A BVI customer file can pass a 25% ownership screen and still miss someone the AML Regulations treat as a beneficial owner. The definition includes a 10% ownership or voting-rights test for relevant non-listed companies, alongside control through other means. A checklist copied from another jurisdiction can leave that gap unnoticed.
This guide is for compliance teams at British Virgin Islands funds, administrators, banks, investment businesses, and trust and company service providers. It also explains where the Financial Investigation Agency (FIA) supervises designated non-financial businesses and professions (DNFBPs). For help completing the file work, see our BVI KYC services.
Identify the rules and supervisor for your business
The BVI AML framework includes the Proceeds of Criminal Conduct Act, the Anti-money Laundering Regulations and the Anti-Money Laundering and Terrorist Financing Code of Practice, each as amended. Counter-terrorism, proliferation-financing and applicable sanctions legislation sit alongside those instruments. The FIA legislation library publishes the texts and amendments.
The Financial Services Commission (FSC) supervises regulated financial services businesses. The FIA supervises DNFBPs for AML/CFT/CPF purposes and receives suspicious activity reports. A firm’s supervisor and its reporting destination serve different functions. The FIA’s DNFBP obligations page explains its remit and registration requirements.
Assess whether the entity carries on “relevant business” under the AML Regulations. Incorporation in the BVI alone does not answer that question. A holding company may need to supply KYC evidence to its registered agent or bank without having the same AML programme obligations as those providers. Separate corporate and beneficial-ownership filing obligations can still apply.
Check the date inside a PDF. The Code file labelled “latest consolidation” in the FIA library states a consolidation date of 15 August 2018. We read it with the 2022, 2023 and 2024 Code amendments and the later Regulations, including the 2025 amendment. An upload date does not establish the law’s currency. Verify subsequent changes and commencement provisions before using a source for a live decision.
Build CDD around the customer and expected activity
Section 19 of the Code addresses customer due diligence (CDD). Identify and verify the customer and relevant beneficial owners, understand the purpose and intended nature of the relationship, and assess its risk. For a legal person, establish its existence and understand its business, ownership and control structure. Record who is authorised to act for it.
The review should reflect the relationship. A fund subscription calls for an investor assessment; a bank account needs an expected activity profile. A trust or company services engagement requires an understanding of the structure, its purpose and the relevant parties. Agree which entity’s obligations each review is intended to meet when a fund and its administrator share documents.
Apply CDD when establishing a business relationship and in the other circumstances specified by the Regulations and Code, including relevant one-off transactions, suspicion and doubts about existing identification evidence. Thresholds differ by activity. A low-value transaction is not a reason to disregard suspicion or linked transactions.
For a working file, we recommend an evidence index linking each conclusion to a document or source. Record missing evidence as an open issue with an owner. A file should not be marked complete while its ownership assessment still depends on an unanswered question.
Trace beneficial ownership beyond a percentage filter
The 2022 AML Regulations amendment sets out the beneficial-owner definition. For a relevant non-listed legal person, it includes a natural person who ultimately owns or controls, directly or indirectly, 10% or more of its shares or voting rights. The partnership tests include capital, profits and voting rights. Control over management is also relevant.
The 2023 amendments clarify control with or without an ownership interest. Trace indirect holdings, voting arrangements and other means of influence. Do not stop at the registered shareholder if it acts for someone else. Sections 25 and 25A of the Code address legal persons and disclosures connected with director or nominee shareholder services.
Trusts require a different assessment. Consider the settlor, trustee, protector where present, beneficiaries or relevant classes, and other people exercising control under the applicable provisions. Sections 28 and 28A address trust verification and trustee information duties. Applying a company shareholding threshold to a trust will miss relevant roles.
Keep AML verification separate from corporate registry filings. A filing can inform the review, but the firm must still meet its own CDD requirements and resolve discrepancies in the evidence.
Escalate higher-risk files with the evidence attached
Sections 20 and 22 address enhanced CDD and politically exposed persons (PEPs). Assess the customer, beneficial owners, activity, structure and geographic connections. Apply the additional measures and approval requirements relevant to the risk and the particular PEP category; domestic, foreign and international-organisation PEP provisions should not be collapsed into one unchecked rule.
Source of funds explains the origin of money used in the relationship or transaction. Source of wealth explains how a person accumulated their wealth. Obtain the information and corroborating evidence required for the case. A payment arriving from a bank account does not necessarily explain where the money originally came from.
