Key Takeaways
- AML and KYC obligations in the BVI apply to relevant persons conducting relevant business, which can include foreign-owned company structures.
- Customer due diligence requirements vary by risk, with enhanced due diligence for higher-risk relationships and simplified measures where permitted.
- Relevant persons must appoint a Money Laundering Reporting Officer, maintain internal controls, keep records, and report suspicious activity to the Financial Investigation Agency.
- Registered agents play a central role in BVI AML compliance, and non-compliance can carry penalties for the business and those responsible.
AML and KYC Obligations in the British Virgin Islands: An Overview
Anti-money-laundering and know-your-customer rules apply fully in the British Virgin Islands, and they reach more entities than a foreign owner might expect. The regime rests on the Proceeds of Criminal Conduct Act 1997 and the Anti-Money Laundering Regulations 2008, supervised by the Financial Services Commission and supported by the Financial Investigation Agency. It binds "relevant persons" carrying on financial business in or from the territory, a category that captures banks, trust companies, fund managers, virtual-asset service providers and, importantly for most readers, the registered agent that every company must engage. You can review the official guidance through the regulator's AML/CFT portal.
This article explains how the framework works in practice: who is caught, what customer due diligence looks like, the controls a regulated entity must run, and the consequences of getting it wrong. It is most relevant to owners of regulated BVI businesses and to those whose ordinary company sits behind a registered agent that must verify them.
The BVI AML Legal Framework and Supervisory Authorities
The foundation is the Proceeds of Criminal Conduct Act, which defines money-laundering offences and the machinery for confiscating criminal assets. Sitting beneath it, the Anti-Money Laundering Regulations and the Anti-Money Laundering and Terrorist Financing Code of Practice set out the practical duties: customer due diligence, record-keeping, internal controls and reporting.
The rules were tightened in September 2024. Amendments to both the Regulations and the Code raised qualification standards for compliance officers, sharpened beneficial-ownership transparency, and expanded obligations around suspicious-activity reporting and virtual assets.
Two authorities matter to a foreign owner. The Financial Services Commission, established in 2001, supervises and regulates all financial services provided in or from the territory; it conducts risk-based inspections, enforces compliance, and can fine or delicense.
The Financial Investigation Agency is the second pillar. Created under the Financial Investigation Agency Act 2003, it receives suspicious-activity reports, runs financial-crime investigations, and exchanges intelligence with foreign counterparts as a member of the Egmont Group.
Separate statutes address adjacent risks, including the Counter-Terrorism Financing Act 2021 and the Proliferation Financing (Prohibition) Act 2021. Sanctions implementation sits with a dedicated Sanctions Unit in the Attorney General's office, working to financial sanctions guidelines aligned with United Nations Security Council resolutions.
The territory commits to the FATF Recommendations, the global benchmark for anti-money-laundering and counter-terrorist-financing standards. That commitment shapes how the local rules are written and enforced.
BVI Company Incorporation in British Virgin Islands
Set up your company in British Virgin Islands with Expanship handling registration end to end.
Who Is Caught: Relevant Persons and Relevant Business
The Code of Practice fixes who must comply. It covers entities the Commission regulates, entities that FATF or its Caribbean body identifies as part of the fight against financial crime, and any business the regulator designates by notice in the Gazette as vulnerable to abuse.
Regulated categories include banks, trust companies, investment businesses, mutual funds, and virtual-asset service providers. A licensed VASP, under the Virtual Assets Service Providers Act 2022, must carry out full customer due diligence on the same footing as a bank.
Certain non-financial businesses are also caught when they conduct relevant financial business. Lawyers, accountants, real-estate agents and company-service providers fall within scope, with the Commission acting as supervisor for most of these designated professions.
A pure holding company with no external customers is generally not itself a "relevant person." Its registered agent, however, is one, and must perform due diligence on the company and every beneficial owner regardless.
The practical lesson for a foreign owner is straightforward. Even if your BVI company never trades and falls outside direct supervision, the agent that maintains it must still identify and verify you.
