overly aggressive growth plans that are not backed by capital, team, and technology raise doubts. At COREDO we often temper expectations and rebuild the financial model.
4. Readiness for oversight
   • Regulatory oversight (on-site and off-site inspections, regular reports, audits) is not a “punishment”, but a normal part of life for a licensed company. It’s important to set up processes in advance, rather than reacting after the fact.

When it’s better to work with a partner instead of obtaining an EMI license

There are scenarios in which I honestly recommend not rushing to obtain a license:

• the product hasn’t yet achieved market fit;
• unit economics are unstable;
• the team is not ready to support full compliance, risk, and IT operations at the level expected of a licensee.

COREDO’s role here is not to sell a licensing service, but to help see the entire path: from an MVP to a fully licensed institution, with minimal regulatory and operational risks.

How to open an EMI structure with COREDO

In practice, the COREDO team:

• analyzes the business model and helps choose a country where EMI regulatory risks in different jurisdictions align with your risk appetite;
• structures the legal entity (or group), builds a clear ownership structure and substance;
• prepares the complete documentation package for licensing: from the business plan and risk policy to AML/KYC procedures and IT descriptions;
• supports dialogue with the regulator, helps respond promptly to requests and adjust the model;
• sets up ongoing support: AML consulting, legal support, interaction with auditors, updating policies for regulatory changes.

My personal view is simple: having your own EMI license for an international fintech project is an investment in control over the product, margins and the pace of development. But only if you are prepared for serious, systematic work on regulatory, IT and operational risks.

When an entrepreneur or a CFO says to me: “We want to buy a licensed PSP company in Europe”,: I always ask the same counter-question: “Are you sure you are ready for an honest Due Diligence?”

The purchase of a payment institution (Payment Institution) or an electronic money institution (EMI), is not just an M&A deal, but the purchase of regulatory history, compliance culture and risk profile, which will either strengthen your holding or become a source of ongoing conflicts with regulators and banks.

Over the years of COREDO‘s development in the EU, Asia and the CIS our team has completed dozens of projects with clients: from due diligence when buying a PSP company in Europe and Singapore to supporting transactions for acquiring EMI/PI licenses together with companies and integrating these assets into large financial groups. This experience has shown: 80% of a deal’s success is determined by the quality of preliminary due diligence: legal, financial, tax, operational and, of course, AML/KYC.

Why it’s more advantageous to buy a licensed PSP

When we discuss a payments market entry strategy with clients, there are usually two options on the table:

• obtaining a new license (EMI/PI) in the EU, the UK, Singapore or Dubai;
• buying a licensed PSP company with an existing license and infrastructure.

Buying an existing PSP allows:

• to reduce time-to-market: often 12–18 months faster compared to obtaining a new license;
• to obtain established relationships with correspondent banks and payment partners;
• to inherit merchants, the technology platform and the team;
• to use the existing license for passporting within the EU (subject to compliance with PSD2 requirements and national rules).

But along with the license the investor takes on:

• regulatory legacy risks (past violations, outstanding regulatory orders);
• the historical transaction profile and client portfolio;
• the PSP’s reputational history in the market.

Structure of due diligence for a PSP company

When I’m asked to perform due diligence when buying a PSP company, I immediately divide the work into at least six blocks:

1. Legal due diligence
2. Regulatory and licensing due diligence (including checking the PSP license)
3. AML/KYC due diligence and compliance check
4. Financial and tax due diligence
5. Operational due diligence and IT/cyber security
6. Strategic and business due diligence (unit economics, model sustainability, ROI)

Each block provides its own layer of red flags, and at COREDO we are used to presenting the result as a risk heatmap: a visual map of the key deal risks and their impact on price, the SPA structure and the post-closing roadmap.

Legal due diligence: structure and change of control

Legal support for the purchase of a PSP in the EU and Asia begins with basic but critical matters.

What I check first

• Ownership structure and beneficiaries (UBO)
  • transparency of the ownership chain;
  • presence of trusts, nominee structures, offshore elements;
  • whether beneficiaries match those registered with the regulator.

  Red flags when buying a PSP: discrepancies between corporate documents and regulator data, hidden controllers, complex structures without a business purpose.

• Legal origin of the license
  • whether the constitutional documents and the license contain restrictions on change of control;
  • whether mandatory approval of a change of control by the regulator is required;
  • whether there are legal restrictions on changes to directors and key personnel.
• Presence of material contracts and obligations
  • agreements with correspondent banks, payment schemes, anti-fraud and KYC providers;
  • agency, outsourcing and white-label agreements;
  • agreements with key merchants, partner and referral contracts.

Which documents to request during PSP due diligence

The list is always adapted to the jurisdiction, but the core remains:

• corporate documents (articles of association, shareholders’ resolutions, register of participants);
• PSP license/EMI, all appendices, letters and regulator decisions;
• register of shareholders and beneficiaries, UBO confirmation;
• key commercial contracts (banks, schemes, merchants, KYC/AML providers, IT outsourcing);
• internal policies & procedures (regarding governance, decision‑making, outsourcing);
• history of legal disputes and counterparty claims.

Regulatory due diligence: license and PSD2

How to check a PSP license in the EU

I always insist on at least:

• verification of the license via the regulator’s official register;
• analysis of the license scope: which types of payment services are permitted, and whether there are geographic or client-type restrictions;
• checking the business model’s compliance with PSD2 requirements (and prospectively PSD3) and AMLD.

History of regulator inspections and orders

The COREDO team always requests:

• copies of regulatory letters, orders, enforcement actions for the last 3–5 years;
• external auditors’ reports on regulatory matters;
• remediation plans and action plans submitted by the PSP to the regulator.

The key question is how the company responded to findings: whether it addressed them promptly, strengthened the compliance function, and improved governance.

AML/KYC due diligence when working with PSP

What I check in KYC/AML compliance

• Risk-based approach policy
  • whether there is a formalized risk appetite statement;
  • how clients are segmented by risk (high‑risk industries, high‑risk jurisdictions);
  • how decisions on onboarding and offboarding are made.
• KYC/AML procedures
  • customer due diligence (CDD) and enhanced due diligence (EDD);
  • source of funds/source of wealth checks;
  • procedures for ongoing monitoring of customers and transactions;
  • sanctions screening, PEP screening, adverse media.
• Transaction monitoring & anti‑fraud
  • presence of an automated transaction monitoring system;
  • scenarios and rules (rules‑based, risk‑based or hybrid models);
  • model for managing alerts and internal investigations;
  • chargeback ratio and dispute ratio metrics for key merchants.

Which documents for AML are needed for due diligence

In COREDO projects for AML due diligence of a PSP provider, I usually request:

• AML policy, KYC policy, risk assessment and risk appetite statement;
• descriptions of onboarding, monitoring, investigation and reporting (SAR/STR) processes;
• internal and external AML audit reports;
• statistics on STR/SAR, offboardings and onboarding refusals for the last 2–3 years;
• training records for employees;
• a sample of customer files (KYC dossiers), including high‑risk customers and PEPs;
• a sample of transactions in high‑risk segments for forensic analysis.

Due diligence of high-risk jurisdictions

For international investors, we at COREDO regularly conduct sanctions due diligence of a payment company:

• we analyze countries, currencies and payment corridors;
• we check whether there are clients or transactions linked to sanction regimes;
• we assess the sanctions screening and negative news monitoring processes.

Financial and tax due diligence: regulatory context

The payments business is specific: a purely financial due diligence does not give the full picture without understanding regulatory constraints.

In COREDO’s PSP financial due diligence projects we look at:

• revenue structure: processing fees, interchange, FX margin, ancillary services;
• concentration of revenue among a few key merchants;
• stability of margins and unit economics by segment;
• expenses for compliance, IT, licenses and regulatory capital.

We supplement tax due diligence in fintech acquisitions with:

• analysis of intercompany agreements within the group;
• verification of substance in the jurisdictions where the company operates;
• assessment of the tax model’s alignment with the overall business logic.

Operational due diligence — IT/cybersecurity

For a PSP technology is not back‑office, but the core of the licensed activity. Operational due diligence of a PSP provider at COREDO always includes:

• assessment of governance: role and independence of the board of directors, existence of a compliance committee, three lines of defence;
• analysis of the key team: experience of the CEO, COO, CCO, MLRO, IT director;
• assessment of the incident management and business continuity processes.

IT infrastructure and cybersecurity review

Minimum set of questions:

• platform architecture (own vs white‑label, critical dependencies on vendors);
• SLAs with key providers, uptime, disaster recovery plans;
• results of penetration testing and vulnerability assessments;
• access management, logging, segregation of duties.

GDPR and personal data

In the EU and the UK I always pay special attention to:

• presence and implementation of GDPR policies (data protection, data retention, data minimisation);
• appointment of a DPO and their role;
• data breach incidents and the company’s response.

Red flags during PSP due diligence

Over the past few years the COREDO team has developed a fairly consistent list of “red flags” that lead me to either strongly recommend revising the price and deal structure or to walk away altogether:

• Mismatch between licensed and actual activities (for example, hidden e‑money activity without the appropriate license).
• Systemic AML violations/KYC: lack of adequate documentation for high‑risk clients, weak EDD procedures, a formal approach to ongoing monitoring.
• Open regulatory investigations or outstanding orders.
• Heavy concentration on sanctions‑sensitive markets or high‑risk jurisdictions without a considered risk‑based approach.
• Critical dependence on a single correspondent bank or a single large merchant.
• History of serious data breaches, weak cybersecurity, lack of proper disaster recovery.
• Opaque ownership structure, hidden beneficiaries, discrepancies between regulator records and corporate documents.
• Absence of a real governance structure and an independent compliance officer.

Due diligence in the deal structure

When due diligence in an acquisition is completed, the most important thing for me is to translate the findings into specific legal and financial SPA mechanisms.

In practice COREDO often offers:

• earn‑out: part of the price is tied to future performance (including compliance indicators, retention of licenses, absence of new sanctions/penalties);
• escrow and holdbacks: part of the amount is blocked for a period sufficient to surface potential legacy risks;
• specialized representations & warranties regarding:
  • absence of undisclosed regulatory investigations;
  • completeness of disclosure of AML/CTF incidents;
  • license status and absence of grounds for its revocation;
• indemnities for:
  • fines and sanctions for breaches whose roots lie pre-closing;
  • regulatory claims related to the historical client portfolio and transactions.

Comparison of jurisdictions for investors

A separate part of the work is choosing a jurisdiction for acquiring a licensed PSP company: the EU, United Kingdom, Singapore, certain Asian or Middle Eastern centres.

What we usually focus on with clients:

• the strictness and predictability of the regulator;
• requirements regarding capital adequacy and safeguarding;
• banks’ attitude towards PSPs from that jurisdiction;
• scalability opportunities (passporting in the EU, cross-border Licensing in Asia);
• historical cases of enforcement practice.

How I structure PSP due diligence with a client

To make due diligence of a payment institution in Europe or Asia genuinely useful rather than formal, at COREDO we follow a simple but effective methodology:

1. We build a map of the investor’s objectives
   • why the PSP is being acquired (geography, products, license, technology, customer base);
   • planning horizon (rapid integration or a careful roll‑out).
2. We develop the scope of due diligence and a deal risk map
   • we determine the depth of review by blocks: legal, regulatory, AML/KYC, financial, tax, IT, operational;
   • we identify critical KPIs and red flags.
3. We perform a phased analysis
   • first a high‑level screening (to weed out clearly problematic targets at an early stage);
   • then a detailed deep dive into key areas.
4. We turn the findings into a deal plan
   • we adjust the deal structure and the SPA;
   • we prepare a remediation roadmap after closing;
   • we model scenarios of regulatory inspections and stress scenarios (for example, withdrawal of correspondent accounts by the main bank).
5. We support the change of control and interaction with the regulator
   • we prepare the document package for approval of the change of control;
   • we help establish a dialogue with the regulator to explain the new owner’s strategy;
   • we take into account the timing and conditions of approvals in the deal timeline.

What’s important before a deal starts

• Due diligence of a fintech company and a PSP is never “too deep” when it comes to AML/KYC and regulation;
• weak compliance at the target almost always costs more than the highest possible price discount;
• a properly conducted due diligence when acquiring a company is not an expense, but a tool for negotiations and managing ROI.

If you are considering the purchase of a licensed payment institution, an EMI, or another fintech asset in the EU, Asia, or the CIS, start not with discussing the price but with a due diligence plan. Price is a derivative of risks, not the other way around.

Crypto custody in the EU is no longer a “grey area”. For me as the founder of COREDO this is one of the most telling areas: over the past few years the team has accompanied the evolution from experimental crypto platforms to mature financial infrastructures that are subject to the same strict regulatory requirements as banks and payment institutions.

In this article I will lay out what cryptocurrency regulation in the EU actually means, how MiCA, DAC8 and CARF are changing the rules of the game, and what needs to be built into the crypto custody business so it doesn’t just “survive 2026”, but use it as a point of growth.

Crypto custody in the EU: what is considered custody

When an entrepreneur tells me: “We’re not a bank, we just hold clients’ assets in wallets,” to the regulator that sounds like a classic crypto custody service.

The custody of crypto assets in the EU typically covers services that:

• have access to clients’ private keys or can initiate transactions on their behalf;
• provide a wallet structure (hot, cold, custodial) with responsibility for the safekeeping of assets;
• offer trust management, margin services, staking, if in doing so they control access to the funds.

The key mistake I often see is the attempt to “hide” the activity behind the wording “we’re just an IT platform.” For the regulator, what matters is not what you call the service in a pitch to investors, but:

• whether the user has full and exclusive control over the private keys;
• who legally owns the assets;
• who is responsible to the client in the event of loss or freezing of funds.

If you control the keys or manage assets on behalf of clients, you fall under the scope of a crypto-asset service provider (CASP) and you need the appropriate status and Licensing of crypto platforms in the EU.

MiCA: regulation of cryptocurrencies in the EU

The MiCA regulation ends the era of fragmented cryptocurrency regulation in Europe. For businesses, it is both a challenge and an opportunity.

Who CASPs Are and Why It Matters

MiCA introduces a single category – Crypto-Asset Service Provider (CASP). For crypto custody platforms this means:

• you cannot work with EU clients in a custodial capacity without a CASP license;
• after obtaining the license you get a single authorization for the EU market: you can serve clients via the «passporting» model without re-licensing in each Member State;
• all key requirements for capital, governance and compliance are now set at the regulation level, rather than being «spread out» across national rules.

MiCA requirements for crypto-custody

For crypto-asset storage services, MiCA sets out a set of basic building blocks:

Capital and financial resilience

corporate governance of CASPs
The owner of a crypto custody business can no longer remain simply a «tech entrepreneur». The regulator expects:

• a transparent ownership structure;
• a board of directors/management with relevant experience in finance and compliance;
• a documented risk management system;
• an independent compliance function and, for large entities, internal audit.

Organization of storage and IT security
MiCA strongly encourages:

• segregation of client assets and company funds;
• a policy for allocating storage between hot and cold wallets;
• procedures for managing private keys (generation, storage, rotation, backups, access on a «least necessary» basis).

MiCA transition period and deadlines

For existing crypto companies, the European Union has provided a MiCA transition period that ends by mid-2026. This is the window in which you need to:

• determine whether you fall into the CASP category;
• choose the country for primary licensing;
• restructure business processes to meet MiCA requirements;
• submit a full set of documents and obtain authorization.

DAC8 and CARF: taxation of crypto-assets

If MiCA covers “licensing and investor protection”, then DAC8 and CARF cover tax transparency.

What DAC8 means for crypto platforms

The DAC8 directive extends the European framework for administrative cooperation in tax matters to crypto-assets. For crypto custody and crypto platforms this means:

• an obligation to transmit client data and their transactions to tax authorities;
• integration into the regime of automatic exchange of crypto-asset data between countries;
• establishing processes to identify unpaid tax liabilities and prevent tax avoidance.

CARF: the reporting standard for crypto-assets

CARF reporting standards: an OECD initiative that essentially does for crypto-assets what the CRS did for standard financial accounts:

• a single message format for automatic exchange of information;
• a unified data set: client identification, crypto-asset balances, transaction history, transfers between accounts;
• the ability for tax authorities of different countries to view crypto-assets in the context of a client’s overall financial flows.

KYC/AML and a risk-based approach in crypto

Regulation no longer works without effective AML/CFT and KYC in crypto businesses. MiCA, DAC8, AMLR and national laws expect platforms to have mature, documented and verifiable compliance.

KYC/AML for crypto custody: basic framework

When we at COREDO build AML/CFT processes in crypto, for crypto custody platforms we typically form the following blocks:

KYC policy

• identification of natural persons and legal entities;
• document verification, screening against sanction and PEP lists;
• data updates on a schedule or by triggers (change in activity, suspicious transactions).

Risk‑based AML/CFT approach in crypto

• client segmentation by risk in crypto services (retail, professional, institutional, high‑risk jurisdictions, complex ownership structures);
• assigning a baseline risk rating during onboarding;
• reviewing risk ratings when new data emerges, client behavior changes or adverse information is detected.

transaction monitoring of cryptocurrencies

• scenarios for automatic detection of atypical or potentially suspicious transactions;
• transaction thresholds under DAC8 and internal limits for enhanced review;
• integration with blockchain analytics systems.

Blockchain analytics for compliance

Today, quality compliance for cryptocurrency platforms is impossible without blockchain analytics. From practice:

• in one licensing project for a crypto exchange we implemented integration with several blockchain analytics providers to:
  • check the ‘cleanliness’ of incoming and outgoing cryptocurrency;
  • track links to darknet markets, mixers, sanctioned addresses;
  • analyze transaction chains according to typical risk scenarios.

How to securely store crypto assets

MiCA and DAC8 define the “what” and the “why”. The question of “how” is engineering and operational design.

Hot, cold and non-custodial wallets

For crypto custody in the EU the key decisions are:

Hot wallets (hot wallets)

• provide high transaction speed;
• carry increased risks of hacking attacks and device compromise;
• require strict limits, multi-signatures, segregation by types of operations.

Cold wallets (cold wallets) and hardware devices

• used for the bulk of assets;
• integrated into multi-stage access procedures (multisig, physical safes, offline storage);
• entail a considered policy for storing seed phrases and backups of private keys (including the use of safes and bank deposit boxes).

Non-custodial wallets and regulation

Monitoring and reporting integration

To meet the requirements of MiCA, DAC8 and CARF, companies build:

• transaction monitoring systems capable of:
  • online analytics;
  • generating reports on request from regulators and tax authorities;
  • documenting all decisions (why an operation was approved, rejected, sent to enhanced Due Diligence).

Licensing crypto platforms in the EU 2026

Given MiCA, DAC8 and CARF the question ‘where to get licensed’ turns from a tax issue into a strategic decision about the company’s positioning in Europe.

Choosing a jurisdiction for a CASP license

When choosing a country for the primary CASP‑license I always advise founders to look at several parameters:

• speed and transparency of interaction with the regulator;
• practice of licensing crypto companies;
• capital requirements;
• approach to AML/CTF and tech solutions;
• ecosystem: banks, payment providers, consultants, auditors.

How to prepare for CASP licensing?

To avoid entering the process chaotically, I usually structure the preparation into four blocks:

Business and product model

• which crypto services in the EU you actually provide (custody, exchange, staking, tokenization, etc.);
• for which client categories (retail, HNWI, corporate, institutional);
• geography: only the EU or global coverage with an EU‑focus.

Corporate structure and governance

• a legal entity in the EU with a clear beneficial ownership structure;
• a board of directors and top management with verifiable experience;
• internal policies: risk management, compliance, IT security, business continuity.

Compliance framework

• KYC/AML policies taking into account a risk‑based approach;
• transaction monitoring procedures and blockchain analytics;
• internal investigation processes and reporting of suspicious transactions.

IT and operational infrastructure

• wallet architecture (hot/cold/non-custodial);
• logging and activity audit system;
• integration with analytics and reporting providers for CARF/DAC8.

Strategic issues for executives 2026

In conversations with owners and chief financial officers of crypto platforms, several strategic topics usually come into focus.

MiCA: competitive advantage

MiCA simultaneously:

• raises the barrier to entry for crypto businesses;
• creates a predictable framework for those willing to invest in regulation and compliance.

Return on investment in compliance

• costs for AML/KYC tools and reporting under DAC8/CARF are better viewed as investments in:
  • access to large clients (banks, funds, institutional investors that require strict compliance);
  • reduced likelihood of sanctions and inspections;
  • increased company valuation when raising capital or exiting the business.
• One of COREDO’s clients managed to increase the company’s valuation in a funding round precisely because it already had a prepared MiCA‑ready compliance framework and a clear plan for CASP licensing. For the investor this meant a manageable regulatory risk.

Scaling the business in the EU and abroad

MiCA with CASP passporting makes the EU one of the most structured markets. For many Asian and Middle Eastern players that COREDO works with, the strategy looks like this:

• create a regulated storefront in the EU under MiCA, DAC8, CARF;
• use it as an “anchor of trust” for global clients;
• build additional jurisdictions around it with a different focus (for example, experiments with DeFi, new tokenization models) in more flexible regimes, but relying on the European standard of compliance.

How COREDO helps develop crypto custody businesses

My personal interest in the crypto market has always been pragmatic: those who can operate under changing regulation survive in the long term. Over years of work with the EU, the United Kingdom, Cyprus, Estonia, Singapore and Dubai, the COREDO team has developed several strategies for supporting crypto projects:

From idea to CASP license

Reengineering existing crypto custody for MiCA/DAC8

As a result, the client receives not a “list of problems”, but a change plan with prioritization and an assessment of the impact on the business model.