Record how screening matches were resolved and which concerns need escalation. Sanctions can require action beyond an ordinary risk-rating decision. Follow the applicable BVI sanctions regime and current official reporting instructions; a SAR does not automatically discharge separate sanctions obligations.
Set review dates and act on changes before they expire
Section 21, replaced in part by the 2022 amendment, requires ongoing CDD: scrutinising transactions, screening customers, and updating information on a risk-sensitive basis and upon trigger events. Its Explanation, paragraph (xiii), as amended in 2023, calls for higher-risk customers to be reviewed at least annually and remaining customers within a four-year cycle, prioritised by risk.
Build your review schedule around those expectations and the firm’s approved policy. A change in beneficial ownership, a customer becoming a PEP, a sanctions issue or unusual activity can require action before the scheduled review. The joint FSC/FIA guidance on ongoing monitoring explains the customer profile, transaction scrutiny and trigger events that support that work.
Periodic KYC refreshes cover only part of ongoing monitoring. If another provider reviews documents, specify who continues to monitor activity, assess alerts and escalate concerns. An updated passport cannot explain a transaction inconsistent with the customer’s known business.
Keep the MLRO and reporting route clear
Regulation 13 governs Money Laundering Reporting Officer (MLRO) appointments. The 2024 amendment introduced an approval framework through the FIA or FSC according to the entity’s status, subject to the applicable exceptions. The 2025 amendment addresses application and approval fees. Check the amended provisions and the relevant authority’s current process; an older appointment-and-notification checklist is insufficient.
The FIA’s SAR guidance explains that a reporting obligation can arise from knowledge or suspicion acquired in the course of business, trade, employment or a profession. Staff need an internal escalation route, and the MLRO needs access to the information required to assess and report concerns. Follow the applicable reporting duties promptly and protect against tipping off.
Use the FIA’s current filing instructions for the submission channel and form. Do not wait for a remediation project to finish before escalating suspicion. Managed KYC file work does not appoint or replace your MLRO, and an engagement cannot remove anyone’s own statutory reporting obligations.
Preserve records after the relationship ends
Regulation 10 requires relevant records for at least five years after the completion of a one-off transaction or linked transactions, or after termination of the business relationship. Reporting or investigation circumstances can require records to be held longer. Check the starting point and any hold before deleting a file; five years from onboarding is not the general rule.
Regulation 11 and Part VI of the Code address retrieval and record keeping. Preserve the identification evidence, transaction records and other records required for the relationship. Our operational recommendation is to retain the review history, match decisions, approvals and exception log with the evidence so that a later reviewer can reconstruct the work.
Agree who holds the records, how your firm retrieves them and what happens when a provider relationship ends. A link to a supplier’s portal is insufficient if access expires before your retention obligation does.
Outsource KYC with access and oversight in the contract
Section 46 permits outsourcing subject to conditions. These include a written agreement, a qualified and competent provider, compliance with the applicable jurisdiction-risk condition and records that remain accessible for the firm and the authorities. The 2023 amendment changed the jurisdiction wording, so do not rely solely on the older recognised-jurisdiction list. Confidentiality or data-protection restrictions must not impede required access or effective compliance.
The entity or professional retains ultimate responsibility. Agree the policy, case population, checks, escalation routes, review quality and record-access arrangements before customer data is transferred. Assess any additional sector-specific outsourcing requirements for your firm.
Reliance on an introducer under Regulation 7 is a separate arrangement with its own conditions. An introduction or a completed KYC pack does not automatically satisfy those conditions. Confirm what information must be obtained, how underlying evidence can be accessed and which responsibilities remain with the relying firm.
The AML programme also needs governance, staff training and testing of controls. A sample-based file review can identify CDD gaps, but its scope is narrower than a programme-wide independent AML audit.
Turn the backlog into a defined review project
Start with the legal entity, customer population, policy version and target date. Separate overdue reviews from missing ownership evidence and cases needing immediate escalation. Set a completion standard that distinguishes resolved files from files awaiting your team’s decision.
AgentKYZ’s BVI managed KYC service covers onboarding, CDD remediation and periodic reviews. Agents organise evidence and perform the first pass; qualified compliance reviewers check the work. Your authorised team keeps acceptance and escalation decisions. Share the case count and deadline to agree the scope, price and handover arrangements before sending customer files.