Licentium

From the journal

A 2026 guide to company jurisdictions for heavy data processing

A company that collects and analyses personal data at scale faces three separate tests when it chooses where to incorporate. They are the data protection law that binds a company formed there, the international lists that banks and counterparties screen against, and the cost of forming, running and banking the company. This guide applies those tests to 24 jurisdictions in Asia, the Middle East, the Atlantic and Caribbean, the Pacific and West Africa. Every jurisdiction here without a private-sector data protection law in force has thin banking, currency controls or both.

Illia ProkopievCo-Founder and CEO62 min read

How the comparison works

This guide weighs a data protection law by five statutory features that bear on a company processing personal data in volume. They are administrative fines, a mandatory duty to report breaches, registration with a regulator or a duty to appoint a data protection officer, limits on transfers abroad, and special-category status for biometric or identity data. The lists below and the country notes record which of the five each local law contains. A law with none of the five, or only one, is called light here. Light does not mean free of duties. Every law reviewed keeps rules on purpose, security, retention and access, and the count covers statutory features only; enforcement practice is outside it.

The local law is only one layer. The data protection law of each country where the data subjects live applies on its own territorial test, whatever the seat. The EU General Data Protection Regulation (GDPR) reaches a company with no EU establishment when it offers goods or services to people in the EU or monitors their behaviour there (Art. 3(2)). Taiwan's Personal Data Protection Act applies to a non-government agency outside Taiwan that processes the personal data of Taiwanese nationals (Art. 51(2)). India's Information Technology Act, 2000 reaches conduct abroad that involves a computer system in India (s. 75).

Customer identity checks bring in the special categories. Under the GDPR, a facial image is biometric data once specific technical processing allows or confirms the unique identification of a person (Art. 4(14)). Processing biometric data to identify a person uniquely then needs one of the conditions in Art. 9(2). Automated face matching meets that definition. Data Protection & GDPR for AI sets out the GDPR duties that follow for data-driven products.

A light local law therefore reduces the duties tied to the seat and leaves the duties tied to the data subjects' home laws unchanged. The comparison also covers the lists that banks screen against, the economic substance rules for companies that serve their own group, local tax, and whether a bank or payment institution will open an account. Choosing Where to Incorporate sets out the general method for weighing them.

International lists in October 2026

Banks, payment institutions and other counterparties screen a company's country of incorporation against several lists, and each list has its own legal effect. On 16 October 2026, 23 of the 24 jurisdictions in this guide appeared on none of them at country level. The British Virgin Islands appeared on two of them and in Annex II of the EU tax conclusions.

  • FATF jurisdictions under increased monitoring. Instrument and date: FATF public statement of 19 June 2026 (22 jurisdictions). Jurisdictions in this guide that it names: British Virgin Islands, listed since June 2025.
  • FATF high-risk jurisdictions subject to a call for action. Instrument and date: FATF public statement of 19 June 2026 (Iran, North Korea, Myanmar). Jurisdictions in this guide that it names: None.
  • EU list of high-risk third countries for anti-money laundering purposes. Instrument and date: Commission Delegated Regulation (EU) 2016/1675, Annex, Part I, as consolidated to 29 January 2026 (23 countries). Jurisdictions in this guide that it names: British Virgin Islands, added by Delegated Regulation (EU) 2026/83 with effect from 29 January 2026.
  • EU list of non-cooperative jurisdictions for tax purposes (Annex I) and state of play of commitments (Annex II). Instrument and date: Council conclusions 13854/26 of 9 October 2026: Annex I (eight jurisdictions) and Annex II (commitments). Jurisdictions in this guide that it names: None in Annex I; British Virgin Islands in Annex II, with a commitment to request an in-depth Global Forum review by 15 February 2027.
  • US Treasury (OFAC) sanctions programmes. Instrument and date: Country information pages as updated to 14 October 2026. Jurisdictions in this guide that it names: None under a country-wide programme; the Hong Kong-related programme designates persons only.

The lists change on different timetables. The EU anti-money laundering list still named Algeria and Namibia after the FATF removed them in June 2026. It did not yet name Kuwait, Iraq, Bosnia and Herzegovina or Papua New Guinea, which the FATF has grey-listed. The next FATF plenary sits from 26 to 30 October 2026 and may change the grey list. Since 30 June 2026, the country trigger for enhanced due diligence in regulation 33 of the UK Money Laundering Regulations 2017 has covered only FATF call-for-action countries. For UK firms, grey-listing is now a risk factor and no longer an automatic trigger.

Two jurisdictions carry signals below the level of a listing. The 2024 mutual evaluation of the Marshall Islands by the Asia/Pacific Group on Money Laundering rated three of the eleven immediate outcomes Low and the other eight Moderate. That result meets a published FATF review trigger, and whether the FATF has opened a review is not public. The 2023 evaluation of Liberia by the Inter-Governmental Action Group against Money Laundering in West Africa rated ten of eleven outcomes Low. AML / KYC & Financial-Crime Programs explains how a firm's own risk assessment uses country risk.