Comprehensive support after obtaining licenses
Registration and licensing are the start, not the finish. In practice COREDO remains by your side afterwards:

• helps prepare for regulator inspections;
• adapts processes to new recommendations from the EBA, the European Commission and national regulators;
• participates in updating AML/KYC policies and procedures when launching new products and entering new markets.

In international business, a growth strategy today inevitably runs up against compliance: company registration in the EU and Asia, financial licenses, KYC/AML, sanctions compliance, cross-border operations: all of this becomes a single task of managing compliance risks at the group level, not of individual legal entities.

Over ten years of COREDO’s work with holdings from Europe, Asia and the CIS, I have become convinced: until a group has a clear map of compliance risks and an established compliance risk mapping, any new jurisdiction, license or bank adds not business opportunities, but points of vulnerability.

How to approach compliance risk mapping for international holdings practically: what to consider a risk, how to build the map, how to align it with the board of directors’ risk appetite and licensing, and which solutions have worked in practice in COREDO projects.

Compliance-risk map of the holding company

If you have:

• companies in several countries of the EU, Asia and the CIS;
• licenses (or plans) for payments, forex, crypto, EMI, investment services;
• ownership structure is multi-level, with trusts, SPV, separate holdco;

then your key resource: not only the corporate structure, but the transparency and manageability of compliance risks.

• bank de‑risking and denial of service: banks see an «unclear» structure, weak KYC/AML, unpreparedness for a sanctions audit;
• blocking & freezing of assets due to sanctions violations or errors in handling PEP/high‑risk jurisdictions;
• reputational damage and an increase in the cost of capital, investors and partners begin to factor a high cost of non‑compliance into valuations;
• prolonged regulator investigations in the EU and Asia, licensing restrictions, additional capital and reporting.

When the COREDO team enters a holding at the scaling stage, most problems come down to one thing: the compliance system cannot keep up with geography and product. There is no centralized risk register, no risk owners, compliance is perceived as a set of documents rather than as an enterprise risk management tool for international groups.

Compliance risk in an international context

Compliance objectives in a global holding are not only “avoiding fines”. They include:

• maintaining access to banking infrastructure and payment providers;
• protection against sanctions and AML incidents;
• compliance with licenses (payment, EMI, crypto, MiFID-like, local regimes in Asia);
• an acceptable level of reputational risk for investors and partners.

• a unified risk taxonomy for compliance;
• a formalized process for identifying, assessing, treating and monitoring compliance risks;
• a documented risk assessment report and a risk register.

When at COREDO we conduct a compliance risk assessment in a transnational group, we divide risks into:

• regulatory (regulatory compliance in the EU and Asia, licenses, reporting);
• sanctions and AML risks for holdings;
• operational (KYC/AML processes, onboarding, monitoring, IT GRC);
• legal (contracts, beneficial ownership transparency, CRS/FATCA, ESG compliance);
• reputational (incidents, investigations, media environment, customer complaints).

Compliance-risk map: methodology

The methodology for building a compliance-risk map relies on a detailed understanding of how the business is structured and where exactly vulnerabilities arise in its processes. Based on the business map, we step by step move to forming a structured compliance-risk map that shows which violations can occur, at which points, and with what probability.

Business map and risk map

Next, the steps:

1. Business-process approach to compliance mapping
   We explicitly describe key processes:
   sales, client onboarding (KYC/KYB), payments, account operations, work with suppliers and agents, HR, IT, reporting.
   On this basis, a compliance risk map by business processes is formed.
2. Identification of risk areas
   For each process we identify:
   • points of generation of sanctions risks and AML risks;
   • zones of cross-border compliance risks (payments, transfers between jurisdictions, use of different currencies, correspondent accounts);
   • contact with regulators, banks, payment systems, auditors.
3. Collection of data and incidents
   The COREDO team usually forms a centralized risk register of compliance incidents:
   regulator requests, payment blocks, bank inquiries, detected violations, red flags.
   This provides real statistics for assessing likelihood.

Likelihood and impact according to ISO 31000
Classic question: how to measure compliance risk, by probability or by severity of consequences?

In COREDO’s practice with holdings we use a two-dimensional assessment:

• likelihood, frequency of occurrence: from «rare» to «frequent»;
• impact, effect on: licenses, banking access, financial results, reputation, personal liability.

It is important to distinguish:

• likelihood as an expert assessment based on incidents and specifics;
• probability as a more strict, quantitative measure (where data exist).

Risk appetite and risk ownership
Without alignment with the board of directors’ risk appetite the risk map remains an academic document.

What I do at the governance level:

• the board of directors formulates the compliance risk appetite:
  which sanctions, AML, regulatory, operational risks are acceptable and which are not;
• risk tolerances are established – acceptable ranges for key KRIs (for example, the number of payments rejected for sanctions reasons, frequency of regulator inquiries);
• risk owners / owners of compliance risks are appointed – generally business unit leaders, not only compliance officers.

Centralized, Decentralized and Hybrid Compliance Models

In international holdings, I see three patterns of compliance governance in multinational holding structures.

Competence Center
A compliance competence center at the head office:

• a single methodology for constructing the compliance risk map;
• centralized risk register and risk assessment report;
• common policies: sanctions compliance, AML, KYC/KYB, TPRM, ESG, data protection;
• a single IT GRC core and compliance infrastructure (RegTech, case-management, monitoring).

Decentralized system model
Local compliance officers in subsidiaries:

• strong adaptation to regulatory compliance in the EU and Asia (local regulators, reporting, languages);
• their own practices for interacting with banks, payment institutions, and financial intelligence units.

Hybrid Model
In most COREDO projects, I promote a hybrid model of compliance risk management in the group:

• head office: methodology center, governance, risk & compliance (GRC approach), a common risk map for the holding;
• subsidiaries: adaptation and detailing of the compliance risk map for the holding with assets in Europe and Asia to their own processes;
• unified standards (ISO approach, policies, KYC/AML framework), but local procedures where required by the regulator.

Sanctions and AML risks in multi‑level structures

Sanctions and AML risks in multi‑level structures are amplified by complex ownership chains, cross‑holdings and beneficiaries from different jurisdictions. To avoid inadvertent exposure to restrictions and regulatory enforcement, businesses need a systematic sanctions audit and a detailed sanctions risk map that covers every level of the structure.

Sanctions audit and risk map
For private equity groups and complex ownership structures, the COREDO team often starts with a sanctions audit and sanctions Due Diligence:

• analysis of beneficial ownership transparency: who the ultimate beneficiaries are and at which levels;
• assessment of multi‑level ownership structures, trusts, funds, SPVs, offshore entities;
• mapping cross‑border chains: payments, dividends, intercompany financing.

On this basis we develop:

• sanctions risks and the holding’s risk map:
  • risk of being listed on sanctions lists;
  • compliance risks when dealing with PEPs and high‑risk jurisdictions;
  • risk of indirect ownership/relationships with SDN‑listed parties;
• “red flags” for internal systems:
  • anomalous payment chains;
  • new counterparties from high‑risk countries;
  • atypical changes in ownership structure.

Integration of AML systems into the risk map
A classic mistake: building the AML system separately from the overall compliance risk map.

A solution that COREDO has successfully implemented in holdings with payment and crypto licenses:

• integration of AML systems into the holding’s overall compliance risk map;
• use of a risk‑based approach when building the compliance risk map:
  • client segmentation by risk;
  • risk‑based KYC and differentiated procedures;
• setting up an AML transaction monitoring system as a source of KRIs:
  • proportion of transactions subject to manual review;
  • number of identified red flags;
  • number of reports to the financial intelligence unit.

Digital infrastructure: IT GRC and RegTech

In holdings with a large number of jurisdictions, licenses and banking relationships, manual compliance risk mapping becomes unmanageable.

Therefore I consider digital platforms for managing compliance risks (RegTech, GRC systems) as the core of the compliance infrastructure:

• IT GRC and compliance for international holdings provide:
  • a centralized risk register and incident register;
  • case management for compliance incidents;
  • process documentation and audit trail;
  • dashboards and dashboards / scorecards for management.

• Integration of AML/KYC with GRC:
  • data lineage and data quality in AML/KYC systems;
  • the ability to link client and counterparty cases and incidents to specific risks on the risk map;
  • monitoring key risk indicators (KRI) in near‑real time.

The COREDO team acted as architect on several projects:
we described the compliance infrastructure, developed requirements for RegTech solutions, and then integrated them with banking, payment and CRM systems.

Compliance risk map and corporate governance

The compliance risk map becomes a practical tool that links corporate governance with the actual areas of responsibility and control within the company, showing where and how violations may occur. Through this link, the ‘three lines of defence’ model helps build a transparent allocation of roles, from the operational level to the board of directors, and provides a unified system for managing compliance risks.

The three lines of defence in a bank
An effective compliance system as a risk management tool does not operate in isolation:

1. First line: business units and operational staff.
   They are the key risk owners; it is here that primary risks arise and are managed.
2. Second line: legal, risk and compliance functions.
   Their task – methodology, monitoring, updating the compliance risk map and control.
3. Third line: internal audit.
   It validates the compliance risk map, checks the realism of assessments, the presence of controls and the effectiveness of processes.

In one of COREDO’s projects for a holding with licenses in the EU and Asia, we began by ‘reworked’ the risk map together with internal audit:
some risks that were considered low turned out in practice to be critical because of cross‑border characteristics and the requirements of specific regulators.

Tone at the top and compliance culture
Without tone at the top and a compliance culture, any risk map turns into bureaucracy.

• approve risk appetite and risk tolerance;
• include compliance KPIs at the top‑management level;
• support regular reviews of compliance risk mapping and reports on KRIs;
• allocate resources for compliance training and awareness‑programs.

COREDO’s practice shows: when compliance KPIs become part of the management bonus system, residual risk begins to materially decrease.

Compliance risk mapping in an international holding company

That very «step-by-step plan» the COREDO team uses in a typical project for a group with assets in Europe and Asia.

1. Diagnostics
   • analysis of jurisdictions, licenses, banking and payment relationships;
   • assessment of the maturity of the current compliance‑function and IT‑landscape;
   • collection of incidents, requests from regulators and banks, sanctions and AML‑cases.
2. Risk taxonomy and processes
   • development of the compliance‑risk structure for international holdings;
   • process descriptions (onboarding, payments, TPRM, HR, IT, reporting);
   • identification of cross‑border chains and areas of sanctions/AML risk.
3. Assessment and map construction
   • compliance risk assessment according to the ISO‑approach: likelihood and impact;
   • creation of the risk register and the risk assessment report;
   • visual risk map / heat map for the board of directors.
4. Linkage to risk appetite and governance
   • alignment of risk levels with the board of directors;
   • appointment of risk owners and roles;
   • choice of model: centralized, decentralized, hybrid.
5. Integration with internal control and audit
   • building the link «risk map: control procedures – checks»;
   • involvement of internal audit in validation of assessments and scenario analysis;
   • stress‑testing of the compliance‑system and scenario risk analysis.
6. Digitalization and RegTech
   • definition of requirements for the GRC‑platform and AML/KYC‑solutions;
   • integration with CRM, payment, banking and accounting systems;
   • launch of dashboards and automated compliance monitoring.
7. Continuous monitoring and review of the risk map
   • regular updating of the compliance‑risk map (at least annually, and more often in case of significant regulatory changes);
   • analysis of new jurisdictions, products, partners;
   • adjustment of KRIs and processes.

Compliance risk map: ROI and impact

From COREDO’s experience I see several consistent effects:

• Reduction in cost of non‑compliance
  Fewer fines, fewer blocks, fewer bank refusals.
  For fintech and holding groups this directly affects the cost of capital raised and business valuation.
• Faster expansion into new jurisdictions and licenses
  When you have established compliance management in an international business, regulators and banks view the holding differently – as a predictable and understandable player.
• Reduction of reputational risks
  A clear compliance risk map, scenario analysis, and properly structured sanctions and AML compliance reduce the likelihood of events that could undermine market trust.
• Manageability of growth
  When scaling into new markets, in M&A deals, or launching new products, the risk map becomes a filter:
  what can be done, where additional control is needed, where it’s better to refrain.

In one of COREDO’s cases for a group with assets in the EU and Asia, the implementation of a compliance risk map and a GRC platform:

• reduced the number of problematic requests from banks by more than half;
• reduced the share of manual transaction reviews thanks to better risk‑based calibration;
• allowed the regulator to approve the license expansion, relying on the provided risk assessment report and governance structure.

What you should personally consider

1. Does the group have a formalized compliance‑risk map, rather than a set of fragmented policies?
2. Do the board of directors and top management understand their risk appetite specifically in terms of compliance and sanctions?
3. Are your IT systems, AML/KYC and processes tied to a single GRC approach, or does each legal entity operate independently?

Команда COREDO за последние годы сопровождала холдинги в ЕС, Великобритании, Чехии, Словакии, на Кипре, в Эстонии, Сингапуре и Дубае – от регистрации юридических лиц и получения финансовых лицензий до построения комплексных комплаенс‑систем и risk map на уровне группы. Этот опыт убеждает меня в одном:

Your compliance‑risk map is essentially a strategic map of the holding’s resilience. And the more complex your geography and licenses, the more important it is that this map is not only drawn but actually works every day.

When in 2016 I launched COREDO, I had a very simple idea: international business should receive clear and predictable solutions, not a collection of disparate services from a dozen consultants in different countries. Since then the COREDO team has grown from a small consultancy to a partner that takes on the full cycle of tasks: from company registration in the EU, Asia and the CIS to obtaining financial licenses, setting up AML frameworks and long-term business support.

In this article I want to candidly and to the point examine three key questions that you, as an owner or chief financial officer, face in international projects:

• how to choose and structure jurisdictions for a company;
• how to approach licensing (banking, payment, crypto, forex and other licenses);
• how to build a sustainable AML system and a comprehensive support model so that the business runs smoothly, not from one inspection to the next.

And at the same time I’ll show how we solve these tasks in practice at COREDO: with numbers, case studies and concrete approaches.

Choosing a jurisdiction for business

Over the years I have become convinced: the mistake is not a “bad” country, but a misformulated objective. The same jurisdiction can be perfect for a fintech startup and completely unsuitable for a traditional trading business.

When a client comes to me with the request “just need a company in the EU”, I always slow the process down and ask five basic questions:

1. Where are the key clients and suppliers located?
   This affects VAT, permanent establishments and the risk of tax claims in the countries of presence.
2. Do you need access to licensing (financial services, crypto, payments)?
   Some countries offer more flexible regimes for fintech, others are more conservative but respected by regulators and partner banks.
3. What target level of substance (office, employees, directors) are you prepared to maintain?
   In the EU, requirements for economic presence are gradually tightening, and this must be honestly taken into account when planning the structure.
4. What constraints do you have on timelines and budget?
   Some jurisdictions register in a few days, others take months, especially when a financial license is involved.
5. What is the exit strategy: attracting an investor, selling a stake, IPO?
   For investors from the US, Europe or Asia, the choice of jurisdiction is often as important as the product.

COREDO registration process

At COREDO this has long been formalized as a “registration roadmap”. For the client, the process looks as transparent as possible:

1. Pre-project analysis
   • beneficiary checks (KYC, sources of income);
   • analysis of the business model for compliance with requirements of the local regulator;
   • preliminary structuring (holding, operating company, licensable entity).
2. Choosing the jurisdiction and company form
   • In the EU and United Kingdom this could be, for example, a private limited / s.r.o. / OÜ;
   • In Singapore and Dubai: local legal forms, which we structure according to the client’s objectives.
3. Preparation of corporate documents
   At COREDO we handle the articles of association, shareholders’ resolutions, corporate agreements, option programs if the business is investment-oriented.
4. KYC processing at banks and financial institutions
   This is where COREDO’s AML team experience comes into play: we pre-model the bank’s questions, prepare justification of sources of funds, the business plan, and financial forecasts.
5. Launch of operational activities and basic compliance setup
   • basic policies and procedures;
   • contractual framework (contracts, offers, privacy policies, AML disclaimers).

Case: European holding and Asian fintech

A few years ago an entrepreneur approached us who was already running an IT business in Asia and wanted to launch a licensed fintech product targeted at clients from the EU and Asia.

The solution developed at COREDO included:

• a holding company in one of the EU countries with a well-developed treaty framework for avoiding double taxation;
• an operational licensed structure in an EU country where a modern regulatory framework for payment institutions is available;
• a service center in an Asian jurisdiction with a strong technological ecosystem.

The COREDO team ensured the registration of all legal entities, the preparation of documents for banks, the structuring of agreements between companies, and the launch of AML procedures at the start. The client received a working structure within reasonable timeframes, without ‘paralysis’ caused by working with multiple consultants simultaneously.

Financial licenses: how to get approval

The strategically right license is not only access to the market, but also a level of trust from partners. At COREDO we systematically work with licenses in the EU, the United Kingdom, Switzerland, and certain countries in Asia and the CIS.

Typical requests include:

• licenses for payment institutions and electronic money;
• Banking licenses (including for niche players);
• licenses for investment services and forex;
• cryptocurrency licenses and registration of virtual asset service providers;
• Licensing of specialized financial institutions.

Why licensing is not just paperwork

My experience has shown: the likelihood of license approval drops significantly when the applicant treats the process as a “technical submission of documents”. The regulator looks not only at completeness, but also at:

• maturity of the business model;
• strength of the compliance culture;
• transparency of beneficial owners and sources of funds;
• quality of risk management and AML approaches.

Therefore, at COREDO we structure the work as a project cycle:

1. License readiness assessment
   The COREDO team analyzes the client’s current state: corporate structure, processes, presence or absence of AML policies, and the level of documentation.
2. Choice of jurisdiction and type of license
   Sometimes it makes sense to start with a registration regime or a limited license, and then scale. Our experience at COREDO has shown that a staged approach is often more effective than trying to “get the maximum” immediately.
3. Development of internal documents
   • risk management policies;
   • AML/CTF policies;
   • KYC procedures/KYB;
   • transaction monitoring methodologies;
   • governance documents (board of directors, committees, responsibilities of key persons).
4. Application submission and interaction with the regulator
   At this stage the COREDO team supports communication, prepares responses to inquiries, and adjusts documents in accordance with the regulator’s comments.
5. Post-licensing support
   The regulator expects reporting, internal audits, and policy updates. COREDO often remains a long-term partner, providing legal, compliance, and AML support.

License for a crypto provider

One of the illustrative cases is obtaining a license for a crypto company that serves clients from the EU and Asia.

The client approached requesting “a crypto license in one of the EU countries.” In our preliminary analysis we saw:

• a strong technological product;
• a poorly formalized AML component;
• lack of a clearly defined governance structure and role distribution.

The solution developed at COREDO included:

• choosing a jurisdiction with a clear regulatory practice for crypto services;
• establishing a legal entity and preparing a full package of corporate documents;
• development of AML policies, identification and monitoring procedures, and a client risk matrix;
• preparation of a business plan and financial forecasts in the format expected by the local regulator;
• support at all stages of dialogue with the regulator.

AML consulting: how to avoid risks to a license

AML has long stopped being only about banks. COREDO’s practice confirms that regulators and financial partners pay equal attention to payment companies, crypto projects, investment platforms and even some trading businesses.

What AML work entails

When we at COREDO say «AML consulting», we are not talking about a boilerplate 40-page policy that sits on a server “for show”. A real AML framework includes:

• risk assessment by countries, client segments, product types;
• development and implementation of KYC/KYB processes, including enhanced Due Diligence;
• methodologies for monitoring operations and detecting suspicious transactions;
• protocols for interacting with financial institutions and regulators;
• employee training and assignment of responsibility.

COREDO often gets involved in two typical situations:

• the business is being launched and AML processes need to be built in from scratch;
• the business is already operating but has run into problems: requests from banks, account freezes, regulatory remarks.

Common mistakes made by international companies

Experience has shown several common mistakes:

1. Copying someone else’s policies
   The document does not reflect the real business model, and the regulator quickly sees this from transactions and the client base.
2. Gap between legal documents and IT systems
   On paper the process is ideal, but in reality the system does not collect the necessary data and does not record decisions on risk cases.
3. Underestimating partner banks’ requirements
   A bank is often more conservative than the regulator. It is important to consider not only the law but also the internal policy of a particular financial institution.
4. Lack of regular review
   The AML policy was created at project launch and was not updated afterwards, despite changes in products, geography and transaction volumes.

The COREDO team builds AML projects to avoid these mistakes: it all starts with an honest description of the real business, not an idealized picture.

COREDO’s comprehensive client support

Many come to us for company registration or a license, and stay for years thanks to comprehensive support. This is a deliberate model: I originally built COREDO as a full-cycle partner, not a “one-off agency”.

• legal services and protection in the necessary jurisdictions (contracts, corporate law, dispute resolution with financial institutions);
• registration and protection of trademarks in EU countries, the UK and other regions;
• AML and regulatory compliance (policies, training, internal audits);
• accounting outsourcing and reporting tailored to the requirements of the specific country of registration;
• support for opening bank accounts and working with payment providers.

Fintech: multi-jurisdictional reporting

One of our clients is a fintech project with a licensed structure in the EU, operational teams in Asia and clients from various regions.

The COREDO team implemented the following for the client:

• registration of several companies in the EU and Asia;
• obtaining a financial license;
• implementation of AML policies and procedures;
• ongoing legal support (contracts with partners, user agreements, privacy policies);
• support in registering trademarks in key markets;
• coordination of accounting and tax reporting across different jurisdictions.

Thanks to a single team of consultants, the client does not waste resources synchronizing between lawyers, accountants and AML specialists in different countries. For me, this is the key measure of quality: when a business can focus on the product and growth, rather than “putting out” legal and regulatory issues.

