Do’s and Don’ts of Offshore Corporate Record Keeping

Offshore structures can be powerful tools for cross‑border commerce, investment, and asset protection—until something goes wrong. When a bank freezes an account, a regulator asks for evidence, or a buyer runs diligence, everything comes down to your records. I’ve reviewed hundreds of offshore files over the years, and the difference between smooth operations and expensive problems usually isn’t tax strategy or legal drafting—it’s whether the company kept clean, timely, and defensible records.

Why offshore record keeping matters

Offshore doesn’t mean off‑grid. Most reputable jurisdictions require you to maintain accounting records, underlying transaction documents, and up‑to‑date statutory registers. Authorities can demand access, and if you can’t produce records quickly, you can face fines, account closures, or even striking off.

Banks expect strong records to satisfy KYC/AML and sanctions rules. They routinely re‑verify clients every 1–3 years or on any risk trigger. If your documentation is messy or out of date, you’ll spend weeks scrambling to avoid a block on payments. I’ve seen unnecessary fire drills where simple, well‑kept registers and reconciliations would have settled a bank’s questions in a single email.

You also need records to maintain the corporate veil. When transactions aren’t documented, funds are commingled, or decisions aren’t properly minuted, you create ammunition for opponents to argue that the company is a sham. Conversely, disciplined records help you demonstrate substance, arm’s‑length behavior, and legitimate business purpose.

What “records” really mean offshore

“Records” is a broader concept than many founders realize. Think beyond financial statements.

Statutory registers

Ultimate beneficial owner (UBO) or “controller” details where required

Governance documents

Memorandum and articles, bylaws, shareholder agreements

Board and shareholder minutes, written resolutions, consents

Powers of attorney, delegations, specimen signatures

Accounting and tax

General ledger, trial balance, and supporting schedules

Invoices, contracts, purchase orders, delivery notes, receipts

Bank statements, reconciliations, payment approvals

VAT/GST filings, corporate tax returns, transfer pricing files

Compliance and KYC/AML

Due diligence on owners, directors, key counterparties

Sanctions/PEP screening logs and refreshes

CRS/FATCA classifications and self‑certifications

Operational and IP

Intercompany agreements (services, loans, licensing)

Employment or contractor agreements and payroll records

IP assignments, license grants, royalty calculations

Communications and approvals

Email approvals for key transactions (properly archived)

Board packs and management reports

If you run a fund, SPV, or fintech, add sector‑specific items: offering documents, investor KYC files, custodial statements, smart contract audits, or travel rule data.

The Do’s: Build a compliant, efficient system

Map your obligations by jurisdiction

Start with a clear compliance map. Each jurisdiction has its own definitions, retention rules, and filing deadlines.

British Virgin Islands (BVI): Keep accounting records and underlying documentation for at least 5 years and notify your registered agent where records are kept. Maintain registers and meet economic substance reporting, if applicable.

Cayman Islands: Maintain books and underlying records for at least 5 years. Keep the beneficial ownership register where required and file annual returns. Funds have additional CIMA reporting.

Hong Kong: Keep accounting records for 7 years. Maintain a Significant Controllers Register accessible at the registered office.

Singapore: Retain accounting and tax records for 5 years from the end of the financial year. Maintain a register of registrable controllers.

UAE (varies by free zone): Typically 5 years retention, plus UBO submissions and economic substance reporting for relevant activities.

These are baseline expectations; specific rules vary. Create a one‑page jurisdiction sheet with retention periods, where records must be kept, filing dates, and penalties.

Establish a records architecture that scales

If you don’t design a file plan early, you’ll drown in random PDFs. Build a folder structure that mirrors how auditors, banks, and buyers will review your company.