Data protection features at a glance

The list below shows which of the five features each local law contained on 16 October 2026 for a privately owned company. Where an enacted text will add a feature once it is in force, the entry names that text or its starting date.

  • Hong Kong. Private-sector law and status: Personal Data (Privacy) Ordinance (Cap. 486), in force. Administrative fines: No (criminal offences and civil compensation). Breach notice: No. Registration or DPO: No. Transfer limits: No (s. 33 not in operation). Biometric data special: No.
  • United Arab Emirates (outside DIFC and ADGM). Private-sector law and status: Federal Decree-Law No. 45 of 2021 (PDPL), in force; no Executive Regulations published on the official portal. Administrative fines: Not yet set (Art. 26). Breach notice: Yes; period not yet set (Art. 9). Registration or DPO: DPO in listed cases; thresholds not yet set (Art. 10). Transfer limits: Yes (Arts. 22 and 23). Biometric data special: Yes (Art. 1).
  • India. Private-sector law and status: Information Technology Act, 2000 and SPDI Rules, 2011 in force; DPDP Act, 2023 core duties from 13 May 2027. Administrative fines: No (up to INR 250 crore from 13 May 2027). Breach notice: Yes: six hours to CERT-In. Registration or DPO: No (grievance officer under SPDI Rules, r. 5(9)). Transfer limits: Yes (r. 7). Biometric data special: Yes (r. 3).
  • Taiwan. Private-sector law and status: Personal Data Protection Act (2023 text); 2025 amendments not in force. Administrative fines: Yes (Arts. 47 and 48). Breach notice: To affected persons only (Art. 12). Registration or DPO: No. Transfer limits: Restriction orders (Art. 21). Biometric data special: No (Art. 6).
  • Pakistan. Private-sector law and status: No law; draft bills only. Administrative fines: No. Breach notice: No. Registration or DPO: No. Transfer limits: No. Biometric data special: No.
  • Timor-Leste. Private-sector law and status: No law. Administrative fines: No. Breach notice: No. Registration or DPO: No. Transfer limits: No. Biometric data special: No.
  • Bermuda. Private-sector law and status: Personal Information Protection Act 2016, fully in force from 1 January 2025. Administrative fines: No (criminal offences). Breach notice: Yes (s. 14). Registration or DPO: Privacy officer (s. 5(4)). Transfer limits: Yes (s. 15). Biometric data special: Yes (s. 7).
  • The Bahamas. Private-sector law and status: Data Protection (Privacy of Personal Information) Act, Ch. 324A, in force; Data Protection Act, 2025 not in force. Administrative fines: No (criminal fines). Breach notice: No (72 hours under the 2025 Act). Registration or DPO: No (registration and DPO under the 2025 Act). Transfer limits: Prohibition by notice (s. 17). Biometric data special: No (yes under the 2025 Act).
  • Cayman Islands. Private-sector law and status: Data Protection Act (2021 Revision). Administrative fines: Up to CI$250,000 for serious contraventions (s. 55). Breach notice: Yes, within five days (s. 16). Registration or DPO: No. Transfer limits: Adequacy rule with derogations (Sch. 4). Biometric data special: No (s. 3).
  • British Virgin Islands. Private-sector law and status: Data Protection Act, 2021, in force from 9 July 2021. Administrative fines: No (criminal offences). Breach notice: No. Registration or DPO: No. Transfer limits: Safeguards or consent (s. 7(1)(c)). Biometric data special: No.
  • Aruba. Private-sector law and status: Landsverordening persoonsregistraties (AB 2011 no. 37). Administrative fines: No (criminal fines, Art. 26). Breach notice: No. Registration or DPO: No. Transfer limits: Only on a ministerial declaration (Art. 24). Biometric data special: No (Art. 6).
  • Curaçao. Private-sector law and status: Landsverordening bescherming persoonsgegevens (A.B. 2010 no. 84), in force from 1 October 2013. Administrative fines: Up to Cg 10,000 for listed breaches (Art. 54). Breach notice: No. Registration or DPO: No. Transfer limits: Adequacy rule with derogations (Arts. 51 and 52). Biometric data special: No (Art. 16).
  • Antigua and Barbuda. Private-sector law and status: Data Protection Act, 2013 (No. 10 of 2013), limited to data on commercial transactions. Administrative fines: No (criminal fines). Breach notice: No. Registration or DPO: No. Transfer limits: No. Biometric data special: No.
  • Saint Kitts and Nevis. Private-sector law and status: Data Protection Act, 2018 (No. 5 of 2018), not commenced. Administrative fines: No. Breach notice: No. Registration or DPO: No. Transfer limits: No. Biometric data special: No.
  • Saint Lucia. Private-sector law and status: Data Protection Act (Act 11 of 2011), partly in force from 31 January 2023. Administrative fines: No. Breach notice: No. Registration or DPO: Not commenced. Transfer limits: Not commenced. Biometric data special: No.
  • Saint Vincent and the Grenadines. Private-sector law and status: No private-sector law; Privacy Act 2003 (No. 18 of 2003) is a public-sector Act not brought into force. Administrative fines: No. Breach notice: No. Registration or DPO: No. Transfer limits: No. Biometric data special: No.
  • Dominica. Private-sector law and status: No law. Administrative fines: No. Breach notice: No. Registration or DPO: No. Transfer limits: No. Biometric data special: No.
  • Montserrat. Private-sector law and status: No law. Administrative fines: No. Breach notice: No. Registration or DPO: No. Transfer limits: No. Biometric data special: No.
  • Marshall Islands. Private-sector law and status: Personal Data Protection Act 2025 binds core Government ministries and agencies and those acting for them. Administrative fines: No. Breach notice: No. Registration or DPO: No. Transfer limits: No. Biometric data special: No.
  • Federated States of Micronesia. Private-sector law and status: No national law. Administrative fines: No. Breach notice: No. Registration or DPO: No. Transfer limits: No. Biometric data special: No.
  • Samoa. Private-sector law and status: No law. Administrative fines: No. Breach notice: No. Registration or DPO: No. Transfer limits: No. Biometric data special: No.
  • Fiji. Private-sector law and status: No law. Administrative fines: No. Breach notice: No. Registration or DPO: No. Transfer limits: No. Biometric data special: No.
  • Cook Islands. Private-sector law and status: No law; Privacy Bill announced. Administrative fines: No. Breach notice: No. Registration or DPO: No. Transfer limits: No. Biometric data special: No.
  • Liberia. Private-sector law and status: No law; Data Protection Act not yet enacted. Administrative fines: No. Breach notice: No. Registration or DPO: No. Transfer limits: No. Biometric data special: No.