How to choose a consultant

1. Focus and specialization
   It’s important that the consultant works systematically with international registration, financial licenses and AML, rather than treating it as “one of the services”.
2. Experience in relevant jurisdictions
   Company registration in the Czech Republic is very different from licensing in Singapore or structuring in Dubai. Practice is needed, not just theoretical knowledge.
3. Transparency of processes and communications
   You should understand what stage the project is at, what the risks are and the timelines. Here honesty is more important than optimistic promises.
4. Having a team, not a single “jack-of-all-trades”
   Registration, licensing, AML and legal support are different competencies. At COREDO, specialists of different profiles work on projects, and that is what provides depth.
5. Willingness to talk about difficulties
   If a consultant promises “quickly, without problems and questions from the regulator”, I would be cautious. A proper dialogue with the regulator always includes clarifications, revisions and hands-on work with documents.

In one recent inquiry a client put their expectations this way: “We need a partner who not only knows the AML procedure, but also understands how regulators and banks interpret it in practice.”

This request resonates well with my own position. Yes, COREDO actively uses industry knowledge, international standards and Russian and European approaches to AML, but it always keeps the boundaries of its competencies in mind.

If you are planning to enter a new region, are considering a license, or realize that AML and compliance processes in your company need to be reviewed, it is important to ask the right questions in time and build a system rather than patch individual problems. This is exactly the format in which I am used to working with COREDO clients and exactly how I see the role of a reliable long-term partner in international consulting.

As CEO and founder of COREDO, I see every day how entrepreneurs from Europe, Asia and the CIS face the challenges of international business. Company redomiciliation: it is a strategic tool that allows transferring registration to a new jurisdiction while preserving the structure, minimizing risks and opening access to markets. In this article I will share a practical guide based on the experience of the COREDO team since 2016: from assessing the need to change jurisdiction to full support.

Important to understand: redomiciliation is not an emergency “rescue” measure, but a managed strategic step. In 2023-2025 we observe a steady trend: companies change jurisdiction not because of a crisis, but for scaling, preparing for investment or entering new markets.

In COREDO practice redomiciliation is increasingly used as part of M&A preparation, pre-IPO structures or restarting bank onboarding after refusals.

When a business needs redomiciliation

The decision to relocate a company does not happen by chance. Our experience at COREDO shows: entrepreneurs choose redomiciliation when the old jurisdiction limits growth.

In practice we identify several categories of business for which redomiciliation is not just advisable, but critically necessary:

• Financial and fintech companies that require Licensing (EMI, SPI, crypto, forex). Without a “white” jurisdiction the license is either impossible or economically impractical.
• Holdings with international flows facing bank refusals due to the origin of the old jurisdiction.
• IT and SaaS businesses preparing for venture financing — investors almost always require an EU/UK/Singapore structure.
• Companies from offshore or grey-list countries for which continued operation becomes toxic from the point of view of AML and sanctions.
• Export-oriented businesses that need the customs, tax and regulatory advantages of the EU.

Key signals for action:

• Sanctions risks block partnerships.
• Lack of economic presence in target markets reduces investment attractiveness.
• The political stability of the new jurisdiction promises corporate secrecy and protection of property rights.
• The need for AML compliance for financial licenses.

The financial effect of redomiciliation is rarely limited to taxes alone. In COREDO’s real cases the main increase in ROI is driven by:

• re-establishing banking services and reducing transaction costs;
• access to European and Asian payment systems;
• lower compliance costs thanks to a clear regulatory environment;
• increase in business valuation during investments (multiples in the EU are on average higher by 15–40%).

Choosing a jurisdiction: EU, Asia or new ones

choosing a jurisdiction for relocation is a balance between the business environment, regulatory requirements and business objectives.

The most common mistake is to view redomiciliation as a “technical transfer”, without changing the management and compliance logic. In such cases the company formally changes jurisdiction but retains the old risks.

Typical mistakes we encounter:

• transfer to the EU without readiness to disclose beneficial owners;
• lack of real substance when declaring activities;
• ignoring AML requirements at the preparation stage;
• choosing a jurisdiction based on taxes rather than on banking compatibility.

In the EU, for example, the Czech Republic, Slovakia, Cyprus and Estonia lead in simplified procedures for registering legal entities. Redomiciliation in the EU is ideal for business in Europe: beneficiary and director registers are harmonized here, and a white jurisdiction ensures compliance. A solution developed by COREDO helped a manufacturing company from Asia move to the Czech Republic: the client preserved the share capital structure, adapted option programs and gained access to EU markets without double registration.

Asia attracts relocations to Singapore or Dubai: free zones offer zero repatriation taxes, corporate secrecy and asset protection. For businesses in Asia this opens export to ASEAN. At COREDO we accompanied a redomiciliation to Asia for a logistics firm from the CIS: integrating AML services minimized risks, and the new structure raised investment attractiveness.

chil scaling the business with expansion into African markets.
Compare the options in the table for clarity:

Redomiciliation steps: from preparation to launch

The redomiciliation procedure for a business requires precision. Start with an audit: check good standing, the absence of litigation, bankruptcy or debts. Notify creditors; publication is mandatory in most jurisdictions. COREDO’s practice emphasizes: 80% of refusals are due to weak Due Diligence.

1. risk analysis: We assess sanctions risks, compliance and the impact on partners. We model scenarios showing how redomiciliation and compliance strengthen reputation.
2. Document preparation: We adapt the share capital structure, registers. For redomiciliation from an offshore jurisdiction to the EU we integrate AML compliance according to FATF standards.
3. Filing and approval: In the EU – through national authorities or EUIPO. In Asia, free zones speed up the process. The COREDO team handles legal support, including legal opinion.
4. Post-redomiciliation: Tax optimization, account openings, licenses. We ensure economic presence through local offices.

Banks and regulators assess:
– continuity of the legal history;
– absence of a «break» in the ownership structure;
– alignment of the new jurisdiction with actual activities;
– quality of AML documentation and risk assessment.

Licenses and AML when relocating

financial licenses: banking, crypto, forex, payments: open global opportunities. In Poland (NPI/SPI), Estonia or Singapore COREDO accompanies from application to compliance. Our experience has shown: a cryptocurrency license in the EU requires strict AML consulting, including KYC and monitoring.

Comprehensive support at all stages

COREDO offers company registration in the EU, outsourcing, trademark protection under the Madrid Protocol. We register in the Czech Republic, the United Kingdom, Greece, Switzerland – the full range. Legal support saves time: from trademark registration to dispute resolution.

Long-term consequences? Redomiciliation strengthens corporate governance, adapts option programs and increases investment attractiveness. For businesses from the CIS, relocation to the EU addresses compliance pain points, enabling scaling.

The COREDO team will provide transparent processes, time savings and reliable results. Your success: our mission since 2016.

AML for investment companies in the Czech Republic in 2025 is no longer a formality, but a full operational framework that largely determines whether you will obtain a license, retain access to the European financial infrastructure and whether you will actually be able to scale the business in the EU, Asia and the CIS.

Over the past years I have seen funds with strong products and investment companies lose momentum, clients and money only because they underestimated three things: the real AML requirements, the expectations of regulators (FAU and ČNB) and the need to think of AML as part of the business‑model rather than a “legal overlay”.

AML in the Czech Republic for investment companies

Czech AML‑regulation for investment companies is based on several levels:

• Act No. 253/2008 Sb.
  The basic anti‑money laundering law, which sets out obligations for customer identification, identification of beneficial owners, transaction monitoring and reporting suspicious transactions (SAR/STR).
• EU AML Directives (AMLD) and FATF recommendations
  They define the framework of the risk‑based approach: a risk‑oriented approach that has become the key compliance philosophy for investment companies in Europe.
• Supervision and practice:
  • Financial Analytical Office (FAU): the Czech financial intelligence unit and the primary recipient of SAR/STR.
  • Česká národní banka (ČNB) – supervises banks, investment companies, licensed financial services, funds.

At the theoretical level everything is clear, but in reality what matters is not the names of the acts, but how this is reflected in everyday tasks: from investor onboarding to the daily monitoring of the portfolio and transactions. That’s what comes next.

New AML requirements for investments in the Czech Republic — 2025

From 2024–2025 I see three key blocks of changes that affect investment companies in the Czech Republic:

Appointment and registration of an AML contact in the FAU

For a number of companies falling under Act No. 253/2008 Sb., a requirement has been introduced to appoint an AML contact person and register them with the FAU by the established deadline (for some entities, by February 1, 2025).

Tightening of beneficiary identification

AML compliance in the Czech Republic is no longer limited to “collecting a passport and an extract”. The regulator’s real focus is on:

• identifying the Beneficial Owner (the ultimate beneficiary), taking into account complex ownership chains and trust structures;
• regular review checks (beneficiary verification frequency), not one-time KYC at onboarding;
• accuracy and timeliness of data in the Beneficial Ownership Register (corporate transparency).

Increasing automation and digitalization of AML

In the Czech Republic and across the EU, AML is increasingly shifting towards:

• digital identification of clients (e‑ID, eKYC, remote identification);
• integrations with state and commercial databases;
• the requirement for an audit trail and data lineage for blocking, escalation and SAR decisions.

KYC and due diligence for investments in the Czech Republic 2025

Basic KYC and risk‑based approach

Today it’s not enough just to collect a set of documents. A risk‑scoring model is important:

• client assessment (investor type, jurisdiction, PEP status, reputation);
• product assessment (fund type, liquidity, presence of crypto assets);
• channel assessment (online onboarding, via intermediaries, partner networks);
• geography assessment (EU, Asia, CIS, high‑risk countries).

Enhanced Due Diligence for PEPs and high‑risk jurisdictions

For Politically Exposed Persons (PEPs) and clients from high‑risk countries, formal document collection does not work. You need:

• Source of Funds and source of wealth analysis;
• detailed screening against sanctions and adverse media lists;
• understanding how the client’s profile aligns with your investment strategy.

Registration of the AML contact at FAU: checklist

A typical approach that the COREDO team has followed in recent projects:

1. Determining the role and authorities of the AML‑contact
   • access to all AML data and systems;
   • the right to escalate cases to top management;
   • participation in approving the AML policy.
2. Preparation of the AML‑contact dossier
   • a CV, evidence of experience in compliance / jurisprudence / finance;
   • confirmation of absence of conflicts of interest;
   • a description of how their role is integrated into the model three lines of defence.
3. Registration with the FAU
   • filling out the form and submitting the contact person’s data;
   • setting up internal procedures so that all SARs/STRs go through the designated channel.
4. Integration of the AML‑contact into the operational framework
   • participation in KPI reports;
   • coordination of AML audits and interaction with ČNB (if the company holds licenses).

Transaction monitoring and AI in AML at an investment company

investment company in the Czech Republic, especially one that works with a multi-jurisdictional portfolio and high-frequency operations, cannot rely only on “check-lists in Excel”.

• a rules set (rules engine) by types of operations:
  • incoming/outgoing transfers;
  • subscription/redemption of fund shares;
  • operations with crypto-assets;
• risk-scoring models for clients and transactions;
• escalation and case management system (case management).

AI and ML models against false positives

One of the main pains clients brought to COREDO was a high percentage of false positives: the system “clogs” the compliance department with false alerts, people burn out, and real risks get lost in the overall noise.

Data lineage, audit trail and GDPR

Modern AML compliance is unthinkable without:

• data lineage, understanding where data came from, how it was transformed, and on what basis the decision was made;
• audit trail, logs of all actions, status changes, escalations;
• a proper data retention policy compatible with GDPR requirements and the AML law regarding retention periods.

VASP and crypto-assets in the Czech Republic

A separate layer of issues — requirements for VASP and the crypto industry. If a fund:

• invests in crypto‑projects;
• works with tokenized assets;
• itself obtains VASP registration,

then the regulator expects:

• compliance with specific AML‑requirements for VASP;
• having an Internal AML officer with experience specifically in crypto;
• meeting minimum capital requirements (ranges are typically around €50k–€150k depending on the model and services);
• physical presence: an office, a local director, clear governance.

AML audit and interaction with the Financial Analytical Unit / Czech National Bank

Even mature teams sometimes encounter “bottlenecks”: outdated procedures, outdated risk‑models, weak PEP controls, manual processes without an audit trail. In such situations, not only diagnosis is important, but also a regulatory remediation plan, a plan of corrective measures.

1. Gap‑analysis:
   • comparison of current procedures with Act No. 253/2008 Sb., EU directives and local guidelines;
   • assessment of actual implementation (not just the presence of documents).
2. Risk prioritization:
   • quick fixes (quick wins) affecting daily operations;
   • medium‑term changes (rewriting policies, revising the risk‑model);
   • long‑term changes (IT‑architecture, automation, integrations).
3. Regulatory remediation plan:
   • step‑by‑step plan with deadlines and KPIs;
   • allocation of responsibilities: AML‑officer, CIO, lawyers, business‑units;
   • preparation of the rationale for dialogue with FAU/ČNB.
4. preparation for AML‑audit:
   • testing a sample of clients and transactions;
   • simulating FAU requests;
   • team training (including compliance culture and employee training).

Technologies, ROI and TCO in an AML Project

I usually suggest looking at three levels:

TCO (Total Cost of Ownership)

Owning an AML solution includes:

• software licenses and access to external databases (sanctions, PEPs, adverse media);
• integrations (core systems, CRM, banking interfaces, API with FAU: where possible);
• internal resources (IT team, analysts, AML officer);
• training and an annual AML audit.

Economic impact

The ROI of an AML project is not always expressed solely in direct savings. It more often manifests in:

• reducing operating costs through:
  • reducing the share of manual checks;
  • reducing false positives;
• speeding up investor onboarding, especially from the EU, Asia, and the CIS;
• reducing the likelihood of:
  • fines and sanctions;
  • account blocks by banks and custodians;
  • loss or non-renewal of a license.

AML model for the EU, Asia and the CIS: how to build it?

Many COREDO clients start with a Czech license and infrastructure, and then expand into other jurisdictions: the EU, Asia, the Middle East. It is a mistake to build local AML processes “from scratch” in every country.

• create a single AML framework, based on:
  • EU requirements (AMLD);
  • FATF standards;
  • best practice of the risk‑based approach;
• and layer local requirements (Singapore, Dubai, certain CIS countries) as add-ons.

Practical roadmap for investments in the Czech Republic

Summarizing COREDO’s experience, a practical roadmap for an investment company in the Czech Republic that wants to be ready for AML 2025 requirements and beyond looks like this:

1. Map of regulatory obligations
   • identify which specific articles of Act No. 253/2008 Sb. apply to you;
   • document obligations to the FAU and ČNB.
2. Appointment and registration of an AML‑contact
   • select a real, not a formal, responsible person;
   • register them with the FAU and integrate them into the three lines of defense.
3. Review of KYC / EDD and the beneficial ownership framework
   • ensure that Beneficial Owners are correctly recorded both in the system and in the register;
   • implement a clear periodic verification cycle for beneficiaries.
4. Modernization of transaction monitoring
   • implement or update scenario‑based monitoring;
   • if necessary, add AI/ML and XAI to reduce false positives;
   • set up a SAR/STR workflow with clear SLAs.
5. GDPR and data retention
   • review the policy on retention periods and access rights;
   • ensure a transparent audit trail and data lineage.
6. External AML‑audit and remediation‑plan
   • conduct an independent assessment;
   • prepare and implement a remediation plan;
   • prepare a readiness package for FAU/ČNB inspections.
7. Scaling strategy
   • synchronize the Czech AML framework with plans to expand into the EU, Asia, Dubai, and Singapore;
   • embed compliance by design into new products and funds.

As the CEO and founder of COREDO, I see entrepreneurs from Europe, Asia and the CIS facing the challenges of international expansion every day: from registering companies in new jurisdictions to obtaining financial licenses and ensuring strict AML compliance. Our experience since 2016, covering the EU, the Czech Republic, Slovakia, Cyprus, Estonia, the United Kingdom, Singapore and Dubai, confirms: success is built on a deep understanding of local regulations, such as 6AMLD and AMLR, and the implementation of practical solutions. In this article I will outline the key steps based on real cases from the COREDO team, so that you get a clear guide to minimizing risks and accelerating processes.

I’ll add an important caveat from COREDO’s practice: “negative outcome” during bank onboarding or licensing is almost never related to a single document. It is always a combination of factors: ownership structure + source of funds + client risk profile + quality of monitoring + manageability of compliance. Therefore, below I will analyze not the “theory of AML”, but a set of concrete artifacts that are actually checked: (1) EU banks when opening an account/correspondent account, (2) regulators during licensing, (3) auditors during an AML audit/inspection. And most importantly: I’ll show how to compile these artifacts so they work as an evidentiary basis, not as a “folder for the sake of a folder”.

Choosing a Jurisdiction: Taxes and Compliance

In reality a bank judges a jurisdiction not by the “tax rate” but by implementation risk and how controllable it is. Common rejection triggers I regularly see:

• multi-layered ownership chain without clear business logic (especially if there are offshore “layers”);
• “investor/founder” with an opaque source of wealth (high income without a provable accumulation history);
• mismatch between the geography of the funds and the geography of the business (for example, a company in the EU while the money “lives” in Asia/Middle East without explanation);
• nominal substance (there is an address but no management function and no verifiable operational reality);
• lack of a clear model: who the client is, how you make money, what the risks are and who controls them.

The COREDO team recently assisted a fintech startup from Asia with registration in Lithuania: we integrated online verification with the government platform, ensuring AML audit compliance in Lithuania and opening an account in a local bank within 3 weeks.

The Bank of Lithuania AML in 2025 strengthened priorities: mandatory transaction monitoring and PEP monitoring for all new entities. The solution developed at COREDO included preliminary due diligence for international transfers, minimizing predicate offences risks and ensuring smooth onboarding.

Mini-document package that speeds up banking onboarding in the EU (what they actually ask for)

1. Ownership pack: organizational structure (diagram), UBO register, corporate documents for each “tier” of ownership.
2. Source of Funds / Source of Wealth pack: origin of capital (contracts/dividends/sale of assets), tax returns/audit (if any), statements, accumulation logic.
3. Business model pack: products, target markets, client types, payment geography, calculation of expected turnover, list of key counterparties (top-10), money flow diagram.
4. Compliance pack: AML policy, Risk Assessment (methodology + result), sanctions/PEP screening, EDD procedure, SAR workflow, training.
5. Operations pack: substance (office/people/functions), contracts with providers (KYC/screening/monitoring), description of IT environment and access.

Obtaining Financial Licenses

Obtaining licenses for crypto, banking services, forex or payments is not a formality but a demonstration of resilience. In Lithuania the Bank of Lithuania AML requires a business plan with SAR reporting and a risk-based approach before issuance.

Practically speaking: for the regulator and the bank the “business plan” is not a pitch but a test of how well risks are managed. At COREDO we compile it in the format:

• Product scope: which services you provide and which you do not provide (especially important for crypto/payments).
• Customer risk: who your customer is (individual/legal entity), which segments are high-risk, what restrictions (for example, bans on certain jurisdictions / certain industries).
• Transaction risk: what types of transactions, what limits, what triggers enhanced checks.
• Control design: sanctions/PEP screening, EDD procedures, transaction monitoring, case management, SAR/STR reporting.
• Governance: who is the MLRO, who they report to, how the “three lines of defence” works, how often the Risk Assessment is reviewed.
• Outsourcing & vendor risk: which functions are with providers, what SLAs, how you control the quality of data and models.

Our experience at COREDO with a fintech client showed: integration of AI-driven AML scoring increased approvals from 60% to 95%, speeding up the process by 40%. We conducted compliance stress-testing by simulating peak transactions, which convinced the regulator of readiness for 6AMLD implementation.

Realistic timeline for AML implementation

• First 30 days: Risk Assessment, basic policies (CDD/EDD/sanctions), appointment of MLRO, start of screening, initial client and country risk matrix.
• 60 days: setup of transaction monitoring (scenarios, thresholds, alerts), implementation of case management, staff training, first test SAR/STR reports “for internal use”.
• 90 days: tuning false positives/false negatives, regular reports to the board of directors, internal audit plan, vendor quality control, an “audit trail” of decisions.

AML consulting: audit and monitoring

AML compliance Lithuania: a priority for everyone entering EU markets. AML audit Lithuania includes CDD, EDD and checks against FATF recommendations. The COREDO team conducts it in two stages: diagnosis (predicate offence risks) and optimization (automation). In a project for a bank we implemented transaction monitoring Lithuania with AI, providing performance metrics: coverage 99%, response time <1 min.

Which monitoring metrics banks and auditors really “love”

• Alert-to-case ratio: how many alerts turn into cases (if almost all alerts are “off” — the system is noisy).
• Case cycle time: average time to close a case and share of overdue cases.
• SAR/STR quality: share of returns/clarifications from the FIU (if such signals exist) or internal QA scoring of quality.
• False positives for key scenarios and causes (threshold/data/rule/client behavior).

At COREDO we almost always start by tuning the “top-3 noisiest scenarios” — this quickly reduces the team’s load and improves investigation quality without loss of control.

To prepare for an AML audit/inspection, it’s important to understand the mechanics of the review. The auditor almost always follows the logic:

• Design — do you have policies/procedures, and do they correspond to the risks.
• Implementation — do staff actually perform the procedures (and are there traces of this in systems).
• Effectiveness — do controls deliver results (metrics, tests, cases, adjustments).

KYC Lithuania is evolving toward eKYC standards with eIDAS identification: onboarding conversion increases by 50% without loss of security. Our approach: real-time PEP screening plus SAR reporting Lithuania according to Bank of Lithuania templates. For fintechs we minimized risks by integrating AI into Lithuanian banks’ AML systems, which increased efficiency by 35% and reduced fines from AMLA.

6AMLD Lithuania focuses on criminal liability of directors: COREDO recommends an AML officer on the board. In a crypto-business case we performed a stress test of AML compliance, identifying vulnerabilities in CFT, and adjusted policies to ensure protection against predicate offences in international transfers.