Example high‑level structure:

00 Corporate

01 Incorporation & Constitution

02 Registers (Members, Directors, UBO, Charges)

03 Minutes & Resolutions

04 Powers of Attorney & Signatories

05 Licenses & Regulatory Filings

10 Finance

11 Accounting (GL, TB, Journals)

12 Bank (Statements, KYC, Mandates)

13 Taxes (Returns, Assessments)

14 Invoices & Receipts

15 Intercompany & Transfer Pricing

20 Legal & Contracts

21 Customers

22 Vendors

23 Employment & Contractors

24 IP & Licensing

30 Compliance

31 KYC on Owners/Directors

32 Counterparty AML/Sanctions Checks

33 CRS/FATCA Declarations

34 Economic Substance

40 Operations

41 Board Packs & Reports

42 Policies (Record Retention, AML, Data Protection)

99 Archive (Closed items, with retention date tags)

Name files in a consistent, sortable way: YYYY‑MM‑DDDocumentTypeCounterpartyAmountCurrencyVersion.pdf Example: 2025‑03‑31BoardMinutesQ1Resultsv1.pdf

Version control matters. Use v1, v2, and mark executed versions as “Signed”.

Use a secure document management system

Consumer cloud drives get messy fast. Use a business‑grade DMS with:

Permissioning by folder, with least‑privilege access

Multi‑factor authentication and single sign‑on

Encryption at rest and in transit; consider client‑side encryption for sensitive UBO files

Audit logs and file version history

Retention policies and legal hold

Data residency options where required

Good options: Google Workspace, Microsoft 365 (SharePoint/OneDrive), Box, or Dropbox Business. Expect $12–$25 per user/month for a baseline plan with admin controls. Add an e‑signature tool (DocuSign/Adobe Sign) to standardize approvals.

Keep statutory registers current

Stale registers are the number one issue I find in offshore files. Update registers immediately after:

Share issuances, transfers, or cancellations (including option exercises)

Director/secretary appointments and resignations

Creation or satisfaction of charges

UBO changes

Don’t rely on the registered agent to “figure it out.” Send them signed resolutions and updated registers within a week of any change. Build a one‑page change checklist with who to notify: registered agent, bank relationship manager, auditor, fund administrator, and relevant regulators.

Minute decisions properly

If you can’t show the board authorized a major transaction, you’ll have a hard time with auditors, bankers, or a court. Create templates for:

Board minutes (meeting logistics, quorum, agenda, resolutions)

Written resolutions (use for straightforward approvals)

Consent of shareholders (when required by constitution or law)

Directors’ certifications (for bank openings, filings)

Good minutes are specific:

What was approved, in what amount, with what terms

Who is authorized to sign and any limits

Reference to key documents (term sheets, contracts)

Relevant conflicts disclosed and recused directors recorded

Avoid backfilling minutes months later. If you must ratify, label it as such and include the rationale.

Preserve underlying documentation

Accounting records without source documents won’t satisfy most regulators or banks. Keep:

For every invoice: contract or PO, SOW, delivery confirmation or service report, and payment proof

For loans: signed agreements, board approval, drawdown notices, bank advices, and interest calculations

For equity: subscription agreements, KYC on investors, proof of funds, share certificates, and updated member registers

Scan originals at 300 dpi, searchable PDF. Keep originals for key documents (share certificates, wet‑ink agreements) where law requires.

Track economic substance and annual filings

Economic substance regimes in many offshore centers require annual reporting on relevant activities (e.g., headquarters, distribution, holding, financing). Maintain a substance file containing:

Business plan and organizational chart

Local expenses, staff contracts, and service provider agreements

Board meeting frequency and location

Evidence of core income generating activities performed in the jurisdiction

Add calendar reminders for annual returns, license renewals, and substance reports at least 60 and 30 days before deadlines.

Integrate bank and accounting data

Banks and auditors look for consistency between the ledger and the bank. Do monthly reconciliations and file:

Bank statements (PDF and CSV if available)

Reconciliation workpapers

Payment approval trails (signed invoices, dual‑approval logs)

Counterparty KYC for unusual or high‑risk payments

If you use Xero or QuickBooks Online, lock periods after each quarter to prevent accidental changes.

Create and retain an audit trail

Be able to answer “who approved what, when.” Practical steps:

Route material contracts through e‑signature with named roles

Use approval workflows in your DMS or accounting system

Save email threads that contain approvals or representations to a matter‑centric folder

Enable immutable backups or “legal hold” for critical folders

An audit trail is your best defense when a bank asks why a payment was made or a regulator questions a transaction’s purpose.