Lists, banking and currency at a glance

Banking is the practical limit in most of these jurisdictions. The list below sets each list position beside the banking position and any control on payments abroad, as they stood in October 2026.

  • Hong Kong. Lists (16 October 2026): None. Banking, payments and currency: Widest choice in this guide: licensed banks and Hong Kong-licensed payment institutions publish routes for local and overseas companies.
  • United Arab Emirates. Lists (16 October 2026): None. Banking, payments and currency: Local banks; some require a UAE-resident signatory or owners who are individuals; no UAE bank publishes an eligibility rule for RAK ICC companies; one international payment institution publishes a route for UAE free-zone companies.
  • India. Lists (16 October 2026): None. Banking, payments and currency: Banks and international payment institutions publish routes; payments abroad for services pass through an authorised dealer bank under the Foreign Exchange Management Act, 1999.
  • Taiwan. Lists (16 October 2026): None. Banking, payments and currency: Banks and international payment institutions publish routes; foreign investment needs approval.
  • Pakistan. Lists (16 October 2026): None. Banking, payments and currency: Foreign exchange controls slow payments abroad; two international payment institutions block payments to Pakistan and a third withholds US dollar account details.
  • Timor-Leste. Lists (16 October 2026): None. Banking, payments and currency: US dollar economy; a state-owned bank dominates.
  • Bermuda. Lists (16 October 2026): None. Banking, payments and currency: Local banks ask exempted companies why they bank in Bermuda; Hong Kong banks publish checklists for Bermuda companies; the large international payment institutions do not list Bermuda.
  • The Bahamas. Lists (16 October 2026): None. Banking, payments and currency: Local banks only; the large international payment institutions do not list The Bahamas, and one excludes it by name.
  • Cayman Islands. Lists (16 October 2026): None. Banking, payments and currency: Local banks ask why the account is in Cayman; Hong Kong banks and international payment institutions publish routes.
  • British Virgin Islands. Lists (16 October 2026): FATF grey list; EU AML list; EU tax list, Annex II. Banking, payments and currency: Seven licensed banks, one in liquidation; the realistic routes are banks and payment institutions outside the BVI.
  • Aruba. Lists (16 October 2026): None. Banking, payments and currency: Four local banks; exchange licensing and a 1.3% commission on residents' payments abroad.
  • Curaçao. Lists (16 October 2026): None. Banking, payments and currency: Local banks; a 1% licence fee on residents' payments abroad; the large international payment institutions do not list Curaçao.
  • Antigua and Barbuda. Lists (16 October 2026): None. Banking, payments and currency: Thin banking; the large international payment institutions do not list it.
  • Saint Kitts and Nevis. Lists (16 October 2026): None. Banking, payments and currency: Thin banking; the large international payment institutions do not list it.
  • Saint Lucia. Lists (16 October 2026): None. Banking, payments and currency: Thin banking; the large international payment institutions do not list it.
  • Saint Vincent and the Grenadines. Lists (16 October 2026): None. Banking, payments and currency: Correspondent banking is thin across the Eastern Caribbean.
  • Dominica. Lists (16 October 2026): None. Banking, payments and currency: Two banks; the citizenship-by-investment programme draws bank scrutiny of Dominica-linked entities.
  • Montserrat. Lists (16 October 2026): None. Banking, payments and currency: One local bank; Exchange Control Act in force.
  • Marshall Islands. Lists (16 October 2026): None; a published FATF review trigger is met. Banking, payments and currency: Three banks operate domestically and one keeps a US correspondent relationship; one international payment institution and Hong Kong banks publish routes; non-resident entities are exempt from exchange controls.
  • Federated States of Micronesia. Lists (16 October 2026): None. Banking, payments and currency: Two US dollar banks supervised by the US Federal Deposit Insurance Corporation; foreign investment permit required.
  • Samoa. Lists (16 October 2026): None. Banking, payments and currency: Four banks; Central Bank approval for capital transactions; one international payment institution and Hong Kong banks publish routes.
  • Fiji. Lists (16 October 2026): None. Banking, payments and currency: Six licensed banks; one international payment institution publishes a route; banks approve payments abroad for services within delegated limits; Reserve Bank approval for foreign-currency accounts.
  • Cook Islands. Lists (16 October 2026): None. Banking, payments and currency: Thin banking.
  • Liberia. Lists (16 October 2026): None; a 2023 regional evaluation rated ten of eleven outcomes Low. Banking, payments and currency: Thin banking; at least one international payment institution blocks payments to Liberia.