Critical moment of 2026: MLRO/AML Officer is not a “signature person”. Banks and regulators look at the independence of the function: who the MLRO reports to, can they stop a client/transaction, is there direct access to senior management, how conflicts of interest are recorded. We usually implement a simple but strong arrangement:

• The MLRO has the right to freeze/hold transactions until the investigation is completed;
• decisions are recorded in the case-management system with an audit trail;
• monthly MLRO report to management/board: risks, trends, incidents, scenario adjustments.

Support: from registration to scaling

COREDO offers a full cycle: registration, licensing, AML-compliant EU banks, account opening and reporting. In the EU banks require proof of business reputation and a business plan — we prepare them with ESG criteria. For Asia we add cryptographic security protocols.

To be as concrete as possible, here is a typical set of deliverables that we provide to the client in turnkey projects:

• Risk Assessment (methodology + final risk matrix for clients/products/countries/channels);
• AML/CFT Policies & Procedures (CDD/EDD/sanctions/PEP/monitoring/SAR);
• Onboarding playbook for the bank (structure, funds, business logic, answers to standard questions);
• Monitoring setup (scenarios + thresholds + escalation rules + investigation templates);
• Training pack (slides/tests/training log);
• Evidence pack for the audit (case examples, logs, QA reports, decision records);
• Remediation plan for 30/60/90 days if the audit/bank found gaps.

The AML regulator in Lithuania in 2025 emphasizes automated transaction monitoring — we integrate it with existing systems to ensure seamless scaling.

Typical reasons for bank refusals or compliance delays

1. Weak source of wealth: funds exist, but there is no provenance story. Solution: compile a narrative + documents + transaction sequence.
2. Insufficient substance: “a shell office”. Solution: demonstrate management function, contracts, roles, processes.
3. Unaddressed high risk: no EDD logic for PEP/sanctions/high-risk countries. Solution: EDD matrix + limits + controls on review frequency.
4. Monitoring “in a vacuum”: rules exist, but no cases/metrics/QA. Solution: evidence pack + performance indicators.
5. Too broad business model: “we do everything”. Solution: narrow the scope at the start and expand after gaining the bank’s trust.

Strategic ideas for growth

• Conduct sanctions due diligence on founders before submission; reduces rejections by 80%.
• Invest in AI for unusual patterns detection: ROI 200–300% per year.
• Prepare for AMLA focus: quarterly stress tests.
• For eKYC and digital onboarding use EU standards: preserves conversion during growth.

Questions clients commonly ask before entering the EU/Lithuania

One of the key innovations of 2026 is the mandatory digital identification of founders and the use of electronic signatures at all stages of company registration in the EU. According to the European Commission, this reduced the average time for remote registration of legal entities by 35–50%, and the number of rejections due to forged documents and nominee structures fell by more than 40% compared to 2022–2023.

The focus has shifted from the question “what has been filed in the register” to questions “who is behind the structure”, “how is governance formed” and “how transparent is the source of capital”.

That is why today the speed of company registration in the EU and the subsequent bank onboarding directly depend not on the jurisdiction as such, but on the quality of digital identification, the consistency of the corporate structure and the readiness of the business for KYC/AML checks at the level of the individual, not the paper.

New requirements for company registration in the EU in 2025

In 2025, company registration in the EU underwent a number of fundamental changes affecting both the documents for company registration in the EU 2025 and the procedure itself. These changes were the result of accumulated problems of previous years: the use of nominee structures, fictitious directors and opaque ownership chains. The EU is consistently closing these loopholes by unifying requirements between countries and reducing opportunities for regulatory arbitrage. COREDO’s practice confirms: now most EU countries require not only the standard set of incorporation documents, but also proof of source of funds, KYC questionnaires, and disclosure of information about ultimate beneficiaries in accordance with the new 2025 beneficiary disclosure requirements.

Comparative table of changes in the EU and Asia

Documents for company registration in the EU and Asia in 2025

COREDO’s experience shows that in 2025 the standard package of documents for registering a company in the EU includes:

• founding agreement and articles of association,
• proof of registered address,
• digital identification of the founders (video verification, eIDAS, BankID),
• KYC questionnaires and information about beneficial owners,
• proof of source of funds,
• electronic signatures.

Regulators expect a pre-built AML framework for them, not reactive implementation of procedures after registration.

Recommendations for registration

• Prepare a complete set of incorporation documents taking into account the new requirements for disclosing beneficiaries.
• Complete digital identification of the founders and ensure electronic submission of documents. In practice this means involving lawyers and compliance specialists before filing the documents, not after receiving requests from registrars or banks.
• Appoint a compliance officer and integrate AML services into business processes. In some jurisdictions the presence of a compliance officer is viewed as an indicator of business maturity and directly affects the speed of application review.
• Choose a jurisdiction taking into account industry requirements, tax incentives and the possibility of remote registration.
• Conduct Due Diligence on founders and partners, and check against sanctions lists.
• Prepare a business plan and the documents required to open corporate accounts at European or Asian banks.
• Implement ESG criteria and automate corporate reporting. ESG is increasingly used not only by investors but also by banks as an additional filter when assessing a company’s long-term risks, especially in the EU.

Registration in the EU — it’s no longer about documents, it’s about trust

Companies that continue to approach registration formally face the same problems: lengthy timelines, repeated requests, banks refusing to open accounts and the need to “redo” structures after registration. Those who from the start design their corporate model taking digital and AML requirements into account complete the process 2–3 times faster and without reputational risks.

Why COREDO

The COREDO team has supported international business since 2016 at the intersection of company registration, bank onboarding, licensing and AML compliance. We don’t just register legal entities – we design structures that withstand scrutiny from registrars, banks and regulators.

We:

• choose a jurisdiction based on your business model, not ‘from a list’;
• prepare corporate and beneficial ownership structures to meet 2025 requirements;
• support digital identification, eIDAS and electronic signatures;
• proactively eliminate the risk of refusals from banks and regulators;
• work with the EU, Asia and the CIS as a single ecosystem, not as fragmented markets.

If you are planning to register a company in the EU, access European banks or pursue further licensing, start with the right architecture, not with fixing mistakes.

Contact the COREDO team – we’ll analyse your case, show risks before you submit documents and build a solution that will work not only today but also after the first banking review.

As the CEO and founder of COREDO, I see every day how entrepreneurs from Europe, Asia and the CIS face the challenges of international expansion: from registering companies in new jurisdictions to obtaining financial licenses and ensuring AML compliance. Our experience at COREDO since 2016 covers the EU (including the Czech Republic, Slovakia, Cyprus, Estonia), the United Kingdom, Singapore and Dubai, where the team has carried out hundreds of projects on structuring, licensing crypto and payment services, as well as AML audits. In this article I will explain how to turn these difficulties into strategic advantages, drawing on practical cases and proven approaches.

The absence of this logic most often leads to negative audit findings, even when the documents are correct.

Choosing a jurisdiction for registration and bank onboarding

Registration of a legal entity abroad is not just a formality but a foundation for scaling. In 2025, attractive options remain Cyprus, the UAE (especially Free Zones), Singapore and Estonia: here low bureaucracy, remote registration and access to EU/Asian markets combine. For example, in Cyprus the COREDO team recently registered a holding for a CIS client in 5 days, with a full document package including address verification and beneficiary data. This allowed the client to obtain residency through business investment and open an account in an EU bank without delays.

How banks assess a jurisdiction during an AML audit

Cyprus, Estonia and Singapore are perceived as “transparent” jurisdictions with clear AML/CFT rules. At the same time, structures in UAE Free Zones without substance automatically fall into the high-risk segment, regardless of business volume.

At COREDO we always build this logic from the start so that AML audit does not turn into a process of excuses.

Why a lack of substance is a key trigger for a negative AML audit

Lack of real presence is one of the most frequent reasons for negative AML audit conclusions. Banks view such structures as a tool to circumvent controls, even if the business is legal.

Checklist for registration in the EU and Asia (based on COREDO projects):

• Define the purposes: holding, trading or a license (crypto/payments).
• Collect documents: passport, proof of address, UBO data (source of funds, PEP declaration).
• Check substance: office, local director (for the EU: mandatory since 2024).
• Prepare for KYC compliance: banks require a full ownership chain.

Time savings are real — the solution developed at COREDO reduces the process to 2 weeks for Cyprus or Dubai.

Obtaining financial licenses: crypto and payments

Licensing: the next step after registration. In the EU (Estonia, Cyprus) crypto licenses are issued under MiCA, in Singapore: MAS, in Dubai: VARA. The COREDO team conducted an AML audit for a client before applying for a payment license in Lithuania: we identified vulnerabilities in transaction monitoring and fixed them within 30 days, which sped up approval by 3 months. Preparation for an AML audit includes an AML risk map and a self-assessment according to FATF standards – this is the standard for bank onboarding.

Why an AML audit is a mandatory step before licensing

At COREDO we use a preliminary AML audit as a tool to accelerate licensing: the regulator sees that the company understands the risks and controls them, rather than reacting after the fact.

For forex and banking services in the Czech Republic or Slovakia the key: a risk-based AML approach. COREDO’s practice confirms: the integration of GNN (graph neural networks) and FHE (fully homomorphic encryption) into an AML/CFT program increases audit ROI up to 300% through monitoring automation. A client from Asia received a crypto license in Estonia after our external AML audit, where we implemented digital onboarding via eIDAS and the MAS framework, reducing verification time to 3 weeks.

When AML technologies actually work

Using AI in AML makes sense only with correctly built process logic. Automation does not fix mistakes, it scales them.

AML compliance for a sustainable business

Company AML audit – not an option, but a necessity before bank onboarding. Banks check source of funds, PEP status and sanctions lists. Our experience at COREDO has shown: ignoring GNN in AML leads to rejections in 40% of cases, while implementation automates detection of vulnerabilities.

Typical reasons for a negative AML audit

In COREDO’s experience, negative AML audit findings are most often related to the following factors:

• absence of a documented decision trail;
• formal approach to EDD;
• mismatch between risk scoring and the client’s real profile;
• weak integration of AML and IT systems.

How to conduct an AML audit in 30 days? Steps from COREDO’s practice:

1. Self-assessment of risks: create an AML risk map, monitor FATF lists.
2. External AML audit: check transactions, whistleblowing procedures and GDPR integration with AML.
3. Corrective action plan: automate reporting, implement transaction monitoring in the AML/CFT program.
4. legal opinion on compliance: confirms readiness for licensing.

Realistic timeline for a 30-day AML audit

In reality, a 30-day AML audit is possible only with a clear work structure:

• days 1–5: data collection and interviews with key personnel;
• days 6–15: transaction analysis, KYC, sanctions and PEP;
• days 16–25: development of a remediation plan;
• days 26–30: report preparation and legal opinion.

At COREDO we use precisely this format, which allows companies to approach banks and regulators with a ready position.

For FinTechs from the CIS: integrate eIDAS onboarding for the EU and MAS Digital Onboarding for Asia.

Support: from audit to scaling

COREDO provides a full cycle: registration, licenses, KYC compliance, annual AML audit. We hire local lawyers and accountants, and prepare CARF reporting (automatic data exchange).

The link between AML audit and scaling a business

A mature AML system directly affects a company’s ability to scale. Banks, investors and partners view results of an AML audit as an indicator of how well the business is governed.

In COREDO projects, it was precisely a successful AML audit that allowed clients to enter new markets without repeat checks and delays.

Checklist for a company’s readiness for an AML audit

Before starting an AML audit, the company must ensure that:

• the ownership structure is transparent;
• sources of funds are verified;
• the AML officer is involved in operational processes;
• IT and AML are integrated;
• employees are trained in the risk-based approach.

Important to understand: entering international markets is not a one-off company registration, but a business architecture. The mistake of most entrepreneurs is that they treat registration as a “legal start” rather than as the basis for bank onboarding, licensing and further scaling.

Choosing a jurisdiction for business

There is no universal “best” jurisdiction in international practice — there is one suited to a specific business model. At COREDO we always start with classifying the business:

• IT / SaaS – priority for Estonia, Cyprus or the United Kingdom with a focus on IP structure and venture appeal;
• Trading and brokerage – Cyprus, Czech Republic, United Kingdom with licenses and access to EU payment rails;
• FinTech / payments – Lithuania, Singapore, UAE with strict AML and capital adequacy;
• Crypto / Web3 – MiCA jurisdictions in the EU or VARA in Dubai;
• Holdings and investments – Cyprus, Netherlands, UK with a network of DTT agreements.

Consider the tax regime, reporting requirements and geopolitics.
In practice, it is the bank onboarding that becomes the main “bottleneck” of international business. EU and Asian banks assess not only the country of registration, but also:

• the source of funds;
• transparency of the beneficial ownership structure;
• the economic rationale of the operations;
• the company’s readiness for AML controls.

Steps to register a company

Registration is not bureaucracy, but a strategic process.
The most common registration mistakes for companies abroad that the COREDO team encounters:

• registering “in one’s own name” without considering future investors or banks;
• lack of substance for declared international activity;
• template articles of association without corporate logic;
• ignoring AML requirements before applying for an account or license.

The solution developed by COREDO simplifies it to 4 stages.

Stage 1: Document preparation. Collect the founder’s passport, proof of address, and questionnaire. In jurisdictions like the United Kingdom or Estonia an online form is sufficient; in Dubai – notarised copies. Our experience shows: document errors can extend the process by weeks. We always verify translations and the apostille under the Hague Convention.

Stage 2: Submission and approval. In the Czech Republic submit to the Commercial Register online, in Singapore – via ACRA (1-2 days). For branches of foreign entities, as in the EU, prepare a board resolution and the articles of association. The COREDO team has completed 50+ such registrations, including the notification procedure in Slovakia, where we simultaneously make changes to the registers.

Stage 3: Bank account and address. Open a corporate account – in Estonia through LHV, in Dubai at Emirates NBD. Rent a registered office: in Cyprus from 500 € / year. COREDO’s practice confirms: integrate this with registration to avoid delays.

Stage 4: Post-registration. Obtain VAT, EIN, or an equivalent. In Singapore, GST registration. We support through to full operational readiness, opening acquiring for international payments.

Obtaining financial licenses: crypto and payments

Licenses are a barrier to entry, but also a competitive advantage. From an economic point of view, a license is not only a regulatory requirement but also a factor in increasing business value. In our observations, having a license increases a company’s valuation on average by 20–50%, and for FinTech and Crypto – up to 2–3 times compared to unlicensed counterparts.

Moreover, a license simplifies:

• Opening bank accounts;
• connecting to international PSPs;
• attracting institutional investors;
• scaling in other jurisdictions.

At COREDO we specialize in crypto (VASP in Estonia under MiCA), banking (EMI in Lithuania), forex (FCA in the UK) and payments (MAS in Singapore).

Process: regulator analysis (CySEC requires capital adequacy 730k euros), business plan, AML/CTF framework, fit-and-proper tests. Our approach is modular: we develop policies according to FATF Recommendation 15, integrate KYC/EDD. The COREDO team has obtained 20+ licenses, including a payment license in Dubai (DFSA) for a client from the CIS. We accelerated the process by 40% by providing ready-made templates compliant with PSD2 in the EU.

AML Consulting: protection against risks in real time

AML: not a formality, but a foundation of trust. Many entrepreneurs view AML as a cost. However, in reality a properly built AML framework reduces operational risks and accelerates growth.

Companies with transparent AML:

• experience fewer account blocks;
• pass bank checks faster;
• expand into new countries more easily;
• are protected from reputational losses.

Comprehensive support at all stages

COREDO offers end-to-end: from registration to annual compliance. Save time: we take on the routine — reporting, renewals, tax optimization (for example, IP-box in Cyprus with 2.5% tax). Trustworthy advice: choose a partner with 8+ years of experience in your regions.

At COREDO we build long-term relationships, turning challenges into opportunities.

As CEO and founder of COREDO, I see every day how entrepreneurs from Europe, Asia and the CIS face the challenges of international expansion: from registering companies in new jurisdictions to obtaining financial licenses and strict compliance with AML requirements. Our experience at COREDO since 2016 covers hundreds of projects in the EU, including the Czech Republic, Slovakia, Cyprus, Estonia and Lithuania, as well as Singapore and Dubai. We help turn these complexities into competitive advantages, ensuring transparency, speed and full compliance.

How the Bank of Lithuania Views Investment Companies in 2026

Why Lithuania Leads in Investments in 2026

Why AML in Lithuania is stricter than in most EU countries

Typical mistakes of investment companies in KYC in Lithuania

The role of the MLRO in investment companies: formality or control

AML officer and MLRO in investment firms

AML for investment companies with crypto exposure

KYC and compliance for investment companies

• Step: Automate digital identification via eKYC with cryptographic protocols.
• Step: Implement source-of-funds verification for investments in Lithuania, checking the transaction chain for compliance with CFT procedures.
• Step: Appoint an AML officer for investments and set up automated AML transaction monitoring in Lithuania with anti-fraud systems.

How the Bank of Lithuania assesses the effectiveness of an AML system

What happens after a negative AML inspection in Lithuania

AML systems: risks and ROI

The connection between AML and scaling an investment business

Comprehensive support: registration and licensing

Checklist for an investment company before a Bank of Lithuania inspection

• the ownership structure is transparent and justified;
• sources of funds are documented;
• the AML officer is actively involved in processes;
• the IT infrastructure complies with DORA;
• the AML and business strategies are aligned with each other.

Partnership with COREDO

As CEO and founder of COREDO, I see every day how entrepreneurs from Europe, Asia and the CIS face challenges when entering international markets. Our experience since 2016 in company formation, obtaining financial licenses and AML consulting allows the COREDO team to turn these complexities into strategic advantages. In this article I will break down the key aspects based on practice: from choosing a jurisdiction to the assessment by EU banks of investment structures, so that you get a clear guide for your business.

How EU banks really view investment structures

In practice this means that even a correctly registered company can be refused if the bank does not understand the sources of income, the role of the SPV or the economic rationale for the risk allocation. At COREDO we always start from the bank’s perspective, not the applicant’s — this is exactly what shortens account opening times.

Choosing a jurisdiction: speed, taxes, EU banks

Registering a company abroad begins with analyzing your goals, whether seed venture projects or creating investment structures for scaling. The COREDO team always assesses criteria: level of bureaucracy, tax rates, possibility of remote onboarding and access to banking services. In 2025 the leaders remain Cyprus, UAE (Dubai), Estonia and Singapore: jurisdictions where we have successfully registered dozens of companies.

Why, for EU banks, a jurisdiction is not about tax but about a risk profile

For example, Cyprus is perceived by EU banks as a predictable jurisdiction with a clear judicial system and a mature regulator, whereas structures with similar taxes outside the EU require significantly more Due Diligence. That is why at COREDO we often use Cyprus or Estonia as a “trust anchor” for international groups.

In Cyprus, for example, the process takes 5–10 days: you submit the constitutional documents, proof of address and data on beneficial owners. This opens the doors to European regulation with flexible offshore advantages, including residency through investment. COREDO’s practice confirms: for holding structures a corporate tax of 12.5% is ideal here without double taxation thanks to treaties with 60+ countries. In Dubai Free Zones provide 100% foreign ownership and zero corporate tax, with registration in 3 days — we recently launched a client’s payment company exactly like that, enabling integration with EU banks via passporting.

Substance as a key factor in banks’ assessment

Since 2024 EU banks practically do not consider investment structures without confirmed substance. It is not only about an office or a director, but about the actual center of decision-making.

Estonia and Singapore are suitable for fintech: e-Residency allows online registration, and we help meet substance requirements (a real office, local staff) since 2024, when they were tightened. Our approach: first Due Diligence of your current structure, then selecting a jurisdiction based on ROI calculations and risks. A client from Asia, for example, registered an SPV in Cyprus for Series A venture financing, minimizing risk isolation and obtaining an EU bank account in 2 weeks.

How a license affects the banking decision

That is why structures with an EMI, AIFM or VASP license pass bank onboarding faster than non-regulated investment companies. At COREDO we use Licensing as a tool to accelerate banking decisions, not only as a regulatory requirement.

Obtaining financial licenses: crypto and payments

financial licenses – the next step where many lose time. The COREDO team specializes in crypto licenses (VASP in Cyprus), banking, forex and payment (EMI/MFI in the EU). Regulatory requirements such as AIFMD for EU investment funds we review at the planning stage.

For AIF/UCITS or ZISIF §15 in Czechia/Slovakia a minimum capital is required (from 125,000 EUR), a transparent ownership structure and an AML check. COREDO’s practiceshows: EU banks approve faster if ESG criteria are integrated immediately: the share of green assets under the EU Taxonomy.We helped the client’s fund move from ZISIF §15 (asset limit 100 mln EUR) to an AIFMD umbrella fund, securing EU passporting and access to qualified investors without changing the regime.

What EU banks check first in investment funds

When assessing investment funds, EU banks focus on three aspects:

• transparency of ownership and control;
• alignment of the investment strategy with the stated risk profile;
• the fund’s ability to manage liquidity and conflicts of interest.

In practice this means that even a formally permissible structure can be rejected if the bank does not see a clear link between the fund’s strategy and its operating model.

In Singapore, an MAS license for payments takes 4–6 months; the solution developed at COREDO includes KYC/AML from the start. For crypto in Cyprus, CySEC requires Due Diligence of beneficiaries and an investment assessment — we perform it according to international standards, focusing on the business reputation of the founders and corporate governance.

AML consulting for EU banks

AML checks are a pain for 90% of clients seeking accounts with EU banks. Banks have tightened KYC: they require data on beneficial owners, sources of funds and ownership structure. Our experience at COREDO confirms: transparency is everything here. We conduct internal Due Diligence according to FATF standards, including checks for corporate conflicts and non-financial indicators.