Train your team and vendors

Most record gaps originate with human habits. Train people to:

Use the file plan and naming conventions

Save documents to the DMS—not personal drives or chat apps

Capture supporting documents at the time of transaction

Escalate changes that trigger register updates

Extend expectations to administrators, fund admins, accountants, and law firms. Agree on a quarterly handover of “source files,” not just PDFs.

Plan for handovers, exits, and emergencies

Companies change hands. Records often don’t. Prepare for:

M&A diligence: keep a clean, ready‑to‑share data room. I’ve seen deals close weeks faster when the data room already matched buyers’ checklists.

Administrator changes: require a data export with registers, KYC files, ledgers, and filings. Don’t switch providers until you validate the export.

Key person risk: store passwords in a company password manager (1Password, Bitwarden). Maintain a “where records live” index accessible to two senior people.

Build redundancy without duplication chaos

Backup matters, but uncontrolled copies cause version sprawl. Use:

Scheduled cloud‑to‑cloud backups (e.g., Backupify, Veeam for M365)

Immutable or time‑locked storage for critical records

Clear rule: the DMS is the single source of truth; backups are read‑only

The Don’ts: Costly mistakes to avoid

Don’t commingle funds

Personal payments from the company account, or vice versa, make regulators and counterparties suspicious. Even one or two “temporary” commingled transactions can complicate audits. If you slip, fix it fast with documented reimbursements and board acknowledgment.

Don’t backdate or “clean up” history

Backdating minutes or contracts is a fast way to lose credibility. If something wasn’t approved at the time, adopt a corrective resolution stating the facts, the reasons for delay, and ratifying the action effective on a current date. Preserve all drafts.

Don’t ignore where records must be kept

Several jurisdictions require you to keep records at a specified address or to notify your registered agent where records are stored. Failing to notify can draw fines even if your records exist. Keep a short “Records Location Notice” and update it whenever you change providers or offices.

Don’t rely solely on your registered agent

Agents file annual returns and hold constitutional documents, but they rarely maintain your transaction‑level accounting, KYC on your counterparties, or intercompany agreements. Clarify scope in your engagement letter and assign someone internally (or a controller/CFO‑as‑a‑service) to own the overall records.

Don’t use personal emails or devices for official approvals

Approvals scattered across personal Gmail accounts are a nightmare to retrieve. Mandate that all directors and signatories use company email for company business and route approvals through e‑signature or a board portal. If a director insists on personal email, have them forward the approval to a central mailbox that archives automatically.

Don’t assume the bank handles CRS/FATCA for you

Banks collect self‑certifications, but you remain responsible for accurate classifications and for providing TINs and controlling person details. Keep:

Completed self‑certificates (and W‑8/W‑9 where relevant)

Substantial presence/ESR analyses and board assessments

Documentation supporting tax residency positions

Don’t overlook transfer pricing and intercompany agreements

Loans without written terms, services without pricing policies, and royalties without benchmarks are common weak spots. Draft simple intercompany agreements and keep evidence of how you set rates (comparable quotes, third‑party studies, or internal cost‑plus calculations). Revisit annually.

Don’t neglect sanctions and AML screenings

Where you deal with higher‑risk regions or industries, screen counterparties at onboarding and periodically. Save search results and date stamps. A five‑minute check with a reputable tool can save a frozen wire and an account review that takes weeks.

Don’t email sensitive files without protection

UBO passports, bank statements, or KYC packs should not travel unencrypted. Use secure links with expiry, password‑protected files with separate password channels, or your board/DMS portal. Disable link resharing.

Don’t keep only PDFs

PDFs are useful for signing, but auditors often ask for machine‑readable exports. Retain source data:

CSV/Excel for bank transactions and ledgers

Native files for models and calculations

Editable copies of registers with a signed PDF counterpart

Don’t forget to retire old signatories and powers

Every time an officer or director leaves, update bank mandates, revoke powers of attorney, and notify administrators. Keep a Signatory Changes log to ensure nothing falls through the cracks.