Asia and the Middle East

Hong Kong

Hong Kong combines a light data protection statute with the widest banking access of any jurisdiction in this guide. The Personal Data (Privacy) Ordinance (Cap. 486) provides no administrative fines, no mandatory breach notification and no special category for biometric data. Its transfer restriction in s. 33 is marked "Not yet in operation". Hong Kong appears on none of the lists, and the US Treasury's Hong Kong-related sanctions programme designates persons only.

The six data protection principles in Schedule 1 apply in full. DPP1 requires collection for a lawful purpose directly related to the data user's activity, and data that are adequate but not excessive. The data subject must be told the purpose, the classes of transferees and the right of access. DPP3 bars use for a new purpose without prescribed consent. DPP4 requires security measures and, where a processor is engaged, whether within or outside Hong Kong, contractual or other means to protect the data. Enforcement runs through enforcement notices (s. 50) and the offence of contravening one (s. 50A: a level 5 fine and two years' imprisonment on a first conviction). The disclosure offences in s. 64 carry up to HK$1,000,000 and five years where specified harm is caused, and s. 66 gives compensation, including for injury to feelings.

Reform proposals are under study. The Government's reply to the Legislative Council of 29 May 2024 listed mandatory breach notification, retention policies, administrative fines and direct regulation of processors as proposals under review. The 2026 Policy Address Supplement (ch. 8) says the Privacy Commissioner for Personal Data will study further enhancements of personal data protection. No bill is before the Legislative Council. The Commissioner treats breach notification as recommended practice.

Two offences govern access to computer systems. Section 27A of the Telecommunications Ordinance (Cap. 106) punishes knowingly causing a computer, by telecommunications, to perform a function to obtain unauthorised access to a program or data (a fine at level 4). Section 161 of the Crimes Ordinance (Cap. 200) punishes obtaining access to a computer with criminal or dishonest intent (up to five years on indictment). In Secretary for Justice v Cheng Ka Yee [2019] HKCFA 9, the Court of Final Appeal held that s. 161(1)(c) does not extend to the use of the offender's own computer.

The usual vehicle is a private company limited by shares under the Companies Ordinance (Cap. 622), which also offers a company limited by guarantee. Incorporation in Hong Kong sets out registration fees, timelines, the company secretary requirement and profits tax. On banking, the Hong Kong Monetary Authority has told banks, in circulars of 8 September 2016 and 27 April 2023, that blanket requirements are disproportionate. Its examples are a Hong Kong business registration certificate from every applicant and evidence of a Hong Kong office from every overseas company. The circulars guide the banks and give no applicant a right to an account.

United Arab Emirates

Outside two financial free zones, the United Arab Emirates applies a GDPR-style federal law whose operative detail awaits Executive Regulations. In practice it is light for now. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL) has applied since 2 January 2022. On 16 October 2026 the official legislation portal listed no Executive Regulations, no amendment and no Cabinet decision on penalties under Art. 26. Art. 29 gives six months to comply once the regulations issue.

The PDPL applies to every controller or processor residing in the State that processes the personal data of data subjects inside or outside it (Art. 2(1)(b)). A UAE company is therefore bound for the personal data of people abroad. Processing must be fair, transparent and lawful, for a specific purpose and limited to what is necessary (Art. 5). Processing needed to perform a contract with the data subject requires no consent (Art. 4(9)), and biometric data is sensitive (Art. 1). Transfers abroad are governed by Arts. 22 and 23. Three points wait for the Executive Regulations:

  • the period for breach notification (Art. 9);
  • the triggers for appointing a data protection officer (Art. 10);
  • the exemption for establishments that do not process a large volume of personal data (Art. 3).