Typical reasons EU banks refuse on AML grounds

According to our statistics, most EU bank refusals are not related to the client’s geography but to opaque sources of funds and complex ownership structures without an economic rationale.

Example: a client from the CIS was creating a multi-strategy platform in Estonia. EU banks (including Lithuania and the Czech Republic) requested AML checks in the EU investment structures. The COREDO team prepared a report assessing the ownership structure (dispersed vs concentrated), the GAR coefficient for green assets and proxy metrics based on the precautionary principle. Result: the account was opened, ROI exceeded 15% in a year.

ESG as a factor in bank trust, not marketing

For EU banks ESG is a tool to assess sustainability, not a PR indicator. What is checked is not the declaration but the compliance of the investment portfolio with the technical criteria of the EU Taxonomy.

For securitization of assets (real estate, pools of debt claims) we add unit liquidity and financial resilience. In the EU the Taxonomy requires technical criteria for six environmental objectives: we calculate the share of revenue from sustainable activities, ESG capital expenditures and operating expenses, avoiding greenwashing.

Support from registration to scaling

COREDO provides the full cycle: after registration: tax number, reporting, account openings. For investment structures we conduct investment assessments for EU banks: ROI calculations taking into account AIFMD requirements, risk management and ESG factors. A client with real estate development projects in Cyprus used our SPV structure for risk isolation; EU banks approved financing from the European Investment Bank (EIB) on a four-level scale, focusing on the quality of the project cycle.

Checklist: how to prepare an investment structure for an EU bank assessment

Before approaching an EU bank an investment structure should answer the key questions:

• is the logic of ownership and management clear;
• are the sources of funds verified;
• does the strategy correspond to the fund or SPV;
• is there substance and risk control;
• are AML and ESG integrated into the operating model.

The absence of any of these elements almost guarantees a refusal or months-long due diligence.

Strategic ideas for success

To pass EU banks’ Due Diligence:

1. Provide an ownership structure with a minimum contribution of 125,000 EUR for qualified investors.
2. Integrate the ESG taxonomy: target: 50%+ share of green assets, symmetric GAR.
3. For venture use an SPV for seed/Series A, increasing liquidity through securitization.
4. Scale without AIFMD changes via an umbrella fund.

The COREDO team has already implemented 200+ projects: from crypto licenses in Dubai to EU banks for sustainable investments. We save you time by offering transparent processes and support at all stages. Contact us – we’ll turn your idea into a working structure with a high ROI.

Greetings — I am the CEO and founder of COREDO. Over nine years, my team and I have helped hundreds of entrepreneurs from Europe, Asia, and the CIS register companies in key jurisdictions, obtain financial licenses and build robust compliance. Today the focus is on sanctions-related AML in the EU, a topic that determines business survival in cross-border operations. Regulators are tightening control, especially with the launch of AMLA (Anti-Money Laundering Authority) on 31 December 2025, and COREDO’s experience shows: those who implement a risk-based AML approach in advance save time and avoid fines.

Sanctions control for international business

EU AML regulation is evolving under the influence of the Sixth Directive (6AMLD), which will come into full force on 10 July 2027. The key change in 6AMLD is personal criminal liability for directors and beneficiaries for circumventing sanctions and facilitating money laundering. Formal delegation of compliance no longer protects: regulators assess actual control and management involvement.

Imagine a client from Singapore planning payments to the EU. The COREDO team conducted risk profiling and identified a connection to politically exposed persons (PEP) through a chain of beneficiaries. We adjusted the structure, implemented monitoring of suspicious transactions and ensured compliance with 2025 KYC requirements. Result: the account was opened without delays, and the client obtained a license for payment services in Estonia.

Banks’ sanctions control focuses on payment structuring (smurfing) and indirect financing of sanctioned persons. Special attention is paid to operations that do not formally violate sanctions but create an economic effect in favor of sanctioned persons.

KYC and EDD in 2025

KYC verification of clients is now mandatory for all legal entities; KYC is no longer considered an “entry” procedure. In 2025 banks and regulators expect a continuous KYC process where the client profile is updated with every material change in activity or geography of operations.

How to apply the new EU KYC requirements to clients in 2025? Implement periodic KYC information reviews, once a year for standard clients, quarterly for high-risk ones. The transition period until 2027 allows updating databases over 5 years, but COREDO recommends starting now to avoid peak loads.

AMLA Powers, Supervision and Fines

AMLA will take direct supervision over the largest EU banks, applying a risk assessment methodology for direct supervision. Powers include administrative measures and fines: up to 10% of annual turnover or €10 million for the first violation.

The solution developed at COREDO for an Estonian fintech integrated a risk matrix taking AMLA fines into account. We configured transaction monitoring systems to detect anomalies such as payment structuring, and the client successfully obtained a crypto license, avoiding CFT (Countering the Financing of Terrorism) risks.

Banks block such transactions under a decision of the Council (CFSP), requiring Suspicious Activity Reporting (SAR).

Risk-oriented approach: assessment and monitoring

Risk-oriented AML, the basis of compliance requirements for banks. In practice, a risk-oriented approach does not mean complicating processes. On the contrary, it allows reducing the burden on low-risk operations and focusing resources where the likelihood of sanctions violations is truly high. Steps for implementation:

1. risk assessment (Risk Assessment): profile clients by geography, transaction type, and PEP status.
2. CDD/EDD: basic checks + enhanced checks for high-risk cases.
3. Transaction Monitoring: algorithms based on GNN (Graph Neural Networks) and FHE (Fully Homomorphic Encryption) detect money laundering networks.
4. Staff training and internal policies.

How to implement without complications? Start with automation: COREDO integrates ready-made platforms adapted to the EBA (European Banking Authority).

COREDO Case Studies: real solutions

• EU registration with an AML focus. A client from Asia opened a company in the Czech Republic. The COREDO team conducted KYC for legal entities, confirmed substance and opened an account despite a complex beneficial ownership profile.
• Obtaining a payments license in Cyprus. Integrated monitoring for 6AMLD, mitigated risks of blocking sanctions: license in 3 months.
• AML consulting for Dubai. For a holding structure we set up EDD for cross-border payments, avoiding AMLA fines.

These examples demonstrate: COREDO addresses registration, Licensing and AML compliance comprehensively.

GNN, FHE and automation trends

Money laundering volumes are 2-5% of global GDP, fines are growing. ROI from AML systems: payback in 12-18 months due to reduced risks.

Action plan for 2025-2027

1. Audit current KYC: verify beneficiaries, update to 2025 standards.
2. Implement risk profiling and monitoring.
3. Train the compliance office for AMLA supervision.
4. Document everything: regulators examine risk-related decisions.

Criteria for choosing a jurisdiction

Within COREDO this stage is called pre-jurisdictional audit. We model not only company registration but its further life: account opening, interactions with banks, the tax burden after 12–24 months and the possibility of obtaining licenses or investments.

• Tax regime. Look for rates from 0% in UAE Free Zones or 1% in Georgia for small businesses. Avoid double taxation through treaties – Cyprus offers special regimes for holding companies.
• Speed and bureaucracy. Serbia and Georgia: 3–7 days online, UAE: 3 days in a Free Zone.
• Banking services. A local account is opened automatically upon registration in the same jurisdiction.
  Important to understand: “automatically” does not mean “unconditionally”. Banks in Serbia, the UAE and the EU conduct their own AML onboarding. We prepare the package for the bank in advance: description of the business model, sources of funds and payment scenarios to avoid refusals and freezes at the start.
• Substance requirements. In the EU (Cyprus, Czechia, Estonia) since 2024 an office, employees and local reporting are required.
• Access to licenses. The UAE and Cyprus are ideal for payment services, forex and crypto.

Company registration: step-by-step plan

The process is standard, but details depend on the country. It is precisely the details that most often “break” projects: an incorrect company form, an unsuitable type of activity on the license, or errors in beneficiary data. These issues are hard to fix after registration, so we always account for them at the planning stage. Here is a universal algorithm from COREDO’s practice:

1. Choose the form. Sole proprietorship (IP) for simplicity, LLP/LLC to protect assets — personal liability is excluded.
2. Gather documents. Passport, proof of address, articles of association, beneficiary details. We prepare them to meet banks’ KYC requirements.
3. Submit an application. Online to the registry: Serbia – Agency, Georgia: State Registry, UAE through a Free Zone.
4. Open an account and obtain numbers. Tax ID and license are issued automatically.
5. Register as a taxpayer. In the UAE — first year, 6–18 months.

Obtaining financial licenses: crypto and forex

Licenses: the next level. obtaining a license practically always requires a properly registered company. A mistake at the first stage – choosing the ‘wrong’ jurisdiction – makes licensing either impossible or excessively expensive. Without them, business in fintech, trading or payments is impossible. COREDO’s practice confirms: Cyprus and the UAE lead in speed.

• Crypto and VASP. Cyprus (CySEC) – 3–6 months, requires an AML policy. UAE VARA – 2 months in a Free Zone.
• Banking and EMI. Estonia and Lithuania for the EU, Singapore for Asia – focus on capital adequacy and risk-weighted assets.
• Forex and payments. Czechia and Slovakia offer access to the EU without strict substance requirements.

AML consulting: what it is and why it’s needed

The solution developed by COREDO includes:

• Development of an AML policy with a risk assessment.
• Staff training on FATF and local regulations.
• Integration of software for transaction monitoring.

Post-registration support

COREDO case studies: real results

• Serbia for a CIS client. Opened an LLC online, integrated with EU banks. Tax savings of 40%, turnover doubled.
• UAE Free Zone for a trader. Obtained a crypto license, 0% tax. The client entered Asian markets in 2 months.
• Cyprus holding for an EU business. Substance + EMI license. Access to venture capital and the Schengen area.

Why 2025 Is a Turning Point for Company Registration

Choice of jurisdiction: strategy

Why these jurisdictions? Because they offer what a growing business really needs:

• Serbia attracts entrepreneurs with the simplicity of the registration process and the ability to operate online. Our COREDO team has executed projects where Serbian jurisdiction became an ideal entry point for European expansion thanks to low administrative barriers and transparent rules for foreigners.
• UAE, this is a completely different level. Here you can register a company in a Free Zone or on the Mainland. Free Zones allow 100% foreign ownership, corporate tax is almost absent, and registration takes as little as 3 days. Mainland registration offers a simple and transparent tax regime starting from 1% for small businesses, simplified reporting and opening a bank account. The registration process involves vetting of the applicant and their business, which usually takes up to several days.
• Georgia impresses with its speed and accessibility. To open a business in Georgia, you need to register on the State Registry website, complete online identification and choose a business form. Fast online registration and no requirement for the owner to be a tax resident make this jurisdiction ideal for startups.
• Cyprus is a unique combination of European regulation and flexible advantages. Special tax regimes for holding structures, simple reporting and English-language support create a favorable environment. Cyprus also provides residency through business investments: the opportunity to open a company, invest in the economy and obtain a residence permit. Processing takes 5–10 days.

Documentary basis: from simple to complex

• founding agreement and articles of association
• proof of registered address
• digital identification of founders (video verification, eIDAS, BankID)
• KYC questionnaires and information on beneficiaries
• proof of source of funds
• electronic signatures

This is not just a bank requirement; it reflects the global trend of tightening control and reducing AML risks in the financial system.

AML compliance: from theory to practice

• Customer Due Diligence (CDD) – basic verification of clients and partners
• Enhanced Due Diligence (EDD) – enhanced checks for high-risk clients and transactions
• Continuous KYC – continuous monitoring and updating of customer information
• PEP screening, checks against lists of politically exposed persons
• Sanctions screening – checks against the sanctions lists of the FATF and other authorities

• a designated AML officer responsible for compliance
• internal policies and procedures that comply with FATF recommendations
• a transaction monitoring system capable of detecting suspicious activity
• an AML training program for staff
• documentation confirming the origin of funds and the founders’ source of wealth

Differences between the EU and Asia

What to do after registration

COREDO’s strategic approach: how we help

1. Strategic planning
   We start not with documents, but with understanding the client’s goals. What business do you want to create? In which countries do you plan to operate? What level of risk are you willing to accept? What tax incentives do you need?
   Based on this analysis we recommend the optimal jurisdiction and company structure. For example, if you plan to work with cryptocurrency investments, we recommend choosing a jurisdiction that has clear MiCA requirements and a developed infrastructure for crypto business.
2. Due diligence and AML preparation
   We conduct enhanced due diligence on all founders and beneficiaries, checking them against sanctions lists and databases (Dow Jones, LexisNexis, World-Check). We also help prepare documentation proving the origin of funds and source of wealth.
   At the same time we develop AML policies and procedures that will comply with FATF requirements and local regulators. This includes appointing an AML officer, developing a staff training program and implementing a transaction monitoring system.
3. Registration and licensing
   We prepare all necessary documents and submit the application to the relevant authorities. We also coordinate the process with banks and payment systems to ensure a smooth opening of the corporate account.
4. Ongoing support
   After registration we continue to support the client. We assist with tax reporting, regulatory reporting, updating AML policies in accordance with changes in legislation and FATF recommendations.

Examples of solving complex problems

Example 1: Fintech company with foreign investors

Example 2: investment fund with a global structure

Example 3: Company with a high-risk profile

Key takeaways and recommendations

1. choice of jurisdiction: it’s a strategic decision that should take into account not only taxes but also the regulatory environment, the availability of banking services, and compliance with international standards.
2. AML compliance is not just a regulatory requirement; it’s the foundation of your business. Invest in it from the outset, and you’ll avoid costly problems down the line.
3. Document preparation is a critical success factor. Make sure all documents are prepared correctly and fully disclose information about beneficiaries and the source of funds.
4. Work with an experienced partner who understands local regulations and can tailor the process to your specific needs.
5. Don’t assume that registration is the finish line. It’s the start of a long-term journey that requires ongoing attention to compliance and adaptation to changes in legislation.

Conclusion

Our mission at COREDO: to help you overcome this complexity and create a sustainable, compliant structure that will serve as the foundation for your global expansion.

I welcome you as the CEO and founder of COREDO. Since 2016 our team has been helping entrepreneurs from Europe, Asia and the CIS build reliable structures abroad: from registering companies in the EU and Singapore to obtaining crypto-licenses in Dubai. Today I want to explain how a Legal Opinion (legal opinion) addresses real challenges: difficulties with company registration, licensing and AML compliance. Our experience at COREDO confirms: it is not a formality, but a strategic asset that saves time, minimizes risks and speeds up access to financing.

This case is typical for the EU: without a Legal Opinion the regulator is forced to interpret the documents and the business model on its own, which almost always leads to additional requests and pauses. A well-prepared opinion removes these uncertainties in advance and shortens the regulatory cycle many times over.

When a Legal Opinion Is Required

In 2025, company registration rules in the EU and Asia tightened: mandatory digital identification of founders, enhanced KYC and screening against sanctions lists. A Legal Opinion becomes mandatory when the regulator assesses a high-risk business: investment funds, forex brokers or crypto exchanges.

For one client we prepared a Legal Opinion for a license, integrating the standards of LMA (Loan Market Association) and ISDA (International Swaps and Derivatives Association). This confirmed the transparency of funding sources and reduced the risks of transaction disputes.

In Asian jurisdictions a Legal Opinion often serves to confirm that digital identification and remote governance procedures comply with local law and international AML/CFT standards. Without it, remote models are extremely difficult to scale.

This table reflects real cases: the COREDO team always adapts the opinion to the specific regulatory licenses of capital markets.

Legal Opinion during due diligence

For venture capital in the EU, a Legal Opinion for venture capital integrates verification of the company register and the tax authority. Ignoring this risks the ROI: practice shows long-term risks when issuing securities without an opinion reach 25% due to challenges to transactions.

Legal opinion on licensing crypto, forex and payment services

obtaining financial licenses: a pain for many. A Legal Opinion for crypto licensing is mandatory when scaling crypto services: the regulator checks AML policies and compliance for crypto exchanges. In crypto and fintech projects, a Legal Opinion additionally records the company’s position on the legal nature of digital assets, the liability of operators, and the applicable AML rules. This is especially important in jurisdictions where regulatory practice is still being formed. In Dubai, VARA requires an AML Legal Opinion to confirm risk assessment methodologies and the jurisdiction’s case law.

Payment service providers in Slovakia require a Legal Opinion for AML requirements. We integrated ESG criteria and automated reporting, ensuring cross-border transactions without disruptions.

The role of a legal opinion in registering legal entities abroad

Registration of a legal entity in the EU in 2025: digital identification, eIDAS signatures and KYC for high-risk businesses. A Legal Opinion for registering an EU legal entity confirms corporate status and minimizes legal risks. For a client from Asia we prepared a Legal Opinion on corporate status before opening in the Czech Republic; the process is remote, without visas.

In Asia (Singapore, Dubai) a Legal Opinion helps with foreign founders: verification of business immigration through SPV structures. In CIS regions, like Georgia, we combine it with tax incentives.

Legal Opinion: ROI and long-term support

LMA and ISDA standards in a Legal Opinion help minimize risks in cross-border transactions. When is a Legal Opinion mandatory to confirm corporate status in cross-border transactions? Always, when verifying authority and the enforceability of a contract. Ultimately a Legal Opinion is not an expense, but an investment in business governance. It shortens timelines, reduces regulatory and banking risks, and increases trust from investors and partners. That’s why at COREDO we recommend preparing a legal opinion not “on request”, but in advance — as part of a strategy for entering international markets.

(Total length: about 10,500 characters including spaces.)

I welcome you as the CEO and founder of COREDO. Over nine years my team and I have helped hundreds of entrepreneurs from Europe, Asia and the CIS register companies in key jurisdictions, from the Czech Republic and Cyprus to Singapore and Dubai, and successfully complete bank onboarding. Today we’ll examine, why EU banks refuse even licensed companies, and share proven solutions so you save time and avoid account freezes.

This is why a license by itself does not guarantee account opening: for the bank it is only one element of the overall risk picture, not a free pass.

Reasons for rejection during bank onboarding

Imagine: you register a company in Estonia or the Czech Republic, obtain a license for payment services, but the bank blocks the account application. Our experience at COREDO shows that in 70–90% of cases the issue is the Legal Opinion, a legal opinion that analyzes corporate registers, tax liabilities, licensed activities and AML aspects. EU banks, following EBA guidelines 2024-2025, require a complete package: a flawless opinion with an apostille, confirmation of UBO and source of funds.

We regularly see legal opinions that describe the company abstractly, without tying it to specific operations and jurisdictions. For a bank this is a critical drawback: if the document does not explain why this particular company in this structure performs these specific payments, it is perceived as formal and useless.

The COREDO team recently assisted a client from Singapore with a Pte Ltd license. EU banks refused due to cross-border AML risks: the logic of cross-border payment flows from Asia. We conducted a forensic UBO analysis, checked against the ACRA registry and notarized the chain of ownership. Result: the account was opened in a Czech bank within 14 days, without EDD delays.

Another trap: shelf companies or ready-made companies older than 5 years. COREDO’s practice confirms: 40% of AML onboarding failures are related to dormant status, where governance analysis reveals gaps in actual control. Regulators require an AML audit before onboarding, especially for high-risk profiles.

UBO verification and source-of-funds checks to prevent account blocking

UBO (Ultimate Beneficial Owner), ultimate beneficiaries: this is the foundation of KYC Due Diligence. Non-compliance with public registers leads to onboarding refusals and EDD. At COREDO we always start with a full verification: declarations of control, a forensic audit of the chain, confirmation of source of funds through bank statements and contracts.

One case: a company from Dubai with a forex license faced onboarding refusal in Slovakia. FATF risks from grey list jurisdictions triggered the block. The solution developed at COREDO: a strategic business plan with evidence of economic presence, integration of GDPR data protection and an AML audit. The account was activated, and foreign trade operations increased by 30% without fines.

Source of funds often becomes a trigger for account blocking. A common mistake by companies is limiting themselves to declarations of origin of funds. For banks this is not enough: a verifiable chain of documents is required, showing the link between business activity, contracts, receipts and the distribution of funds. The absence of even one link is interpreted as increased risk.Banks request evidence: not just declarations, but the full chain from supplies to payments. Under AMLA 2025, a deep audit is mandatory for PEP onboarding, we integrate it into onboarding, reducing risks by 80%.

EDD for shelf companies and 6AMLD

High-risk clients: PEPs, companies from Asia with AML non-compliances or ready-made companies: require EDD (Enhanced Due Diligence). The 6AMLD directive strengthens AML for payment providers and card issuance: banks block if there is no forensic analysis. Our approach at COREDO: we combine digital KYC 2025 with notarization, minimizing blocking metrics.

Practical example: an Estonian fintech with a shelf company from the Czech Republic. Bank refusal due to weak corporate governance. The COREDO team conducted a governance analysis, updated the articles of association, confirmed substance (office, staff). Now the client issues cards under 6AMLD. This example shows that bank onboarding problems are rarely fatal. In most cases they point to managerial and structural weaknesses that can be fixed before the next submission – provided the company is ready to rebuild governance and AML frameworks.

Your strategic steps

• Invest in a Legal Opinion in advance: a full registry analysis reduces rejections by 70-90%.
• Conduct an AML audit: mandatory for scaling foreign economic activity (FEA) in high-risk zones.
• Manage UBO and source of funds: forensic EDD for shelf companies prevents loss of operations.
• Integrate governance into KYC: the key to fintech expansion into Estonia or the Czech Republic.

The COREDO team implements this at every stage: transparently, with reporting and support. We acknowledge the challenges; regulations are tightening, but with our experience you will scale your business without losses.

Contact us if you need details about your case. Together we’ll build a reliable structure for the EU, Asia and the CIS.