Step‑by‑step setup blueprint (first 90 days)

Weeks 1–2: Assess and gather

Inventory what exists: registers, minutes, bank mandates, accounting, contracts, KYC

Map legal obligations per jurisdiction (retention, filings, ESR, UBO)

Identify gaps and risks (e.g., missing registers, unfiled changes, commingling)

Freeze the chaos: announce a temporary rule—no new deals without saving supporting docs

Deliverable: Gap analysis with a prioritized action list and owners.

Weeks 3–4: Design your system

Approve a file plan and naming convention

Select tools: DMS, e‑signature, accounting, password manager, AML screening

Draft policies: record retention schedule, approval matrix, KYC/AML procedure

Build templates: board minutes, resolutions, contracts, payment approvals

Deliverable: Records policy pack and tooling checklist.

Weeks 5–8: Build and remediate

Migrate documents into the DMS with correct structure and access

Reconstruct statutory registers from inception; cross‑check against share certificates and cap table

Prepare and pass ratification resolutions where needed

Reconcile bank accounts year‑to‑date; attach missing supporting documents

Notify the registered agent of records location; file any overdue returns

Deliverable: Clean, current registers; reconciled accounts; updated filings.

Weeks 9–12: Operate and improve

Train staff and directors on the new process

Schedule monthly close tasks and quarterly governance reviews

Run a mock bank KYC refresh: assemble a pack and time how long it takes

Tighten controls based on mock findings

Deliverable: Operational cadence and a ready‑to‑send KYC/ESR compliance pack.

Jurisdiction snapshots and typical retention guides

This is a practical cheat sheet. Always verify the current law and your entity’s specific obligations.

Retention: Commonly 5 years for accounting records and underlying documents.

Keep: Registers (members, directors, charges, UBO if applicable), annual returns, economic substance filings.

Nuance: Must notify your registered agent where records are kept; non‑compliance may trigger administrative penalties.

Cayman Islands

Retention: Commonly 5 years post‑transaction for books and records.

Keep: Beneficial ownership register (where required), annual returns, for funds—CIMA filings and audited financials.

Nuance: Strict expectations around BO registers and timely filings; significant fines possible for breaches.

Hong Kong

Retention: 7 years for accounting records.

Keep: Significant Controllers Register at registered office; annual returns; audit reports.

Nuance: SCR must be accessible to authorities on request.

Singapore

Retention: 5 years from end of financial year for accounting and tax documents.

Keep: Register of registrable controllers, AGM/annual return documents, transfer pricing files where relevant.

Nuance: Inland Revenue Authority expects contemporaneous TP documentation for related‑party dealings.

UAE (e.g., DIFC, ADGM, and mainland rules vary)

Retention: Often 5 years; confirm specific free zone rules.

Keep: UBO filings, ESR notifications and reports, audited financials for certain licenses.

Nuance: ESR enforcement is active; insufficient evidence of substance can lead to penalties.

Mauritius and Seychelles

Retention: Typically 7 years in Mauritius; Seychelles tends to align with 7 years for IBCs’ accounting records (check current law).

Keep: Accounting records, underlying documents, UBO and director registers, annual filings.

Nuance: Record location notifications and accessibility requirements apply.

Record keeping for special scenarios

Holding companies and SPVs

These entities seem simple but attract scrutiny because they’re often low‑substance. Keep:

Detailed cap table and share certificates

Intercompany agreements and transfer pricing support

Board minutes evidencing oversight and rationale for distributions, loans, or guarantees

Evidence of director decision‑making in the jurisdiction if substance is required

Common mistake: forgetting to minute intra‑group dividends or not updating the register after a parent reorganization. Fix by ratifying past actions with supporting vouchers and aligning registers immediately.

Investment funds

Funds produce a torrent of records. Organize by investor and by period:

Offering documents and updates

Subscription agreements, KYC packs, and AML checks

Capital calls, NAV calculations, auditor confirmations

Custody, brokerage, and administrator reports

Side letters and compliance attestations

Maintain a consistent investor data room. Banks and regulators often ask for AML evidence at the investor level, even if an administrator handles onboarding.