The cybercrime law already applies. Federal Decree-Law No. 34 of 2021 on Countering Rumors and Cybercrimes contains three offences that bear directly on data processing:

  • hacking an information system or network (Art. 2: a fine of AED 100,000 to 300,000, imprisonment or both, with heavier penalties where data is obtained);
  • acquiring, copying or disseminating personal electronic data without permission (Art. 6: at least six months' imprisonment, a fine of AED 20,000 to 100,000, or both);
  • processing the personal data of UAE nationals and residents in breach of the legislation in force (Art. 13: a fine of AED 50,000 to 500,000, imprisonment or both).

Only two free zones have their own general data protection laws, both on the GDPR model. They are the Dubai International Financial Centre (DIFC Law No. 5 of 2020) and Abu Dhabi Global Market (ADGM Data Protection Regulations 2021). The DIFC law also reaches an entity outside the DIFC that processes personal data in the DIFC as part of stable arrangements (Art. 6(3)(b)). Dubai Healthcare City has a regulation for patient health information only. The published rules of the other zones reviewed list no data protection instrument, so the federal PDPL applies across them, including in DMCC, JAFZA, the Dubai Development Authority zones and RAKEZ. Incorporation in the UAE: Free Zones compares the zones as company registries, and Incorporation in the United Arab Emirates covers the mainland company and corporate tax.

The Ras Al Khaimah International Corporate Centre (RAK ICC) registers international companies. Its rules page lists the Business Companies Regulations 2018, the Registered Agent Regulations 2018 and the Foundations Regulations 2019. The page lists no data protection instrument, so the federal PDPL applies to its companies. The forms on offer are a standard company limited by shares, a restricted purpose company confined to the objects in its constitution, and a segregated portfolio company. A RAK ICC company is intended for business outside the UAE, and its dealings inside the UAE are limited to what its regulations permit. It needs no office of its own, because the registered agent's address serves, and it cannot sponsor UAE residence visas. Staff or premises inside the UAE therefore need a mainland or free-zone licence. RAK ICC companies register for UAE corporate tax and file returns, and the 9% rate applies to taxable income above AED 375,000.

The UAE banks that publish conditions expect a UAE-licensed company. Some add a UAE-resident signatory or require owners who are individuals, and none publishes an eligibility rule for RAK ICC companies. Most of the large international payment institutions do not list the UAE, and one publishes a route for UAE free-zone companies.

Formation packages for a standard RAK ICC company were priced at about USD 1,450 to USD 6,600 in October 2026. Most covered incorporation, registry fees and 12 months of registered agent and office services. The middle half fell between about USD 2,500 and USD 4,100, with a median near USD 3,100. Renewal packages centred on about USD 2,400 a year. The registry's own fee for a standard company is usually AED 3,250 for incorporation with the first year and about AED 3,950 for each renewal. Extra registry charges apply for more than three shareholders, directors or activities and for layered corporate ownership (about AED 1,250 to AED 1,750 for two levels or more). Where the registry rates an application high risk, an enhanced due diligence fee of about AED 7,000 can apply. Agents add 5% VAT to their professional fees.

Registration usually takes three to seven working days after a complete file is lodged, and one to two weeks end to end. A RAK ICC file follows the standard set described under the documents section, including three proposed names and the registry's own specimen signature form, notarised if signed outside the UAE. A corporate shareholder's documents must be notarised and attested or apostilled in its home country, with certified English or Arabic translations where needed.

India

India is light on administrative penalties until 13 May 2027, but it already imposes consent, transfer and incident-reporting duties. Section 43A of the Information Technology Act, 2000 gives compensation where a body corporate is negligent in securing sensitive personal data. The Sensitive Personal Data or Information Rules, 2011 (SPDI Rules) treat biometric information as sensitive (r. 3). They require written consent before collection, by letter, fax or email (r. 5(1)), and notice of the purpose and the recipients (r. 5(3)). A published grievance officer must resolve complaints within one month (r. 5(9)). A transfer may go only to a recipient that keeps the same level of protection. It must also be necessary for a lawful contract or made with consent (r. 7). Rule 8 names ISO/IEC 27001 as the security standard.

The CERT-In Directions of 28 April 2022, issued under s. 70B(6) of the IT Act, bind any body corporate. Data breaches and data leaks must be reported to CERT-In within six hours of noticing them. Section 72A punishes disclosure of personal information in breach of a lawful contract with intent to cause wrongful loss or gain. Since a 2023 amendment its fine reaches INR 25 lakh. The IT Act also applies to a contravention committed outside India that involves a computer system located in India (s. 75).