As CEO and founder of COREDO, I see every day how entrepreneurs from Europe, Asia and the CIS face a negative AML audit. This moment turns ambitious growth into a crisis: fines, reputational risks and frozen accounts. Our experience at COREDO shows that the right remediation plan after an AML audit not only corrects violations – it strengthens the business, increasing ROI from compliance and opening doors to new licenses and markets.

Over the past 9 years I have seen dozens of AML remediation projects after a negative audit. And almost always the problem is not the absence of policies, but the gap between the documents and real operational practice.

In one project in the EU a client had 120 pages of AML policies and not a single documented rationale for EDD. This became the key trigger for the negative audit.

Imagine: your fintech startup in Estonia has just undergone an external audit under the EU AML directives, and the report identified gaps in KYC/CDD/EDD for high-risk clients from Asia. The regulator requires urgent measures, and you waste time rewriting policies manually. The COREDO team implemented something like this for a client from Singapore: we developed AML remediation in 45 days, integrating RegTech with AI for transaction monitoring. The result: zero repeat violations and a license for payment services, approved by the MAS (Monetary Authority of Singapore).

The regulator’s key questions are always the same:

• Is the root cause of the violations understood;
• Has a specific responsible AML officer been appointed;
• Is there control over remediation timelines;
• Is the effectiveness of the new measures being measured.

Negative AML audit: impact on business and COREDO

Typical causes of a negative AML audit

• overloaded transaction monitoring rules without risk-based logic;
• lack of documented decision-making for EDD;
• a gap between the frontline and the AML function;
• outdated risk-scoring models that do not reflect the real client profile.

How to properly read a negative AML audit report

A typical AML audit report always consists of four blocks: findings, root causes, regulatory expectations and remediation timeline. The mistake of most companies is working only with the findings, without addressing the root causes.

Steps for remediation after an AML audit

Developing a remediation plan after a negative AML audit is a task that requires experience. Here is the sequence we apply for international businesses in the EU, Asia and the CIS:

1. Immediate report analysis. We start with an internal AML audit, identifying vulnerabilities: gaps in transaction monitoring, incomplete EDD for high-risk clients, or lack of logging of AML decisions. The COREDO team records all non-compliances with EU AML directives and FATF, preparing a roadmap within 72 hours.
2. Appointment of an AML agent and a compliance officer. We choose an internal or external AML agent certified by ACAMS. COREDO’s practice shows: modular AML staff training (KYC updates after an audit, incident investigations) increases effectiveness by 60%. For a Cypriot client we integrated biometric KYC with Face ID, reducing verification time from 3 days to 5 minutes.
3. Updating AML procedures. AML policy updates toward a risk-based approach: we adapt to new EU directives, introducing AML monitoring automation through RegTech. We use AML machine learning for predictive analysis: an AI-based model predicts AML risks with 95% accuracy, integrating blockchain analysis for crypto transactions.
4. Implementation of RegTech and AI. After an AML compliance failure, automation is the key to scaling. RegTech AML addresses transaction monitoring gaps: for an Estonian payment platform COREDO deployed a system with automated monitoring systems, where Precision/Recall metrics reached 92%/97%. ROI? Savings of €250k per year on staff plus zero fines.

In COREDO projects we first optimize rules and risk scoring manually, and only then automate. This approach prevents a company from scaling errors instead of controls.

5. KYC updates after the audit and sanctions screening. We strengthen CDD/EDD, adding vendor Due Diligence for partners. In Singapore we helped a client pass a MAS audit by implementing real-time screening across 500+ sanctions lists — AML reputational risks dropped to zero.
6. Testing and reporting. We conduct an internal compliance audit, simulating an external AML inspection. We prepare reports on suspicious transactions and cooperate with regulators, minimizing the long-term consequences of AML fines.

How COREDO ensures ROI

The ROI calculation for investments in AML systems after a fine is simple: savings on fines (average: €1–5M) + increased revenue from faster onboarding. Our experience: a client in the UK returned 3x the investment in a year thanks to scaling AML systems. AML customer experience improved: false positives fell by 75%, customers remain loyal.

When remediation doesn’t save the business

In some cases a negative AML audit reveals not operational but strategic problems. If the business model was originally built around high-risk flows without economic substance, remediation becomes a temporary measure. In such situations we recommend restructuring, changing jurisdiction, or ceasing licensed activities. These are difficult decisions, but they are what allow the business to be preserved in the long term.

Real cases of registration and support

Registration of legal entities abroad has been our foundation since 2016. In Cyprus we opened a company for an EU startup in 7 days, immediately providing substance (office, staff) according to the new 2025 rules. Then we obtained a CySEC crypto license, integrating AML compliance with biometric verification.

In Dubai for an Asian holding: Mainland registration + DFSA payments license. After the initial audit we introduced a deep internal AML audit, eliminating KYC deficiencies – the business scaled without disruptions.

In Estonia: e-Residency + EMI license: the COREDO team carried out an AML risk assessment, implementing AI in AML for transaction monitoring. The client avoided AML fines while expanding into the CIS.

Financial licenses and compliance with COREDO

obtaining licenses (crypto, banking, forex, payments) requires perfect AML. In the Czech Republic we helped with a CNB license, updating the AML policy to align with EU AML directives. In Singapore: MAS for forex, with automated AML monitoring based on machine learning.

CEO checklist after a negative AML audit

COREDO as a strategic partner

Contact us: together we’ll turn risks into a competitive advantage. Your business deserves a reliable partner with 9 years of experience in Europe, Asia and the CIS.

Why use a shelf company for international business?

Due diligence checklist step by step

Checking the business and beneficial owners

financial audit of a ready-made business

Checking bank accounts and licenses

Due diligence: assets, IT and personnel

AML and compliance risks

COREDO Cases: from due diligence to growth

• Cyprus, EU: The client bought a shelf company with an EMI license. Our legal business review revealed minor debts, which were settled within 10 days. Result: payments launched, expansion into the CIS, ROI 32%.
• Singapore, Asia: Registering legal entities in Asia via acquisition. Financial audit showed a strong P&L; AML check was clean. Scaled to Dubai.
• Estonia: Legal support for M&A with verification of the SRO and government contracts. We handed over the digital signature and CRM: operations are uninterrupted.

Recommendations from COREDO

As CEO and founder of COREDO, I often encounter situations where investment companies lose access to bank accounts due to strict anti-money laundering checks such as 115-ФЗ.

Important to understand: a bank refusal under 115-ФЗ is not a subjective decision of a particular manager and not a “failure with the bank”. It is a systemic signal that the business model, transactional logic or the company’s AML contours do not fit the risk profile of the credit institution.

Imagine: your investment company is growing, contracts with partners from the EU and Asia are pouring in, but suddenly the bank refuses service. An account freeze paralyzes the company’s payments, and the bank’s motivated refusal refers to risks under 115-ФЗ, lack of an economic purpose for transactions or suspicions of one-day companies.

COREDO’s practice confirms: in 2025 such cases have increased due to strengthened KYC procedures (Know Your Customer) and the banks’ risk-based approach. The bank’s financial monitoring service records the slightest inconsistencies, and the account is blocked for up to 30 days.

If the model looks unconvincing, the bank blocks transactions preventively, even without a direct violation of the law.

But let’s analyze why banks refuse investment companies. Main reasons:

• weak internal AML control of the investment company,
• insufficient counterparty checks under 115-ФЗ,
• lack of transparent business accounting.

For example, if counterparties’ due diligence is not documented, the bank will deem the transactions risky. In the EU and Asia local equivalents apply: FATF recommendations require evidence of a real economic purpose for transactions, and sanctions risks for investment companies increase scrutiny.

• turnover inconsistent with the declared activity;
• absence of a documented economic purpose for transactions;
• the transit nature of payments (rapid “in-and-out”);
• counterparties without a transparent structure or with a negative media footprint;
• formal AML without real control procedures;
• absence of management reporting explaining the movement of funds.

Even one of these factors can become grounds for refusal.

The COREDO team has developed a clear action plan for such scenarios. The first step is analyzing the bank’s motivated refusal. The critical mistake is to act chaotically: submit applications to dozens of banks, change the accountant or “hide” transactions. This worsens the company’s profile. After a refusal a structured response is important with fixation of causes and corrective actions.

It should be understood: even a perfect explanatory note does not always lead to unblocking. If the company’s risk profile exceeds the bank’s internal limits, it will not continue the relationship — regardless of the correctness of the documents. In such cases the goal is not to “break” a specific bank, but to clean the history and prepare for the next stage: appeal or migration.

If all banks refuse the investment firm, we move to appealing the bank’s refusal under 115-ФЗ: we file a complaint with the Central Bank about the refusal, with a full package of documents for the Central Bank’s interdepartmental commission (MVK).

The interdepartmental commission at the Central Bank evaluates evidence, not emotions. The key is to show that the company understands its risks and manages them.

In our cases the MVK responds positively to:

• a formalized AML framework;
• a risk matrix;
• a review of business processes;
• staff training;
• adjustment of contracts and transaction logic.

What to do if no bank accepts the investment company? We move to rehabilitation under 115-ФЗ. The steps to rehabilitate a business after a bank refusal are simple but require expertise: collect evidence (contracts, invoices, certificates of residency), conduct an audit and submit to the MVK at the Central Bank.

On the other hand, relying only on local banks is risky. An international structure today is not an attempt to evade oversight, but a risk management standard. Investors and EU banks accept holding models with distributed functions: an operating company, an investment SPV, a payment structure. The main thing is transparency and alignment of the AML approach across all jurisdictions.

A solution developed at COREDO is registering a legal entity abroad to open an account for the investment company.

InThe UAE, especially in Free Zones, registration takes 3 days, with 100% foreign ownership and zero corporate tax for many operations.The differences in banks’ approaches are fundamental:

• in the EU banks analyze the economic logic and business structure more deeply;
• in the UAE – focus on the source of funds and substance;
• in Asia – special attention to sanctions and PEPs.

COREDO designs the structure so that one rejection does not “infect” other banks through a negative profile.

To scale an investment business after a banking rejection the COREDO team recommends Estonia or the Czech Republic in the EU. In Estonia e-Residency allows online registration of an OÜ in 1–3 days, with a focus on fintech and crypto licenses. We helped an investment firm obtain a payment license by passing KYC and substance requirements (a real office, local staff), which opened accounts in European banks without rejections. In Slovakia and the Czech Republic COREDO’s practice confirms success with bank accounts for investment companies: low bureaucracy, residence permits through business and integration with EU AML standards.

AML consulting, key to preventing repeat rejections. We implement internal AML control: a risk-based approach, automated counterparty checks and staff training. For investment firms this means due diligence according to FATF, transaction monitoring and reporting that convinces banks of reliability.

After implementing full AML control companies gain not only access to accounts, but also:

• faster payments;
• increased counterparty trust;
• reduced operational pauses;
• the ability to scale without repeat rejections.

obtaining financial licenses strengthens positions. The COREDO team supports everything from crypto licenses in Cyprus (CySEC) to forex and banking in Singapore. The process: document submission, substance-proof and compliance audit. In Dubai a VARA license for crypto investments opens doors to Asian PSPs, bypassing local blocks.

Strategic planning of banking relationships is our priority. After a rejection we assess migration of accounts to alternative jurisdictions, including Africa (for niche investments), but we focus on the EU and Asia. Transparent business accounting and risk management compliance help avoid sanctions risks for investment companies.

How to pass a bank’s counterparty reliability check? We conduct due diligence: PEP check, sanctions lists, analysis of the ownership chain. This is the standard for opening an account for an investment company in the EU.

The conclusion is simple: a bank rejection under Federal Law 115-FZ is not a sentence, but an audit of the business model in a strict format. Companies that use this moment for rehabilitation and restructuring come out stronger and more resilient.

At COREDO we support this process fully – from analyzing the rejection to a new banking architecture.

As the CEO and founder of COREDO, I see every day how entrepreneurs from Europe, Asia and the CIS encounter pitfalls when registering businesses abroad. Our experience since 2016 in EU jurisdictions, including the Czech Republic, Slovakia, Cyprus, Estonia and the United Kingdom, as well as in Singapore and Dubai, confirms: buying shelf companies (shelf companies or ready-made) speeds market entry, but without a thorough Legal Opinion carries jurisdictional risks, from hidden liabilities to AML compliance issues. The COREDO team has already helped dozens of clients adapt such firms for international business, minimizing the risks of shelf companies and ensuring a clean legal status.

In this article I will explain how to properly conduct due diligence on ready-made firms, avoid typical Legal Opinion mistakes, and integrate ready-made companies into your corporate structure. We rely on COREDO’s practice: from verifying legal cleanliness in Estonia to adapting EU ready-made companies for cryptocurrency licenses. This is not theory: these are strategies that deliver ROI through transparency and compliance.

Legal Opinion for ready-made: what it is and why

legal opinion (legal opinion): it is an independent audit of a shelf company’s history that discloses the legal history of shelf firms, including beneficial ownership disclosure, changes of directors and non-disclosure of liabilities. COREDO’s practice shows: without it 70% of ready-made deals in Asia face risks of hidden debts that block bank accounts.

In 2025, with the tightening of substance requirements in the EU (a real office, local staff), a Legal Opinion for ready-made companies becomes mandatory. It records the corporate structure of the ready-made, preventing piercing of the corporate veil in cross-border mergers.

Typical legal opinion mistakes

• Ignoring debt checks for ready-mades: Focus on the articles of association, but without analysing lawsuits. In Estonia we uncovered a hidden rent debt — the client saved €150,000.
• Underestimating AML risks in shelf companies: Without checking whistleblower protections and KYC history. For CIS entrepreneurs this is critical — problems with AML compliance in ready-made firms block scaling in Asia.
• Superficial Due Diligence checklist: No verification of change of directors and protocol of discrepancies. COREDO’s solution: we use Legal tech due diligence to speed up by 40%, with ROI metrics for legal audits up to 5x.

How to avoid typical mistakes in Legal Opinion for ready-made companies? Start with Due Diligence of shelf companies:

• Request the full corporate history (5–10 years).
• Check reputational risks through arbitration centres and online hearings.
• Assess tax risks of offshore companies, certificates, and jurisdiction rates.

Our experience at COREDO with Legal Opinion Asia registration has shown: in Singapore ignoring beneficial ownership leads to refusal of crypto licenses. We integrate risk mitigation strategies, ensuring compliance.

Due Diligence of ready-made companies: checklist

What to check in Due Diligence when buying a ready-made company in the EU? The COREDO team developed a checklist tested on 50+ transactions:

1. Legal soundness: Analysis of the Memorandum of Association, constitutional documents, absence of minutes of disagreement.
2. Financial history: Checking debts of the ready-made company: taxes, loans, disputes. In the Czech Republic we uncovered undisclosed liabilities of €200,000.
3. AML and KYC: Compliance with beneficial ownership disclosure, directors’ history. AML risks in shelf companies are minimized through transaction audits.
4. Reputational risks: Searches in arbitration databases, foreign court decisions.
5. Business adaptation: Adapting the ready-made to the business: change of address, directors. In Slovakia we set up a shelf company for a forex license in 10 days.

Risks of purchasing ready-made companies and mitigation

The risks of buying ready-made companies include the long-term consequences of ignoring due diligence in offshore jurisdictions: from corporate veil piercing to denial of financial licenses. In the EU (EU company registration pitfalls) — tightening of substance requirements; in Africa (corporate law for ready-made Africa, mistakes in assessing tax liabilities of ready-made companies in Africa) — instability.

The COREDO team minimizes them through offshore structuring:

• Changing the structure of a ready-made without a legal opinion? No: always with a Legal Opinion to avoid the strategic consequences of piercing the corporate veil in ready-made firms in the EU.
• For the CIS: minimize jurisdictional risks when adapting a ready-made company for CIS markets: focus on tax residency and contractual documentation.
• Mistakes in Legal Opinions for offshore entities: we check non-commercial risks such as intellectual property and licensing agreements.

Ready-made adaptation for your business

How to adapt a ready-made company’s legal address for international business? Our approach at COREDO:

• financial license EU (crypto, forex, payments), we integrate financial license requirements, with AML consulting.
• Cryptocurrency license in Estonia: After purchasing a shelf company we conduct Due Diligence, change directors, and confirm substance.
• Full support: business outsourcing, trademark registration, dispute resolution in international centers.

Why choose COREDO for long-term success?

Solutions developed by COREDO combine legal consulting and financial support: from purchasing ready-made companies to AML/KYC. Our clients save time — registration + license in 4–6 weeks, with transparency at every stage.

Contact the COREDO team: we’ll turn risks into opportunities. Your business deserves a reliable structure.

As CEO and founder of COREDO, I see daily how entrepreneurs from Europe, Asia and the CIS face the challenges of international expansion: from registering companies in new jurisdictions to obtaining financial licenses and ensuring strict AML compliance. Our experience at COREDO since 2016 covers hundreds of projects in the EU, Czechia, Slovakia, Cyprus, Estonia, the United Kingdom, Singapore and Dubai, where the COREDO team consistently turns regulatory barriers into competitive advantages. In this article I will cover the key aspects — from corporate registrations to AML audits in Latvia and minimizing risks under the 6AMLD in Latvia, with practical steps based on real cases.

Important to note right away:

That’s why

Registering companies abroad: choosing a jurisdiction

A common mistake is to treat AML as a step after company registration. In Latvia the logic is the opposite: the business risk profile is formed before the legal entity is opened, based on the founders, the geography of capital and the intended business model. Latvijas Banka and partner banks analyse this data in advance, and it is extremely difficult to change the first impression afterwards.

company registration in the EU or Asia in 2025 requires a focus on digital identification and KYC — audits and Latvia-like procedures. In the EU, including Latvia and Estonia, video verification of founders via eIDAS or BankID is mandatory, plus confirmation of the source of funds (source of funds verification). The COREDO team implemented this for a fintech startup from Singapore that opened an SPV in Cyprus: we integrated electronic signatures, reducing timelines from 5 weeks to 10 days. In Asia, in Singapore and Dubai, we similarly strengthened KYC automation, with checks of beneficial owners against sanctions lists.

According to COREDO’s practice, key red flags when registering and opening accounts in Latvia:

• sources of funds not documented for the past 2–3 years;
• UBO with a business history in high-risk jurisdictions without EDD;
• use of nominee directors without real decision-making;
• mismatch between the declared business model and actual transaction flows;
• absence of a pre-prepared AML framework.

COREDO’s practice confirms: for high-risk business (crypto, forex) choose jurisdictions with remote registration. In Latvia under the supervision of Latvijas Banka the process takes 2–4 weeks, but requires a business plan and AML compliance from the very start. Steps we recommend:

• Assess a risk-based approach: the EU focuses on predicate offences under 6AMLD (including Latvia), while Asia focuses on cross-border transaction risks.
• Gather the package: articles of association, registered address, eKYC questionnaires, proof of business reputation.
• Integrate ESG and automated reporting for bank accounts — EU banks now require this for high-risk clients.

Practical checklist for AML registration in Latvia:

• ownership structure without ‘extra layers’;
• confirmed source of funds and source of wealth;
• description of business processes and client types;
• preliminary AML risk matrix;
• understanding of SAR reporting obligations;
• designated AML officer in place from the start.

For companies from Asia scaling into the EU, the solution developed by COREDO combines registration in Estonia with a holding structure in Dubai: full disclosure of beneficiaries minimized delays in account opening.

Financial licenses: MiCA and payment services

obtaining licenses – crypto (MiCA), banking, forex or payment – directly depends on AMLR requirements and internal procedures. In Latvia and the Czech Republic, for MiCA licenses Latvijas Banka checks transaction monitoring systems and AML stress testing. Our experience has shown: typical refusals arise from KYC gaps in Latvia, such as incomplete identification of beneficiaries or weak PEP monitoring.

The COREDO team accompanied a client from the United Kingdom to a payment license in Slovakia: we implemented a graph-based transaction analysis with explainable AI AML, identifying unusual patterns and securing approval in 8 weeks.

Notably:

This is why COREDO implements explainable AI: it not only reduces false positives but also helps protect the company’s position during regulatory inspections.

Key steps:

• Conduct a gap analysis against 6AMLD requirements (Latvia): focus on enhanced Due Diligence (EDD) for PEPs and source of wealth checks.
• Develop a compliance officer structure with a clear point of accountability for AML.
• Integrate AI-driven anomaly detection for transaction monitoring in Latvia — this reduces operational costs by 30–40% and increases ROI.

AML consulting in Latvia and the EU

AML audit in Latvia is not a formal document check. Auditors and the regulator assess three levels:

• Design – correctness of the AML architecture;
• Implementation – actual application of procedures;
• Effectiveness – whether controls work in practice.

AML audit Latvia is a priority for business in the EU, especially with the new AMLR compliance in Latvia and the risks of AMLA sanctions in Latvia. Typical AML findings include logical gaps in schemes, delays in SAR reporting and ineffective transaction monitoring. In 2025 fines for AML violations in the EU reach 10% of turnover or €10 mln under AML fines 10% of turnover.

Our experience at COREDO identified typical AML audit violations in Latvia for fintech: weak post-transaction analysis (predicate offences as organised crime ML threats) and gaps in KYC. For a client from the CIS we conducted AML checks in Latvia, implementing stress-testing of AML procedures in Latvia and eIDAS KYC – this eliminated findings and passed the regulatory audit of Latvijas Banka.

Typical AML audit findings in Latvia for fintech:

How to identify AML gaps yourself before a regulatory audit:

• test 10-15 high-risk client cases “from end to start”;
• check the speed and quality of SAR escalation;
• compare risk scoring with actual transactions;
• review decision logs of the AML officer;
• assess which monitoring scenarios generate noise.