IP holding and licensing

Royalty arrangements draw tax attention. Keep:

IP assignment documents and chain of title

Valuations or economic analyses supporting royalty rates

License agreements and usage reports

Evidence of active management of IP (board discussions, enforcement actions)

Employer‑of‑record or contractor models

Authorities look for shadow employment and PE risks. Keep:

Contracts with EOR providers and local vendors

Work scopes, time sheets, and approval logs

Evidence of where management and control sit (board packs, KPIs)

Payroll/tax filings where applicable

Crypto and digital assets

Expect heightened AML scrutiny and valuation questions. Keep:

Wallet addresses, custody arrangements, and signing policies

On‑exchange statements and API exports

Transaction logs with fiat equivalents at the time of each transfer

Chain analytics reports for higher‑risk counterparties

Board approvals for treasury policies and staking/yield choices

Sample file plan and naming conventions

Consistent naming reduces retrieval time for everyone, including your future self.

Registers

2025‑01‑15RegisterOfMembersv3_Signed.pdf

2025‑01‑15RegisterOfDirectorsv2_Signed.pdf

Minutes and resolutions

2025‑03‑31BoardMinutesQ1Meetingv1Signed.pdf

2025‑07‑01WrittenResolutionIntercompanyLoanUSD1.5mv1_Signed.pdf

Banking

2025‑04‑30BankStatementBankName_OperatingUSD.pdf

2025‑04‑30BankReconciliationOperatingUSD_v1.xlsx

Contracts

2025‑02‑20MSAAcmeLtdSaaS2yr50kUSDyrv3Signed.pdf

2025‑02‑20SOW1AcmeLtdOnboardingv1_Signed.pdf

Taxes

2025‑06‑15VATReturnQ2_Submitted.pdf

2025‑08‑31CITReturnFY2024Submitted.pdf

Intercompany

2025‑01‑10ICSServicesAgreementParentToHoldCoCostPlus10v2Signed.pdf

2025‑03‑31ICLLoanAgreementHoldCoToOpCoUSD2m5pctv1_Signed.pdf

Tag particularly sensitive items with “Confidential_UBO” and restrict access.

Annual calendar and checklists

Monthly

Bank reconciliations and payment support filed

Invoice and receipt capture complete

Sanctions screening refresh for new/high‑risk counterparties

Board chair receives a one‑page compliance dashboard

Quarterly

Board meeting or written resolutions for key management decisions

Review substance metrics (expenses, mind‑and‑management evidence)

Intercompany charges raised and documented

Record retention log updated for soon‑to‑expire items

Annually

Update registers and obtain director/officer confirmations of accuracy

File annual returns and license renewals

Refresh UBO/PSC/Controllers information and notify changes

Conduct a mock KYC pack preparation for your main bank

Review policies (AML, record retention, data protection) and train staff

Auditor pre‑close: prepare trial balance, supporting schedules, and key contracts

Simple annual KYC pack contents for a bank:

Corporate: certificate of incumbency/good standing, registers, minutes naming signatories

Ownership: current UBO IDs and address proofs (refreshed as per bank policy)

Activity: latest financials, top ten customers/vendors, description of flows

Compliance: sanctions/PEP policy summary, ESR/CRS status confirmations

Tools I recommend (no affiliation)

DMS and collaboration: Google Workspace Business, Microsoft 365, Box Business

E‑signature: DocuSign, Adobe Acrobat Sign

Board portals (for larger orgs): Diligent, BoardEffect; for lean teams: a secured SharePoint site with approval workflows

Accounting: Xero or QuickBooks Online; add ApprovalMax or ProcurementExpress for approvals

AML/KYC: ComplyAdvantage, Sumsub, Dow Jones Risk & Compliance, or World‑Check through a provider

Password management: 1Password Business or Bitwarden Enterprise

Backup: Veeam for M365/Google, Backupify, or native vaulting with immutability

Email archiving: built‑in M365/Google Vault; set retention and legal holds

Budget expectation: $20–$50 per user/month for core stack (DMS, email, password manager, e‑signature), plus AML screening fees per check.