KYC and Customer Due Diligence Requirements
Due diligence happens before the relationship begins, not after. A regulated entity must collect and verify a customer's full name, date of birth, address and identity documents prior to opening an account or executing a transaction.
Standard customer due diligence runs along four lines:
- Identify and verify the customer using reliable, independent documents or data.
- Identify and verify beneficial owners, meaning individuals who ultimately own or control at least 25 percent of a legal person, or who otherwise exercise control.
- Understand the nature and purpose of the relationship.
- Establish source of funds and source of wealth for higher-risk relationships.
The depth of verification is not fixed. A risk-based approach governs the entire exercise, so the intensity of checks rises or falls with the risk posed by the customer, product, delivery channel and geography.
Verification has moved with technology. The Commission has amended the Code to let credit and financial institutions use electronic methods to verify identity, recognising how onboarding now works in a fintech setting.
Beneficial ownership feeds a central register. Information collected by registered agents flows into the Beneficial Ownership Secure Search System, where it is held for access by competent authorities.
If due diligence cannot be completed, the rule is firm: decline or terminate the relationship, and consider whether a suspicious-activity report is warranted. There is no discretion to proceed on incomplete information.
BVI Ongoing Compliance in British Virgin Islands
Keep your British Virgin Islands entity compliant with filings, returns, and statutory obligations.
Enhanced Due Diligence and Simplified Due Diligence
Some relationships demand more. Enhanced due diligence is mandatory where the risk is elevated, and the Code lists the principal triggers.
- Politically exposed persons, foreign and domestic, together with their family members and close associates.
- Customers connected to countries FATF identifies as high-risk or subject to a call for action.
- Non-face-to-face or remote onboarding.
- Correspondent banking relationships.
- Unusual or complex transactions with no apparent legitimate purpose.
Where these apply, the entity must dig deeper. Enhanced measures include gathering additional identity information, verifying source of wealth and funds, securing senior-management approval before the relationship proceeds, and reviewing the account more frequently under intensified monitoring. The 2024 amendments codified specific protocols for high-risk relationships and transaction monitoring.
Lower-risk cases work in the opposite direction. Simplified due diligence may apply where a customer or product is assessed as low risk, typically listed companies on recognised exchanges, regulated institutions in equivalent jurisdictions, and certain government bodies.
Simplification has limits. It reduces the depth of verification and monitoring but never removes the duty to identify the customer, and it cannot be used at all where there is any suspicion of money laundering or terrorist financing.
Specific section numbers for simplified due diligence within the 2024-revised Code are not fully reproduced in public sources; consult the gazetted Code directly via bvifsc.vg before relying on a particular threshold.
Appointing a Money Laundering Reporting Officer and Internal Controls
Every relevant entity must appoint a Money Laundering Reporting Officer. The role requires at least a diploma-level qualification and a minimum of three years' post-qualification experience covering money laundering, terrorist financing and proliferation financing.
The appointment is not at the entity's sole discretion. Approval must come from the Commission or the Financial Investigation Agency, depending on which body supervises the business.
Small operators get measured relief. An entity with three or fewer employees may apply to have a senior officer or director serve as the reporting officer, provided that person meets the qualification standards.
Departures must be flagged quickly. If the reporting officer leaves, the relevant regulator must be notified within 14 days, and the 2024 amendments set out how replacements are appointed and how regulators assess qualifications.
Around the reporting officer sits a control framework. The Regulations and Code require:
- Written policies, procedures, controls and risk assessments.
- An independent audit or review function to test those controls.
- Annual training for all staff on money laundering, proliferation financing, terrorist financing and sanctions.
- Escalation routes for internal suspicious-activity reports to the reporting officer.
- Senior-management oversight and sign-off on the programme.
The 2024 reforms shifted the test of compliance. Entities must now demonstrate that their controls are effective in practice, not merely that the paperwork ticks the regulatory boxes.
BVI British Virgin Islands Incorporation Pricing
See transparent pricing to incorporate and maintain a company in British Virgin Islands.
Ongoing Monitoring of Business Relationships
Due diligence does not end at onboarding. A regulated firm must monitor relationships throughout their life, in line with the FATF Recommendations.