The Digital Personal Data Protection Act, 2023 (DPDP Act) brings the heavier layer. Notification G.S.R. 843(E) of 13 November 2025 brings its core duties into force on 13 May 2027, and the core of the DPDP Rules, 2025 starts on the same date. Rule 7 then requires notice of a breach to each affected data principal without delay. The Data Protection Board must also be told without delay and receive a detailed report within 72 hours. Penalties reach INR 250 crore. The Removal of Difficulties Order of 5 October 2026 corrects two words in ss. 9(1) and 10(2)(c)(ii) and moves no date.

A foreign company with a place of business in India, physical or electronic, must register under s. 380 of the Companies Act, 2013 within 30 days. Foreign ownership of an Indian services company is permitted under the automatic route. Payments abroad for services are current-account remittances through an authorised dealer bank under the Foreign Exchange Management Act, 1999, with the tax certifications the bank requires. Banks and international payment institutions publish onboarding routes for Indian companies.

Taiwan

Taiwan's operative law is moderate. It fines breaches and requires notice to affected persons, and it has no biometric category and no duty to report to a regulator. The Personal Data Protection Act in force is the 2023 text. Amendments promulgated on 11 November 2025 add reporting duties to the regulator, a security regime in a new Art. 20-1 and revised fine bands. The Executive Yuan has not set their effective date and may commence them at any time.

Art. 6(1) lists the special categories: medical records, healthcare, genetics, sex life, physical examination and criminal records. Biometric data is not among them. After a breach, Art. 12 requires notice to the persons affected, after investigation and by appropriate means, with no fixed period and no report to a regulator. The competent authority may restrict international transfers in the cases listed in Art. 21.

The fines are administrative. Breaches of Arts. 6(1), 19 and 20(1) and of transfer orders carry NT$50,000 to NT$500,000 (Art. 47). Notice and rights breaches carry NT$20,000 to NT$200,000 once a correction order is not met (Art. 48(1)). Security failures carry NT$20,000 to NT$2 million, rising to NT$150,000 to NT$15 million where serious or uncorrected (Art. 48(2) and (3)). The Act also applies to agencies outside Taiwan that collect, process or use the personal data of Taiwanese nationals (Art. 51(2)). It therefore follows Taiwanese data subjects to any seat.

A foreign company may not do business in Taiwan in its own name without branch registration (Company Act, Art. 371). Foreign investment in a Taiwan company needs approval under Art. 8 of the Statute for Investment by Foreign Nationals. Banks and international payment institutions publish onboarding routes for Taiwan companies.

Pakistan

Pakistan has no enacted data protection law. Only draft bills exist, from 2018, 2020 and 2023, and a bill may be reintroduced. The Prevention of Electronic Crimes Act, 2016 already protects identity information. Under s. 16, obtaining, selling, possessing, transmitting or using another person's identity information without authorisation is an offence. It carries up to three years' imprisonment, a fine of up to PKR 5 million, or both. Contracts follow the Contract Act, 1872. Foreign exchange controls slow payments abroad. Several international payment institutions block payments to Pakistan or withhold US dollar account details.

Timor-Leste

Timor-Leste has no data protection law. The Ombudsman for Human Rights and Justice reported on 15 January 2026 that a Court of Appeal decision makes data protection legislation "an immediate constitutional obligation", so a law is expected. The economy runs on the US dollar, and a state-owned bank dominates. A company formed there needs a board member who holds a residence visa.

Atlantic and Caribbean

Bermuda

Bermuda's law is moderate. It treats biometric data as sensitive and requires breach notice, and it has no administrative fines. The Personal Information Protection Act 2016 (PIPA) has been fully in force since 1 January 2025. It applies to every organisation that uses personal information in Bermuda wholly or partly by automated means (s. 3). Biometric information is sensitive personal information (s. 7). Each organisation must designate a privacy officer, who has primary responsibility for communicating with the Privacy Commissioner (s. 5(4)). A breach likely to affect an individual adversely must be reported to the Commissioner without undue delay, and then to the individuals affected (s. 14). An organisation stays responsible for personal information it transfers to an overseas third party. It must first assess the recipient's level of protection and, where that level is not comparable, provide for it by contract or other means (s. 15). Failing to notify a breach is an offence, and a company faces fines of up to BD$250,000 on indictment (s. 47).

The Computer Misuse Act 1996 punishes unauthorised access to computer material (s. 3: up to six months or BD$6,000). The Act reaches conduct abroad that has a significant link with Bermuda (s. 7).

The Economic Substance Act 2018 covers distribution and service centre business and intellectual property business, among other relevant activities. A company carrying on such an activity must show adequate substance in Bermuda. A company that is tax resident in a jurisdiction outside Annex I of the EU tax list is excluded, on evidence filed with the Registrar.

The usual vehicle for international business is the exempted company. Local banks ask an exempted company to explain why it banks in Bermuda. Hong Kong banks publish document checklists for Bermuda companies, and the large international payment institutions do not list Bermuda. Incorporation in Bermuda covers the exempted company, government fees, registration time and tax.