What auditors and banks will ask for

Have these ready and up‑to‑date:

Corporate profile

Certificate of incorporation, M&A/bylaws, certificate of good standing

Registers of members, directors, charges, and beneficial owners/controllers

Governance and signatories

Latest board minutes authorizing bank signatories and major transactions

Specimen signatures and powers of attorney

Ownership and KYC

UBO IDs, proof of address, source of wealth/background summaries

Organization chart with percentage holdings

Financials

Trial balance, general ledger, and bank statements with reconciliations

Top customer and supplier lists with contracts

Invoices and payment supports for sampled transactions

Compliance

CRS/FATCA self‑certifications

Economic substance filings and evidence

AML policy summary and screening logs for higher‑risk deals

If you can assemble this in under 48 hours, your bank relationships and audits will feel calm, not combative.

Common red flags and how to fix them

Red flag: Registers don’t match share certificates or cap table.

Fix: Rebuild from inception using a transaction ledger; cross‑verify with bank subscription receipts and board approvals; issue replacement certificates if needed and record the reason.

Red flag: Payments to directors or related parties without contracts.

Fix: Draft service or loan agreements; pass board approvals; document pricing rationale; attach back‑up for all past payments and reclassify in the ledger if necessary.

Red flag: No evidence of mind‑and‑management in the jurisdiction.

Fix: Schedule quarterly board meetings with a majority of directors attending in person or by local presence, keep detailed board packs, and engage local directors where appropriate.

Red flag: CRS classification inconsistent with actual flows.

Fix: Revisit self‑certifications, reconcile tax residency and controlling person data, and correct records with the bank; document your analysis.

Red flag: Scattered approvals across personal emails and chat apps.

Fix: Centralize via e‑signature and a clean approvals policy; export and archive prior approvals to the DMS; disable ad‑hoc approvals going forward.

Personal insights from the field

Three patterns show up repeatedly in offshore record failures:

1) “We’ll clean it up later” never happens. The best‑run companies spend an extra 10 minutes when a deal is signed to save everything in the right place. That small habit saves hundreds of hours in a diligence or audit scenario.

2) Registered agents are not records managers. They are essential partners, but they don’t own your operations file. Assign an internal or outsourced controller to be the single point of truth.

3) Clarity beats volume. A precise, signed board resolution with annexed term sheet is worth more than a 50‑page generic board pack. Strive for sharp, well‑labeled files that tell a coherent story to outsiders.

Practical retention schedule (baseline)

Adjust to local laws and your industry, but as a working model:

Permanently

Incorporation documents, constitutional documents, all registers

Board and shareholder minutes/resolutions

Share certificates, major contracts, IP assignments

7 years

Accounting records, tax filings, audit reports

Bank statements and payment support

5 years

KYC/AML records post‑relationship end, CRS/FATCA evidence, ESR files

2–3 years

Routine operational correspondence not tied to material contracts

Attach a destruction log for items past retention, approved by the company secretary or compliance lead. Deleting on schedule reduces risk.

A simple approval matrix to avoid bottlenecks

Document who can approve what, and keep it pragmatic:

Payments up to $25k: Finance lead + one director

$25k–$250k: Two directors or one director + CFO

Above $250k or strategic: Board resolution

Related‑party transactions: Always board resolution with conflict managed

Bank account openings/changes: Board resolution, specimen signatures annexed

Save the matrix in the 00 Corporate/04 Signatories folder and update when roles change.

Data privacy and cross‑border considerations

Offshore companies often hold EU, UK, or other personal data subject to GDPR‑style rules. Basic hygiene:

Keep UBO and KYC files under strict access controls

Use SCCs or appropriate mechanisms for cross‑border transfers

Redact passports and IDs when sharing beyond need‑to‑know

Maintain a data processing inventory and vendor DPAs

Many compliance headaches stem from casually sharing KYC packs with too many parties.

Bringing it all together

Tight offshore record keeping isn’t about perfection; it’s about being able to show your work. When your registers, minutes, accounting, and compliance files align, you reduce risk, accelerate banking and audits, and add tangible value at exit. Build a clear architecture, choose tools that encourage good behavior, and embed a monthly rhythm that captures documentation while memories are fresh.

Done right, your records become an asset: a living, searchable history of the company that proves legitimacy, control, and care to anyone who needs to see it—banks, buyers, and regulators included.