Monitoring carries several duties. Transactions must be scrutinised for consistency with what the entity knows of the customer and their risk profile, and unusual or complex transactions must be examined for background and purpose. Customer records must be kept current, and relationships reviewed periodically at a frequency that matches assessed risk.
High-risk relationships attract specific, enhanced protocols. Screening against international sanctions lists forms part of ongoing surveillance, particularly for dealings touching high-risk countries.
Certain events force an immediate look. A material change in customer behaviour, ownership or risk profile must prompt a fresh review and, where justified, re-performance of due diligence. Minimum transaction-monitoring thresholds in dollar terms are not reproduced in public sources, so the gazetted Regulations should be consulted for any precise figure.
AML Record-Keeping Requirements
Records anchor the whole regime. The standard retention period is five years, measured from the end of a business relationship or the date of an occasional transaction, consistent with FATF Recommendation 11 as implemented locally.
| Record type | Must be kept | Period |
|---|---|---|
| CDD/KYC documents (identity, corporate, UBO) | Yes | 5 years from end of relationship |
| Transaction records (sufficient to reconstruct) | Yes | 5 years |
| Internal and external SARs and supporting analysis | Yes | 5 years |
| Correspondence and authority inquiries | Yes | 5 years |
| Staff training records | Yes | 5 years |
| Risk assessments (business-wide and customer-level) | Yes | 5 years |
Format is flexible, substance is not. Records may be held electronically or on paper, but they must be readily retrievable when the Commission, the Financial Investigation Agency or law enforcement asks for them.
The five-year rule is the long-standing local standard. Where the exact section in the 2024-amended Regulations matters to a decision, the current gazetted text on bvifsc.vg is the authority to check.
Suspicious Activity Reporting to the Financial Investigation Agency
Suspicion triggers a reporting duty. Where a transaction is unusual, lacks a clear legitimate purpose, or involves a high-risk country or a sanctioned individual, the entity must report it to the Financial Investigation Agency, the territory's financial intelligence unit.
The process runs through the reporting officer. Staff file internal reports; the officer assesses them and, where suspicion is confirmed, submits an external report to the Agency. The Agency in turn shares intelligence with the Commission and with foreign counterparts.
Two hard rules accompany reporting. Tipping off a customer or third party that a report has been made, or that an investigation is under way, is a criminal offence under the Act and the Regulations.
A consent route exists for difficult cases. Where proceeding with a transaction might itself amount to a money-laundering offence, the reporting officer can seek the Agency's consent to proceed, a request sometimes described as a defence against money laundering.
The precise electronic filing portal and any mandatory reporting deadline are not confirmed in public sources. Confirm the current procedure directly with the Agency at fia.gov.vg before relying on a specific timeframe.
The Role of the Registered Agent in AML Compliance
For most foreign owners, the registered agent is where the regime bites. Every Business Company must appoint a registered agent licensed by the Commission, and that agent is itself a relevant person bound by the full Regulations and Code for each client company it services.
The agent must know its client companies. It performs and maintains due diligence on the company's constitutional documents and on every beneficial owner, director and authorised signatory.
Beneficial ownership flows upward through the agent. Under the Beneficial Ownership Secure Search System Act 2017, registered agents submit ownership information to the central system and keep it accurate; the company must notify its agent of any change within 15 days.
Agents may lean on others, within limits. Reliance on due diligence performed by a regulated introducer in an equivalent jurisdiction is permitted where a written reliance agreement exists, the introducer meets equivalent standards, and records are available on request, but ultimate responsibility stays with the agent.
Oversight is continuous. Registered agents file an annual compliance declaration with the Commission and submit to its risk-based inspections, while all their staff must complete annual training on money laundering, proliferation, terrorist financing and sanctions. The exact form number for that declaration is not confirmed in public sources and should be verified via bvifsc.vg.