The Bahamas

The Bahamas is light today and will become moderate once its 2025 Act commences. The Data Protection (Privacy of Personal Information) Act, Ch. 324A, in force since 2 April 2007, applies to a data controller established in The Bahamas. A body incorporated there counts as established (s. 4(3)). The Act requires fair and lawful collection, specified purposes, adequate and relevant data, limited retention and security (s. 6). A civil duty of care applies, and disclosures to third parties must be protected by contractual or other legal means (s. 12). The Data Protection Commissioner may prohibit a transfer abroad by notice (s. 17). Offences carry fines of B$2,000 on summary conviction or B$100,000 on information (s. 29). The Act has no breach notice, no registration and no biometric category.

The Data Protection Act, 2025 (No. 74 of 2025) received assent on 9 December 2025. It appears on the official list of Acts not in force and commences by ministerial notice, possibly in stages (s. 1(2)). Once in force it adds:

  • registration with the Commissioner (s. 38);
  • a data protection officer where core activities involve regular and systematic monitoring or sensitive data (s. 46);
  • notice to the Commissioner within 72 hours of a breach likely to result in a risk to rights, or one involving sensitive data (s. 48);
  • communication to data subjects within 72 hours in the cases s. 49 names;
  • sensitive status for biometric data processed to identify a person uniquely (s. 2).

The Computer Misuse Act, Ch. 107A punishes causing a computer to perform a function to secure unauthorised access to a program or data (s. 3: B$5,000 or six months, more where damage results). The Act applies outside The Bahamas where the accused or the computer was there (s. 11).

The Commercial Entities (Substance Requirements) Act, 2023 (CESRA) and its Guidelines (v1.1) govern economic substance. Distribution and service centre business means providing services to an entity in the same group in connection with business outside The Bahamas. An entity that is tax resident elsewhere and subject to corporate income tax there falls outside the Act on proof. Annual CESRA reports are due within nine months of the end of the financial year, and a passive holding entity reports in reduced form.

Agents offer an International Business Company (IBC) for business conducted outside The Bahamas and a Companies Act company for business conducted locally. An IBC issues registered shares only. It needs at least one shareholder and one director, either of which may be an individual or a company. It keeps its registers of shareholders and directors at the registered office. Each year it files a CESRA report and a declaration of accounting with the Registrar. A foreign-owned company that intends to do business in The Bahamas also needs approval from the Bahamas Investment Authority. That approval usually takes two to three months, and exchange control approval from the Central Bank is needed as well.

The standard annual government fee for an IBC is USD 350 where the authorised share capital is USD 50,000 or less, and USD 1,000 above that. It falls due each January. A 10% penalty applies if it is unpaid by 1 April and 50% if unpaid by 1 November. A company still unpaid at 31 December is struck off. The Bahamian dollar trades at par with the US dollar.

Formation packages for an IBC, usually including the initial government fee and registered office services, were priced at about USD 1,200 to USD 3,900 in October 2026. The middle half fell between about USD 2,000 and USD 3,300, with a median near USD 2,500. Some agents charge the first annual fee on top. Annual renewal fees ran from about USD 1,100 to USD 2,250, centred on about USD 1,450. Economic substance filing services, where not included, cost about USD 150 to USD 950 a year. VAT at 10% may be added to professional fees. Incorporation takes from about 48 hours to 15 business days once due diligence is complete, and most often about one week.

Local banks are the only route. They publish no corporate eligibility rules. The large international payment institutions do not list The Bahamas, and one names it as an excluded country.

Cayman Islands

Cayman's law is moderate and current. It requires breach notice within five days and allows penalties for serious contraventions. It has no biometric category and no registration or data protection officer duty. The Data Protection Act (2021 Revision) is the latest revision on the official index. It applies to a data controller established in the Islands, including a company incorporated there, where data are processed in the context of that establishment (s. 6). A breach must be notified to the Ombudsman and to the data subjects without undue delay. The deadline is five days after the controller should, with reasonable diligence, have become aware of it (s. 16), and failure to notify is an offence. The Ombudsman may impose a monetary penalty of up to CI$250,000 for a serious contravention likely to cause substantial damage or substantial distress (s. 55). Transfers abroad need an adequate level of protection, subject to the derogations in Schedule 4, which include consent and contract necessity. Biometric data is not a listed sensitive category (s. 3).

The Computer Misuse Law (2015 Revision) punishes knowingly unauthorised access to a computer (s. 3). The summary penalty is a fine of CI$5,000 and two years' imprisonment, higher where damage exceeds CI$10,000. The Law applies where the offence relates to a computer or information in the Islands (s. 9).

The Companies Act (2026 Revision) provides the exempted company, which is the usual international vehicle, and the Limited Liability Companies Act (2025 Revision) provides the LLC. The International Tax Co-operation (Economic Substance) Act (2026 Revision) governs substance. Services to an entity in the same consolidated group, in connection with business outside the Islands, are distribution and service centre business. An entity tax resident outside the Islands is not a relevant entity. Failing the substance test carries penalties of CI$10,000, then CI$100,000 (s. 8).