The COREDO team integrated transaction scoring and sanctions filters, minimizing the risk of AMLA sanctions for companies in Latvia. How to identify gaps in AML compliance in Latvia? Start with internal control: assess financial crime risks in Latvia, including financial ties risks in Latvia. Practice confirms: explainable AI for AML analysis in the EU detects 20–30% more anomalies than manual methods, especially for CIS businesses with PEPs in transactions.

Companies are required to prove that risks of predicate offences were identified and controlled. Explainable AI plays a key role here – it forms the evidential basis of decisions.

Support: from audit to scaling

In Latvia projects COREDO works systemically rather than ad hoc: from structure diagnostics to building a resilient AML architecture. We consider AML as part of the business model, not an isolated compliance function.

COREDO provides a full cycle: after registration we implement compliance training programs, automate transaction monitoring AML and prepare for inspections. For a crypto company from Dubai expanding into the Czech Republic, we linked MiCA AML license with internal AML control, preventing AML-related reputational losses.

In our Latvia projects, investments in AML optimization pay off within 6-9 months:

• reducing operational compliance costs by up to 40%;
• accelerating onboarding and licensing by 30–50%;
• reducing the risk of fines and account blocks to almost zero.

Ultimately, a reliable partner solves pains with transparency: the COREDO team is always available, from due diligence to ongoing support. If you are planning expansion, start with an audit; it’s an investment in sustainable growth. Contact us and we will review your case individually.

The conclusion is simple:

COREDO helps build exactly such a system — from registration to ongoing compliance and regulatory inspections.

As CEO and founder of COREDO, I often see how owners of investment companies approach exit with ambition but encounter unexpected barriers. Preparing an investment company for sale to an investor requires a systematic approach: first we strengthen the legal structure of the business, then we optimize financial reporting and operational processes to increase the company valuation and minimize risks.

Legal structure for investors

In practice the buyer evaluates not the “beauty of the presentation”, but three things:

• whether the asset can be safely purchased without hidden tails,
• whether the company can be run without the founder,
• how predictable the cash flow and compliance risks are.

Therefore preparation for sale is not “sprucing up” the reporting, but assembling a manageable asset: legally clean, financially transparent, operationally autonomous.

Investors first of all check the transparency of the legal structure.

Legal readiness checklist (what the investor will ask for in the first 72 hours):

• current cap table (who owns, entry/exit terms, pledges, options, convertible instruments);
• shareholders agreement (drag-along / tag-along, reserved matters, procedure for approving transactions and investment decisions);
• absence of “shadow” arrangements: side letters, verbal commissions, unrecorded partnerships;
• IP and software rights: who owns algorithms/code/models/datasets, any assignment from contractors;
• corporate “hygiene”: meeting minutes, director appointments, charter updates, signatory authorities;
• documents on KYC/AML governance: who is MLRO/Compliance, which policies are approved, how risk decisions are recorded.

A practical step: create a single data room and bring documents to a single version (contract versions, dates, signatures, attachments). It’s banal, but it saves months: the investor sees order — and exerts less price pressure.

Avoid typical traps: nominee directors in Singapore or unrecorded partnerships in the Czech Republic can derail due diligence. We always formalize exit mechanisms from partnerships in advance – through put/call options in shareholder agreements. This protects everyone and demonstrates maturity.

Optimizing financial position for valuation

Key metrics: free cash flow (FCF), Debt/EBITDA below 3x and return on invested capital (ROIC) above 15%. For investment firms add AUM (assets under management), portfolio diversification and a track record of returns – at least 3 years of audited data.

Do a Quality of Earnings (QoE) before going to market. The investor will almost always order QoE themselves — and will use the findings as an argument to reduce the price. If you prepare QoE in advance, you control the agenda.

What is usually “cut” in valuation:

• one-off revenues that will not recur (one-off deals, single performance fees);
• revenue dependence on 1–2 large clients/LPs;
• “on-paper” income without confirmation by cash flow;
• expenses that were hidden in capex/outside the P&L;
• risks of clawbacks/commissions/disputes under contracts.

Prepare the company’s financial statements under IFRS: balance sheet, P&L, cash flow with breakdown by fees and performance fees. Conduct an external sale audit, from a Big Four, to confirm operational profitability.

Minimum “financial package” that speeds up the deal:

• management reporting for 24–36 months (P&L / CF / BS) + bridge EBITDA → FCF;
• revenue breakdown by streams: management fee, performance fee, success fee, advisory;
• unit economics (if there is client acquisition): CAC, LTV, churn, payback;
• AUM report: dynamics, concentration, asset structure, limits, drawdowns;
• 3-year forecast with assumptions (Base / Downside) and market sensitivity;
• tax memo: where tax is paid, risks of permanent establishment and transfer pricing.

Step 3: operational model without the owner

Minimum set that increases trust:

• investment committee: regulations, quorum, decision records;
• risk framework: limits, stop-rules, independent risk/compliance function;
• compliance framework: MLRO/Compliance Officer, decision log for EDD/PEP/sanctions;
• operational framework: who runs onboarding, who is responsible for reporting, who handles incidents;
• KPI dashboard: AUM, net inflows, churn LP, performance vs benchmark, operational SLAs.

Key metrics: gross margin >60%, ROE >20%, LTV/CAC >3. Document intellectual property: patents on portfolio management algorithms, brand trademarks, software licenses. In the EU, register them through EUIPO in advance.

Sales strategy and deal structuring

The company’s sale strategy depends on the type of investor: strategic (for synergy) or financial (for growth). We recommend “Company for sale”: build with the exit in mind: annual business revaluation, data-driven decisions.

How deals are most often structured in investment companies:

• Share deal (purchase of shares) — convenient when value lies in the license, contracts, brand goodwill.
• Asset deal — when the company has a “history” of risks, and the buyer takes only the assets/contracts.
• Step deal — entry in tranches: initially minority, then control upon meeting KPIs.

To reduce friction, they often use:

• escrow (part of the price is held for 6–18 months to cover claims);
• W&I insurance (representations and warranties insurance — especially if there’s a large buyer);
• regulatory conditions: “closing after approval/notification”, plus a list of “pre-closing covenants”.

Tips on timeline and risks:

• Month 1–2: Audit and restructuring.
• 3–6: Financial optimization, SOPs.
• 7+: Teaser, negotiations, closing.

Risks: tax claims — insure against them; conflicts with partners: specify in agreements. COREDO provides full support: from registration in Dubai to AML audit in the EU.

Practical tip: don’t go to market “raw”. If you want a premium valuation, prepare the company as a product: clear risk profile, predictable numbers, manageability without the owner, and transparent compliance. Then negotiations are not about “why do you have a hole here”, but about growth, synergy and price.

At COREDO we usually carry out preparation using the model: Vendor DD → structure finalization → QoE/IFRS → operational autonomy → data room → negotiations and closing. This reduces the discount and speeds up the deal.

Greetings — I am the CEO and founder of COREDO.

Over nine years my team and I have helped hundreds of entrepreneurs from Europe, Asia and the CIS register companies in key jurisdictions, obtain financial licenses and set up robust AML compliance. Our experience shows: formal AML is a trap that masquerades as protection but in practice leads to account freezes, AML fines and wasted time. Instead, focus on a risk-based approach — it is what saves businesses from real threats and increases ROI.

Over the years we’ve seen the same pattern: companies that “do AML as a box‑ticking exercise” spend more money and encounter more problems than those who build a risk-based model from the outset. Formal AML means the same procedures for everyone, overloaded checklists and endless manual reviews.

Imagine: you register a company in Estonia or Singapore, open accounts, and six months later banks are blocking transactions due to “suspicious activity.” This is not uncommon. The COREDO team recently completed a project for a fintech startup from the Czech Republic expanding to Dubai. The client faced false positives in their manual AML monitoring: the system flagged 40% of legitimate payments from high-risk clients. The result: weeks-long delays, reputational damage and the threat of license revocation. We implemented automated AML systems with algorithms of a risk-based approach (risk-based approach according to FATF standards), reducing false positives to 5% and speeding up processing by 70%.

Registration of companies abroad: AML risks

Many entrepreneurs make the mistake of thinking that AML starts after company registration. In practice, banks and regulators assess risks already at the stage of onboarding a legal entity. Ownership structure, founders’ history and the chosen jurisdiction form the initial risk profile, which is then extremely difficult to change.

According to our statistics, the main triggers for refusals and blocks during registration and account opening:

• complex multi-level structure without a clear business rationale;
• sources of funds not documented;
• involvement of a PEP without enhanced EDD;
• mismatch between client geography and the company’s jurisdiction;
• absence of a described AML architecture at the start.

Formal AML does not close these risks — it only records them after the fact.

Why does formal AML fail here? Companies spend resources on manual checks of all clients equally, ignoring risks. Global AML spending exceeds tens of billions of dollars annually, but the effectiveness of money laundering detection is less than 1%. In the EU and Asia fines for AML violations in 2024–2025 exceeded $7 billion, with a focus on ineffective AML and overcompliance.

Answers to these questions are more important than the tax rate. Choose taking geo-risks into account: for entry into Africa add screening for adverse media data and blacklists.

Obtaining licenses for crypto, banking services, forex or payments requires perfect AML compliance. Regulators like the FCA in the United Kingdom or MAS in Singapore check not only capital, but also transaction monitoring, risk-based AML and readiness for CFT requirements (countering the financing of terrorism).

ROI from risk-based AML is evident not only in reduced fines. It speeds up licensing, reduces blocks, and increases the trust of banks and investors. In our projects operational AML cost savings reach 40–60% already in the first year.

AML business risks: fines and criminal liability

AML risks for business are evolving. Violations of AML in the EU and Asia lead not only to financial fines, but also to license suspension, account freezes and even criminal liability for top management. Regulators are escalating levels of intervention: from warnings to full revocation.

Why does formal AML block the accounts of legitimate businesses? It focuses on volume, not on risks: excessive KYC harms ROI, false SARs reduce effectiveness, and scaling AML procedures for Europe, Asia and the CIS becomes chaotic without automation.

How COREDO Solves Problems

The COREDO team offers a full cycle: from registration to AML optimization. We conduct risk assessments, implement automated systems for transaction monitoring, and train staff to FATF standards. For international business in Africa we add screening against greylists, minimizing reputational losses.

Optimizing AML resources is simple:

• Assess risks by clients, geographies and products;
• Automate screening for PEPs, sanctions and media;
• Implement risk-based KYC – only for high-risk;
• Scale with ROI in mind: automation is five times more effective than a formal approach.

Ready to scale your business without AML traps? Contact us: we’ll discuss your strategy in person.

During consultations entrepreneurs almost always ask the same question: what is more advantageous, buying an investment company or registering a new one from scratch. And to answer honestly, without simplifications: the right choice does not depend on your “favorite jurisdiction”, but on your goal – speed to market, control, compliance, tax model, scalability and reputational horizon.

Since 2016 the COREDO team has supported dozens of projects in the EU, the United Kingdom, Singapore, Dubai, Cyprus, Estonia, the Czech Republic, Slovakia and other jurisdictions in Europe and Asia. I have seen how buying a ready licensed firm gave a client a strategic advantage of 6–12 months — and how the same deal completely “burned” the ROI due to hidden AML risks and underestimated integration.

In this article I will break the decision down: when it makes sense to buy a ready investment company (shelf / licensed company), when to register from scratch, which due diligence checks are critical and how to calculate ROI taking into account compliance and integration.

Buying a ready-made investment company: a strategic advantage

Buying a ready-made investment company is not just a way to save time on registration and approvals, but a tool that, when chosen correctly, becomes a real strategic advantage. Such an asset allows you to enter the market with an already streamlined infrastructure, licenses and track record, which directly affects the speed of scaling and competitiveness – below we will examine the key arguments in favor of such a purchase.

Key arguments in favor of buying

If your goal is the fastest possible market entry, buying an investment company with an existing license often becomes the shortest route. This is especially noticeable in regulated segments:

• MiFID II investment firms in the EU
• Management companies under AIFMD / UCITS
• VASP / crypto licenses (Estonia, Lithuania, some Asian jurisdictions)
• payment and EMI licenses (in the EU, the UK, Singapore, Dubai)
• forex / brokerage licenses

Typical advantages of acquiring a ready-made company:

Risks of buying a ready-made investment company

COREDO’s experience shows: speed is the main advantage and at the same time the main source of risk. The buyer focuses on the license and jurisdiction while underestimating:

1. AML/KYC legacy and the quality of the client base
   • How thoroughly KYC / enhanced Due Diligence (EDD) was conducted previously
   • What AML risk scoring was applied
   • How sanctions screening and PEP screening were conducted
   • How many and what types of Suspicious Activity Reports (SAR) were filed
   • Whether there is a backlog in transaction monitoring
   We once supported the purchase of a licensed company in the EU where formally “there were no problems”, but during reputational due diligence + adverse media screening clients surfaced with signs of high-risk jurisdictions and a potential sanctions context. The deal was only “saved” through a significant discount and strict indemnity clauses for AML risks.
2. Hidden liabilities and contingent liabilities
   • open tax audits and potential additional assessments
   • undisclosed guarantees and side-agreements
   • ongoing or potential litigation / lawsuits
   • possible piercing of the corporate veil, if the regulator/court can extend liability to the beneficiaries
3. Reputational risks of shelf / shell companies
   • who the beneficial owner / UBO was
   • what operations were carried out
   • whether the company featured in negative news, data leaks, investigations
   • how banks and regulators in the EU or Asia perceive it
4. Transfer of licenses and permits (licensing transfer)
   • requires a fit and proper test for new owners and directors
   • triggers a re-examination of the license
   • may lead to restriction of permitted activities
   In the deal that the COREDO team conducted in one of the EU countries, the regulator explicitly stated: without formal re-authorization they will not recognize the change of ownership, meaning the key advantage in terms of speed was partially negated.

Registration of an investment company: control and substance

Registering an investment company from scratch is not just a choice of jurisdiction and form, but a tool to strengthen control over the structure, risks and regulatory requirements. Properly built substance and a well-thought-out long-term strategy from the outset allow you to embed competitive advantages that cannot be “finished” hastily later.

When registration from scratch is preferable

Company registration in the EU or Asia from scratch gives you what you can’t buy:

• Full control over the corporate structure:
  • UBO structure, trusts, nominee schemes: everything is arranged according to your transparency and tax-residency strategy.
  • Structure of governing bodies, board composition, independent directors.
• Clean reputational history:
  No legacy clients, suspicious transactions, or inherited AML regulations.
• Flexible adjustment of corporate governance and risk management to your business model:
  • risk appetite policy
  • enterprise risk framework
  • stress testing / scenario analysis
  • internal committee structure (risk, audit, compliance)
• The ability to establish substance requirements (economic presence) from the very beginning:
  After the tightening of requirements in the EU, a formal company without a real office, staff and operational activity no longer works as a sustainable solution.

  When registering from scratch we put in place:

  • an office and minimal staff in the jurisdiction
  • a real management function
  • contracts with local providers
  • a clear economic nexus
• Modern IT and AML infrastructure done right from the start:
  Instead of “reworking” outdated CRM and AML systems of an acquired company, you build the architecture to fit your strategy:
  • KYC automation and RegTech solutions
  • transaction monitoring based on risk scoring
  • centralized case management
  • integration with regulatory reporting systems (CRS, FATCA) and local reporting

Where registration is worse than purchase

• Timeframes
  Company registration in some EU or Asian jurisdictions takes only days or weeks.

  But obtaining licenses such as MiFID II, AIFMD, VASP, payment and forex licences can take months or even more than a year. For a startup or a fund with a flexible horizon this is acceptable; for a time-sensitive strategy (market entry before a new regulatory cycle or a competitor) it can sometimes be critical.

• Predictability of banking and payment relationships
  A new structure without history always raises more questions from banks and payment institutions:
  • who is the UBO, where the capital comes from, what is the source of funds
  • what is the business purpose of the structure
  • whether there is real presence and substance
  In such cases, the COREDO team usually models the bankability profile in advance: which banks or EMIs are more willing to open accounts for the chosen model.

Compliance and AML risks: what you must not postpone

Whether you are buying a company or registering one from scratch, the AML/CTF framework determines how resilient your business will be to scrutiny from regulators, banks and investors.

Key AML/CTF components in transactions

• KYC and enhanced due diligence (EDD)
  • client identification procedure
  • identification and verification of the Ultimate Beneficial Owner (UBO)
  • client classification criteria: retail / professional / institutional
  • additional procedures for PEPs and high-risk categories
• Sanctions screening and PEP screening
  • regular screening against global sanctions lists (including SDN lists)
  • automated adverse media screening tools
• Transaction monitoring and SAR
  • development of risk-based rules and scenarios
  • AML risk scoring algorithms for transactions and clients
  • procedure for detecting, escalating and filing SARs with the regulator
• Procedures for cross-border investments
  • country risk assessment
  • controls against treaty shopping when using double taxation agreements
  • consideration of substance/economic presence requirements in the source and destination jurisdictions of capital

Tax consequences of MiFID II and transfer pricing

When my team and I design a structure for a purchase or registration, I look not only at the tax rate. More important are the sustainability of the tax model and compatibility with EU rules, CRS/FATCA and local requirements.

Key tax elements

• Tax residency and substance requirements
  Determines where the company is considered a tax resident and where its income is taxed.

  When purchasing a company, it’s important to understand:

  • whether its tax residency status is preserved
  • whether dual residency will arise
  • how changes in management (directors, place of decision-making) will affect the tax position
• Transfer pricing and intercompany agreements
  In a group of companies with several legal entities in the EU, Asia and the Middle East, transfer pricing regulation defines:
  • how you will allocate profits
  • what documentation is needed to justify prices
  • how the future integration of the acquired company will fit into the existing TP policy
• Treaty shopping and use of tax treaties
  Many clients initially take a superficial view of double taxation agreements.

  Our task: to build a structure so as not to be accused of treaty shopping, while preserving available benefits.

Regulatory regimes

• MiFID II, AIFMD, UCITS in the EU
  These regimes define:
  • permissible types of investment services
  • capital and organizational structure requirements
  • regulatory reporting and investor protection requirements

  When purchasing an existing licensed company, it’s important to assess:

  • how well its current business model matches your product
  • how much adaptation (or license modification) will cost
  • whether it is simpler to register a new structure for your model than to try to “roll out” an existing license
• VASP/crypto licenses
  Crypto-sector regulation is dynamic. When buying a company with a VASP license (for example, in one of the EU countries or in Asia), an investor often wants to buy time.

  But if the regulator changes its approach in the next 12–24 months (which is happening regularly now), you effectively face the same situation as when registering from scratch: reworking policies, new requirements for the capital buffer, enhanced AML procedures/CTF.

Due diligence when buying an investment company: a checklist for the owner

Over years of practice at COREDO we have built a structure for comprehensive due diligence, without which I would not recommend entering into a deal:

Due diligence – company review

• Charter documents, governance resolutions, history of amendments
• Contracts with key clients and partners
• Licenses, permits, correspondence with the regulator
• Existence/prospect of corporate veil lifting and personal liability of directors and UBOs

Financial due diligence

• Audited financial statements for 3–5 years
• Revenue structure (recurring / one-off / high-risk clients)
• Debt, off-balance obligations, guarantees
• Potential contingent liabilities (litigation, tax disputes, client claims)

Tax due diligence

• Tax history and audits
• Risks of additional tax assessments, fines, penalties
• Existing optimization schemes: whether they comply with current law and whether they risk being classified as abuse

AML compliance due diligence

• AML/CTF policies and procedures
• Actual practices for KYC / EDD / sanctions screening
• Transaction monitoring systems in use and their effectiveness (false positives, SAR backlog, client onboarding time)
• Quality of documentation: client files, risk assessments, escalation logs

Reputational due diligence

• Search for negative news, leaks, investigations
• Screening of key clients and counterparties
• Perception of the jurisdiction and the specific structure by banks and regulators

IT and data due diligence

• Architecture of CRM, risk systems, AML modules
• Software licenses, rights to algorithms (trading models, scoring engines)
• compliance with data protection and GDPR, especially when transferring client data across borders

How to calculate ROI of purchase vs registration

Chief financial officers traditionally compare:

• Cost of purchase (equity value + transaction costs)
• Cost of registering from scratch (establishment, license, initial capital, team)

Basic logic of ROI analysis

To evaluate a deal, standard metrics are used:

• NPV (Net Present Value)
• IRR (Internal Rate of Return)
• Payback period

In one case, a client viewed the purchase of a licensed investment company in the EU as a “saving” versus registering from scratch. After the COREDO team calculated:

• the costs of upgrading AML systems
• IT landscape migration
• reputational and tax adjustments

How do you structure a deal with escrow?

In the investment sector, the deal’s legal mechanics are not a formality but a tool for risk management.

Key elements I always recommend discussing:

• Share deal vs asset deal
  • Share deal: faster and simpler in terms of licenses, but you take on all of the company’s past.
  • Asset deal: cleaner in terms of historical risks, but in some jurisdictions more complicated regarding transfer of licenses and relationships with clients and the regulator.
• Escrow arrangements
  Part of the deal price is held in an escrow account and paid to the seller only after a specified period and/or upon fulfillment of conditions (for example, no claims from the regulator or the tax authority).
• Warranty & indemnity clauses / insurance
  • Warranties: seller’s assurances regarding the absence of debts, investigations, undisclosed clients, etc.
  • Indemnities: specific obligations to compensate losses if certain risks materialize (for example, a regulator’s fine for past AML breaches).

  In several deals in the EU and the UK, W&I insurance is added, which complements the buyer’s protection.

• Post-acquisition integration plan
  • how you will integrate teams and processes
  • how you will migrate clients and data
  • which AML efficiency KPIs to track (false positive rate, onboarding time, SAR backlog) in the first 12–18 months.

When should I buy or register from scratch?

I boil the choice down to several typical scenarios I’ve encountered at COREDO.