Penalties for AML and KYC Non-Compliance
The consequences span criminal and regulatory tracks. Under the Proceeds of Criminal Conduct Act, a money-laundering conviction carries up to 14 years' imprisonment and an unlimited fine for an individual; failure to disclose or tipping off can draw up to five years' imprisonment and a fine.
| Offence | Maximum penalty |
|---|---|
| Money laundering | 14 years' imprisonment and/or unlimited fine |
| Failure to report / tipping off | 5 years' imprisonment and/or a fine |
Regulatory exposure runs alongside the criminal one. The Commission may levy administrative financial penalties on entities and individuals, and it may suspend or revoke a financial-services licence for serious failings, which ends an institution's ability to operate in the territory.
Individuals face personal fallout. Directors, the reporting officer and senior managers responsible for failings may be judged not fit and proper, barring them from regulated roles.
The published enforcement decisions and the text of the Regulations on bvifsc.vg are the authoritative source for specific penalty amounts, which are not reproduced in full in public summaries. Systemic failure also carries a jurisdictional cost, since it can invite heightened FATF scrutiny with knock-on effects for all locally connected entities.
Conclusion
The weight of the regime usually rests not on your company but on the licensed firm that maintains it, which means your most consequential obligation is to give your registered agent complete, current beneficial-ownership and identity information, and to update it within 15 days of any change. Withholding or delaying that information is what triggers real friction, since the agent cannot keep you on its books without it.
Before you incorporate or restructure, weigh whether the activity you plan brings the entity itself into a regulated category such as a fund or virtual-asset business; that single question decides whether you carry the full reporting and control burden directly or rely on your agent to carry most of it for you.
How Expanship Can Help Your Business in the British Virgin Islands
Expanship supports foreign owners through the customer due diligence their registered agent requires, helps assemble and refresh beneficial-ownership records, and keeps your file aligned with the Regulations and Code so onboarding and renewals proceed without avoidable delay. The same team handles the wider set of obligations that come with owning an entity in the territory.
- Company formation and structuring for non-resident owners
- Registered agent and registered office services
- Ongoing compliance and filing management
- Accounting and bookkeeping support
- Economic-substance and beneficial-ownership assistance
- Banking introductions for new and existing companies
To discuss your AML and KYC position or any related requirement, contact Expanship British Virgin Islands.
Frequently Asked Questions
Usually not, if it has no external customers and no financial-service activity, because a pure holding company is generally not a relevant person. Your registered agent, however, is a relevant person and must perform full due diligence on the company and its beneficial owners, so you will still be subject to identity and ownership verification.
The Financial Services Commission is the primary supervisor, regulating all financial services provided in or from the territory and enforcing compliance through inspections and penalties. The Financial Investigation Agency is the financial intelligence unit that receives suspicious-activity reports and investigates financial crime.
A beneficial owner is an individual who ultimately owns or controls at least 25 percent of a legal person, or who otherwise exercises control over it. Registered agents must identify and verify these individuals and submit the information to the Beneficial Ownership Secure Search System.
The standard retention period is five years, measured from the end of a business relationship or the date of an occasional transaction. This covers due diligence documents, transaction records, suspicious-activity reports, correspondence, training records and risk assessments, in either electronic or paper form.
Enhanced measures are mandatory for higher-risk relationships, including politically exposed persons, customers connected to FATF high-risk countries, remote onboarding, correspondent banking, and unusual transactions without an apparent legitimate purpose. These cases call for additional information, source-of-wealth checks, senior-management approval and closer ongoing monitoring.
A money-laundering conviction under the Proceeds of Criminal Conduct Act can bring up to 14 years' imprisonment and an unlimited fine, while failure to report or tipping off can draw up to five years. Regulated entities also face administrative penalties and possible licence revocation from the Commission, and responsible individuals can be barred from regulated roles.
Legal Disclaimer
The information provided in this article is for general informational purposes only and does not constitute legal, tax, or professional advice. While we strive to ensure the accuracy and timeliness of the content, laws and regulations are subject to change, and the application of laws can vary widely based on specific facts and circumstances.
Readers should not act upon this information without seeking professional counsel tailored to their individual situation. Expanship and its authors disclaim any liability for actions taken or not taken based on the content of this article.
For specific advice regarding your business setup, compliance requirements, or any legal matters, please consult with qualified legal and tax professionals in the relevant jurisdiction.