Rationale for buying a ready-made company

• You need to enter the EU market quickly with a MiFID II / AIFMD / VASP or payment license.
• The target company’s stable client base and its relationships with banks/custodians are important.
• You are prepared to invest in AML remediation and IT integration, and this is built into the model.

Rationale for registering from scratch

• You are building a new PE/VC fund, a management company, or a fintech platform with a long-term strategy.
• You need a clean reputation, a transparent UBO structure, and control over governance.
• You want to build a modern RegTech stack, KYC automation, and transaction monitoring tailored to your risks from the start, rather than “patching” someone else’s systems.
• You are considering jurisdictions where registration and Licensing are relatively predictable in terms of timing and requirements.

The COREDO team has learned over years of work: a properly designed structure at the start saves years of time and millions on subsequent “fixes”. And it is precisely here that a sensible combination of registering from scratch and targeted acquisitions (up to a roll-up strategy) gives the business that balance of speed, control, and resilience that most of our clients strive for.

International registration in 2026

Choosing a jurisdiction: strategy

Documents for registration in 2026

The standard package of documents for registering a company in the EU in 2026 includes:

• founding agreement and articles of association;
• proof of registered/legal address;
• digital identification of founders (video verification, eIDAS, BankID);
• KYC questionnaires and information about beneficiaries;
• proof of source of funds;
• electronic signatures.

• If your funds are salary, you need payslips for the last 12 months.
• If these are dividends from another company — you need extracts from the shareholders’ register and financial statements.
• If it’s an inheritance — you need court documents, the will, and bank statements.
• If it’s a prize or a gift: you need documentary proof with an explanation.

Banking requirements 2026

Banking requirements for new companies in the EU in 2026 include not only standard KYC documents. Banks now require:

• proof of business reputation;
• business plan;
• information about the corporate structure;
• source of funds;
• for high-risk businesses – full AML compliance and transparency of all transactions.

AML compliance: from theory to practice

What does this mean in practice?

Company registration with foreign founders: requirements

What does this mean?

Registration timelines: real figures

Remote registration: pros and cons

Tax planning from the very beginning

After registration: what to do?

Common mistakes when optimizing a website

I’m often asked: is it possible to build an international business so that the director doesn’t wake up at night worrying about fines for AML/CFT violations and AML compliance?

Over the years of working at COREDO: from the EU and the United Kingdom to Singapore and Dubai, I have observed one pattern: where a director truly understands how an AML compliance audit works and how it protects him personally, the business scales faster, banks and investors are more willing to join the project, and regulators see the company as a partner rather than a potential source of problems.

In this article I’ll break it down:

• how an AML audit minimizes the director’s AML liability;
• when and for whom an external AML audit is needed in the EU and Asia;
• how to calculate the ROI of outsourced AML audit;
• which weaknesses the audit most often uncovers and how to turn them into a strategic advantage;
• how to use the results of an AML program evaluation in dialogue with banks and investors.

AML audit: protection for the director

Legally, in many jurisdictions in Europe, Asia and the CIS it is the director and the board of directors who bear ultimate responsibility for AML/CFT violations:

• incorrect AML risk assessment;
• absence or mere formality of internal AML controls;
• ignoring requirements for customer due diligence (CDD) and the UBO verification process;
• weak transaction monitoring AML;
• violations in sanctions-list screening and handling of PEPs.

In practice, the regulator, the bank or law enforcement authorities look at three things:

1. Whether an AML program was formalized and approved (policies, procedures, internal AML/CFT control rules).
2. Whether it was regularly reviewed through an AML compliance audit (internal or independent).
3. Whether the director responded to the results: did the director approve a plan of remedial actions and oversee its implementation.

If these three points are documented, the director gains real protection:

• you can demonstrate good faith and deliberate risk management;
• there are arguments to reduce fines and mitigate sanctions;
• the regulator has fewer grounds to allege personal negligence.

What tasks does an AML audit solve for a business and its director?

In essence, an AML audit of the business answers several key questions for the director:

• How well does our current AML program comply with regulatory requirements (5MLD in the EU, BSA in the USA, local laws in Singapore, Dubai, Estonia, Cyprus, etc.)?
• Are our internal AML controls working in practice, or does everything rest on a single compliance officer?
• What scenarios could lead to regulatory fines, account freezes, sanctions, or banks refusing service?
• What needs to be changed within realistic timeframes so that I, as the director, can confidently sign reports and answer to shareholders and investors?

At COREDO, the team usually focuses on four areas:

1. AML audit policies and procedures
   • compliance with local and international standards (5MLD, FATF, BSA, CFT measures);
   • the structure of internal AML/CFT control rules;
   • documented roles and responsibilities: director, compliance officer, BSA officer, operations teams.
2. Audit of AML control systems and processes
   • how KYC / CDD and KYC enhancement actually work for high-risk clients;
   • the quality of AML UBO audit and the UBO verification process;
   • AML audit of PEP and sanctions screening: tools, frequency, documentation of results;
   • parameters of transaction monitoring systems and responses to alerts.
3. Evaluation of AML program effectiveness (AML program evaluation)
   • how well the risk-based approach is implemented in AML, not just described;
   • the correctness of AML risk assessment by countries, products, and client segments;
   • AML staff training, knowledge testing, rotation of responsibilities.
4. Protecting the director and reducing liability
   • documenting that the director approved the AML policy, received reports, requested adjustments;
   • board of directors reporting protocols on AML/CFT issues;
   • building an evidence base for mitigating regulatory fines.

Independent AML audit: when is it mandatory?

In a number of EU and Asian countries, for certain categories of businesses an independent AML audit (external) is either required by law or strongly expected by regulators and banks.

Most often this applies to:

• banks and licensed payment institutions;
• virtual asset providers (crypto licenses, VASP);
• forex brokers and investment companies;
• licensed fintech providers;
• related entities in jurisdictions of the EU, the United Kingdom, Singapore, Dubai, Cyprus, and Estonia.

A separate group of cases that the COREDO team regularly works with:

• rapid growth of the customer base and expansion into new countries (scaling the business in the CIS, Asia, Africa);
• banks’ compliance requirements when opening or reviewing accounts;
• requests from investors or funds for investor Due Diligence AML before a funding round or an M&A transaction
• preparation for a thematic regulatory inspection or a response to comments already received.

In such situations an external AML audit serves as:

• independent confirmation that the director sees and manages risks;
• a tool to protect the director from AML fines: you have a report from an independent expert with a date, findings, and a plan of remedial actions;
• an argument in negotiations with banks and investors: the audit shows the maturity level of the system, not just a polished presentation.

How an AML audit reduces a director’s risk

If you imagine a typical company with a financial license in the EU or Asia, the director’s path to reducing risks through an audit looks like this:

1. Proactive AML audit (proactive audit)

   The director does not wait for a regulator’s visit and commissions a proactive AML audit themselves.

   • defines objectives: business protection, AML, reduction of personal liability, preparation for licensing/scaling;
   • determines the scope: a full audit or, for example, a focus on CDD, UBO and PEP in high-risk regions.
2. Diagnosis and gap analysis
   At COREDO we start with the current state:
   • analysis of the existing AML policy;
   • interviews with the compliance officer and operational teams;
   • selective review of client files (AML audit of CDD, UBO, PEP);
   • review of transactions from the perspective of AML/CFT and sanctions.
3. Identification of risks to the director
   We always dedicate a separate section in the report specifically to the director’s AML responsibility:
   • in which areas there is a high risk of claims against the director for lack of control;
   • which processes pose a threat to personal liability, not just to the company;
   • what gaps exist in board reporting and risk management documentation.
4. Corrective action plan (remedial actions)

   At this stage many COREDO clients see where the audit turns into practical protection:

   • a clear list of tasks: what needs to be changed in CDD, UBO verification, PEP screening, monitoring;
   • prioritization: which measures are critical to reduce the director’s personal risks within the coming months;
   • allocation of responsibility: who is responsible for implementation, how they report to the director regularly.
5. Formalization of the director’s and the board’s role

   To protect the director, it is important that decisions are not only made but also formalized:

   • minutes of meetings where the director approves the AML policy and the remedial actions plan;
   • regular board of directors reporting on AML/CFT;
   • compliance officer KPIs related to AML.
6. Follow-up AML audit and scaling

   In 6–12 months it makes sense to conduct a follow-up AML program evaluation:

   • check how the implemented measures are working;
   • adjust the AML risk-based approach taking into account new countries, products, PEPs and transactions;
   • prepare an updated package for banks, regulators and investors.

COREDO Case Studies: How Audit Protects

Case studies from COREDO’s practice: how audit truly protects — real client stories in which an independent review became not a «paper obligation», but a tool of legal and financial protection. Through concrete examples you will see how a properly conducted audit prevents sanctions, lowers risks for directors, and protects businesses in challenging situations.

Protecting the director of an EU payment company from sanctions

Client: a licensed payment services provider in the EU with plans to expand into Asia. Growth of operations, geographic expansion, emergence of clients from countries with elevated AML/CFT risk.

Problem: the correspondent bank requested detailed information on AML compliance, hinting at possible limit restrictions. The director understood that any incident would lead to questions directed at him personally.

Solution developed by COREDO:

• an independent AML compliance audit focusing on:
  • UBO AML audit for complex corporate structures;
  • PEP AML audit for clients from CIS countries and Asia;
  • review of transaction monitoring systems settings and sanctions filters;
• revision of the AML risk-based approach taking into account the planned expansion into new markets;
• updating internal AML/CFT control rules and redistributing responsibilities among the director, compliance officer, and BSA officer.

Crypto company in Asia: AML and UBO/PEP checks

Client: a crypto platform licensed in an Asian jurisdiction, targeting clients from Europe, Asia, and Africa.

Main challenges:

• complex UBO structures in African jurisdictions;
• a high proportion of PEPs among clients;
• regulatory requirements for regular CFT audits (countering the financing of terrorism).

The COREDO team implemented the following approach:

• a full AML audit for directors with a focus on personal liability and risk areas;
• AML CDD audit for clients from Africa and the CIS: in-depth verification of sources of funds, business models, and ownership structure;
• configuration of PEP screening tools and sanctions screening procedures to meet regulatory expectations;
• preparation of an updated AML/CFT policy taking a risk-based approach to clients from specific countries.

For the director, we additionally:

• compiled a package of documents demonstrating his involvement in approving and overseeing the AML program;
• developed a periodic board reporting framework for key AML KPIs;
• outlined a communication scenario with the regulator in the event of any incident.

ROI from AML audit and outsourcing

Many executives ask a direct question: how to calculate the ROI from conducting an AML audit for the business and from AML audit outsourcing?

1. Reducing direct regulatory risks
   • fines, sanctions, license restrictions;
   • temporary suspension of operations, account freezes;
   • costly remedial programs under strict regulatory supervision.
2. Access to banks and financial infrastructure
   • simplified KYC procedures by banks when you already have a recent AML audit report;
   • increased limits and expanded product range;
   • reduced likelihood of unexpected de-risking decisions by correspondent banks.
3. Investor and partner confidence
   • AML audit as proof to banks and investors of the maturity of corporate governance;
   • passing investor AML due diligence without protracted delays and contentious issues;
   • higher business valuation in deals: sustainable AML compliance, this is a protected cash flow.
4. Internal impact and scaling
   • reduction of operational losses due to errors in CDD, UBO and PEP checks;
   • optimization of the compliance team’s work and transaction monitoring IT systems;
   • ability to enter new countries and segments painlessly, including the CIS, with controlled AML/CFT and PEP risks.

COREDO’s practice shows: a properly structured AML audit pays off not only by avoiding fines, but also by providing access to more favorable banking, investment and partnership opportunities.

Weaknesses of an AML Program in an Audit

1. Formal AML risk assessment
   • risk assessments are not linked to actual countries, products, and channels;
   • the risk-based approach is declared but not implemented in CDD and monitoring procedures.
2. Insufficient depth of CDD and KYC enhancements
   • superficial verification of source of funds and wealth;
   • lack of a clear process for enhanced due diligence on higher-risk clients.
3. UBO verification process lacking sufficient checks
   • complex ownership chains are formally described but not verified down to the real ultimate beneficial owner;
   • weak AML auditing of UBOs for structures involving offshore or high-risk jurisdictions.
4. PEP screening and sanctions
   • outdated or unadapted PEP screening tools;
   • sanctions screening does not cover secondary sanctions and local lists;
   • incorrect classification of PEPs and their connections, lack of enhanced monitoring.
5. Internal AML controls and operational execution
   • there are regulations, but employees act on their own;
   • AML training for employees is conducted irregularly or only “for the record”;
   • weak link between alerts from the monitoring system and real managerial decisions.
6. Reporting to regulators and board reporting
   • unsystematic approach to reporting: the director receives fragments of information instead of a holistic picture;
   • insufficient documentation of AML/CFT decisions at the board of directors level.

How to use AML audit results

A strong competitive advantage comes not simply from having the report, but from the ability to properly integrate it into corporate governance.

What I recommend directors focus on:

• Integration into corporate governance
  • include the key audit findings on the board’s regular agenda;
  • link top management KPIs to the implementation of the remedial actions plan;
  • use the audit as a basis for updating the company’s risk appetite.
• Communication with banks
  • provide banks with excerpts from the audit as part of the company’s dossier;
  • show how you are implementing the recommendations, especially regarding CDD, UBO and sanctions;
  • update the information when there are material changes in the business model.
• Working with investors and partners
  • demonstrate that you treat AML/CFT as part of strategic management, not merely a legal burden;
  • use the report as part of the data room in M&A transactions or when raising capital.
• Scaling across the CIS, Asia and Africa
  • adapt a risk-based AML approach to account for PEP risks and weak state control systems in particular jurisdictions;
  • implement uniform CDD, UBO and PEP control standards across all subsidiaries;
  • synchronize local AML/CFT requirements with the group AML policy.

Where should a director start an AML audit?

If simplified to concrete steps, the recommendation for the director is as follows:

1. Define the objective: protecting the director, preparing for licensing, scaling, requests from a bank/investor.
2. Order a proactive AML audit externally if you need an independent perspective and credibility with regulators and partners.
3. Ensure the report includes:
   • a clear picture of AML/CFT and sanctions risks;
   • emphasis specifically on the director’s AML responsibilities;
   • a practical, prioritized plan of remedial actions.
4. Formalize decisions at the board level and establish accountability.
5. Schedule a follow-up audit in 6–12 months.

Conclusion: how to turn upsells into systematic profit growth

If you sum up the whole guide, it becomes clear: increasing the average order value is not a single “magic” tool, but a system of interrelated mechanics, each of which amplifies the others. Upsell, cross-sell, bundles, minimum order amount, loyalty program, AI recommendations and work on the checkout path deliver maximum effect only when combined, not individually.

Sustained AOV growth starts when:

• upsells are integrated into the user journey from the product page to checkout;
• each offer is based on data (behavior, segment, LTV), not intuition;
• all hypotheses are tested via A/B tests and control groups;
• ROI is calculated not by feel, but by a formula that takes margin and the customer lifecycle into account.

How to start right now

If you turn this material into concrete steps, I recommend the following sequence:

1. Record the current AOV, CR and LTV — this is your baseline.
2. Launch one mechanic with the maximum potential (an upsell in the cart or bundles).
3. Set up an A/B test and a control group.
4. Scale only after a confirmed incremental effect.
5. Add AI recommendations and loyalty programs once the basic mechanics are already delivering results.

The goal — growth in net profit and LTV, not pretty numbers in the report.

If you want to understand, which exact upsell and cross-sell mechanics will deliver the maximum ROI in your store, start with an audit of the checkout path and order structure. In most projects it’s already visible at this stage where the “low-cost” +20% to AOV are — without risk and without complex implementations.

As CEO and founder of COREDO, I see every day how entrepreneurs from Europe, Asia and the CIS face barriers when entering international markets. Registering a company in the EU, obtaining a financial license, or opening a corporate account in Lithuanian banks turns into a marathon of checks where a single flaw in the documents can delay the process by months. Our experience at COREDO since 2016, covering the Czech Republic, Slovakia, Cyprus, Estonia, the United Kingdom, Singapore and Dubai, confirms: a Legal Opinion from an accredited Lithuanian lawyer becomes that very lever that speeds up approval and minimizes risks. In this article I will explain how to properly prepare a Legal Opinion for Lithuanian banks, relying on the practice of the COREDO team and the current requirements of the Bank of Lithuania for 2025.

Legal opinion on Lithuanian banks

legal opinion is an official lawyer’s opinion confirming that your structure complies with Basel III, CRR III requirements and local rules. Without it banks reject applications: in our observations, 40% of rejections are related to compliance gaps.

The COREDO team recently assisted a client from Singapore launching an EMI (Electronic Money Institution). The bank required a Legal Opinion to open an account with a Lithuanian bank, focusing on the company’s structure in the Legal Opinion and verification of beneficiaries. We integrated KYC analysis in Lithuanian banks, KYC for corporate clients and beneficial owners verification, which made it possible to open the account in 3 weeks instead of 2 months. This approach not only saves time but also increases ROI: the client scaled operations by 150% in the first quarter.

Legal Opinion for Lithuanian banks

• Introduction and identification of the entity: Full description of the company, founders, UBO (ultimate beneficial owners). Specify enhanced UBO verification with links to eIDAS or video-verification: this is a must-have after the 2025 updates.
• corporate structure and governance: Analysis of governance requirements, organizational structure in the licensing criteria and internal controls. For high-risk businesses such as crypto, add risk-weighted assets according to prudential standards and EU banking union norms.
• Compliance section: A detailed review of KYC/AML in Legal Opinion for banks, including AML for banks, AML manager appointment and automated monitoring. Banks check sanctions lists screening and transaction limits for corporate accounts.
• Financial and operational risks: Assessment of minimum capital in Lithuania (from €350,000 for an EMI), crypto share capital for the crypto license in Lithuania under the MiCA regulation. Mention the CASP transition period until 2025 and differentiated capital.
• Regulatory aspects: Coverage of DORA compliance in Lithuania for outsourcing rules, operational resilience and cybersecurity requirements. Add climate risk management in prudential standards, as required by CRD VI transposition.
• Conclusion: Confirmation of the absence of obstacles to opening an account or obtaining a license, signed by a lawyer.

Legal Opinion for EMI and crypto licenses

Licensing in Lithuania, the EU gold standard for payment services and crypto. Bank of Lithuania’s requirements for a Legal Opinion are mandatory for PI and EMI licenses. EMI requires capital of €350,000; PI requires €20,000–125,000 depending on services. A Legal Opinion for bank compliance in Lithuania confirms creditworthiness assessment, consumer lending rules and fair customer treatment.

The COREDO team helped a client from Estonia obtain a crypto license in Lithuania, integrating the Legal Opinion structure for MiCA compliance in Lithuania 2025: with a focus on governance requirements and data confidentiality.

For PSD3 changes and PSD2 Open Banking a Legal Opinion covers automated transaction monitoring, misleading marketing avoidance and a cooling-off period for loans. Our experience has shown: the ROI from a Legal Opinion for accelerating licensing in Lithuania reaches 300%, by shortening the time by 2–3 months.

From registration to scaling

Registration is just the start. In 2025, banking requirements for new companies in the EU include a business plan and proof of source of funds. COREDO предлагает полный цикл: от подбора юрисдикции (Lithuania for fintech, Cyprus for holdings) до банковский комплаенс. Мы проводим due diligence, готовим комплаенс-документы для EMI/PI в Литве и обеспечиваем долгосрочную устойчивость через Legal Opinion для PSD3 в ЕС.

Final ideas of the strategy

A Legal Opinion for CRR III compliance in Lithuania – an investment in the future. Long-term consequences of a non-compliant Legal Opinion under Basel III: account refusals, license delays and reputational losses. With COREDO you get a partner who understands the impact of a Legal Opinion on scaling fintech in the EU. We integrate KYC for corporate clients, prudential standards and solidarity contributions, ensuring transparency.

An investment company can indeed work with crypto-assets in the EU, but today this is no longer a ‘gray area’, it is a strictly regulated activity: MiCA, DORA, AML/CFT and DAC8 set clear yet fairly strict rules of the game for investment companies and crypto-asset service providers (CASPs).

Below: my practical view as the founder of COREDO on how an entrepreneur, CEO or CFO can build a sustainable, regulated model for working with crypto-assets in the EU: from company registration to licensing, AML/KYC, custody infrastructure and reporting.

Investment company strategy with crypto-assets in the EU

1. Type of activity
   You need to clearly answer what exactly you want to do:
   • manage clients’ investment portfolios of crypto‑assets;
   • act as a CASP (Crypto‑Asset Service Provider) – exchange, broker, custodian;
   • issue tokens or stablecoins;
   • launch funds, SPVs, tokenize assets;
   • integrate crypto‑payments into an existing business.
2. Target jurisdiction in the EU
   Conditions and requirements vary significantly by country. In practice COREDO most often works with:
   • Estonia, Malta, Cyprus – as more “friendly” jurisdictions toward digital assets;
   • Germany (BaFin), sometimes France – as examples of stricter regulation and high capital and governance requirements.
3. Regulatory perimeter: what will apply to you
   For most clients, the picture looks like this:
   • MiCA (Markets in Crypto‑Assets Regulation) – defines who a CASP is, how to obtain authorization, and how passporting works across the EU.
   • AML/CFT + KYC/EDD – anti-money laundering and counter-terrorist financing requirements, including the Travel Rule and on‑chain monitoring.
   • DORA (Digital Operational Resilience Act) – digital and operational resilience, IT and cyber security.
   • DAC8: automatic exchange of crypto-asset data and expanded reporting on crypto transactions.
   • National laws on securities, taxation, and the financial services market.

Where in the EU is it easiest for an investment company to operate with crypto-assets?

Comparison of popular jurisdictions