Local banks ask why the account is held in Cayman, and one asks companies registered elsewhere for a legal or tax opinion on the structure. Hong Kong banks publish checklists for Cayman companies, and international payment institutions publish onboarding routes. Incorporation in the Cayman Islands covers the vehicles, registration times, tax and annual filings.

British Virgin Islands

The British Virgin Islands (BVI) has a light data protection law and flexible company law. It is also the only jurisdiction in this guide that appears on the international lists. It has been under FATF increased monitoring since June 2025, and the FATF kept it there on 19 June 2026. Its action plan covers risk-based supervision of trust and company service providers, investment businesses and virtual asset service providers. It also covers the accuracy of beneficial ownership information, the quality of suspicious transaction reports, and money-laundering prosecutions and confiscation. Delegated Regulation (EU) 2026/83 added the BVI to the EU anti-money laundering list from 29 January 2026. The EU tax conclusions of 9 October 2026 place it in Annex II, the state of play of commitments, because it has committed to request an in-depth Global Forum review by 15 February 2027. Grey-listing does not bar dealings with BVI companies, and since 30 June 2026 UK law no longer makes it a mandatory trigger for enhanced due diligence.

The Data Protection Act, 2021 has been in force since 9 July 2021. It applies to a BVI company's processing of personal data in respect of commercial transactions, wherever the data subjects live. It contains one of the five features, a transfer condition that consent satisfies. Its duties are substantive all the same:

  • express consent or another statutory ground, contract necessity among them (s. 7(1)(a) and (2));
  • necessity and proportionality (s. 7(3));
  • notice of the purpose, the source, access rights, recipients and the consequences of not supplying data (s. 8);
  • disclosure limited to the notified purpose and recipients (ss. 9 and 19);
  • security, including guarantees from processors (s. 10);
  • limited retention, accuracy, and access within 30 days (ss. 11 to 14);
  • a direct-marketing opt-out honoured within three days (s. 21);
  • adequate data protection safeguards or consent for transfers out (s. 7(1)(c)).

Sensitive data covers health, sexual orientation, political opinions, religion and criminal matters. Processing it needs explicit consent or another ground in s. 20, and a breach of that rule carries a fine of up to US$200,000. Biometric data is not in the list. Enforcement runs through enforcement notices (s. 33) and civil claims for damage or distress (s. 35). Offences carry fines of up to US$500,000 for a body corporate on indictment (s. 40).

A BVI business company has full capacity to carry on any lawful business (BVI Business Companies Act, s. 28). The Act offers five types of company: limited by shares, limited by guarantee with or without shares, and unlimited with or without shares (s. 5). Since 2 January 2025 a company must file its register of members with the Registrar within 30 days of incorporation and of any change (s. 43A). The filed copy is not public unless the company opts in. Beneficial ownership information is filed on a 10% ownership or voting threshold, or on control by other means (s. 96A). Late filing of ownership changes carries penalties of up to US$6,000. From 1 April 2026, access for persons with a legitimate interest is limited to beneficial owners holding 25% or more. Companies are exempt from the Income Tax Ordinance (s. 242), and payroll tax applies to employers and self-employed persons in the Territory.

The Economic Substance (Companies and Limited Partnerships) Act and the International Tax Authority's Rules (v4) set the substance test. Distribution and service centre business means providing consulting or administrative services to foreign affiliates. A company in that business must be directed and managed in the BVI, with adequate employees, expenditure and premises there. Its core income-generating activity must also take place in the BVI, directly or through a provider whose employees work there (s. 8). The exit is tax residence in a jurisdiction outside Annex I of the EU tax list, proved by a tax authority's certificate, assessment or return. A claim based on residence in a jurisdiction with no corporate income tax is refused. Penalties run from US$5,000 to US$20,000 for a first determination and US$10,000 to US$200,000 for a second, followed by winding up (s. 12). The annual substance report goes through the registered agent within six months of the end of the financial period.

The Computer Misuse and Cybercrime Act, 2014 carries heavy penalties. Unauthorised access carries up to US$200,000 or seven years on summary conviction, and US$500,000 or 14 years on indictment (s. 4). Disclosing a password or access code with a view to gain carries up to US$200,000 and 10 years, doubled where gain is proved (s. 9). A person with lawful access who grants another person access without lawful authority faces up to US$500,000 and 15 years (s. 10(1)(b)). The Act applies to persons within or outside the Virgin Islands where the accused or the computer was in the Territory (s. 3). Officers of a body corporate are liable for connivance or lack of due diligence (s. 16).

Seven entities hold banking licences, and one is in liquidation, with joint liquidators appointed on 22 October 2025. None publishes eligibility rules for non-resident business companies. The realistic routes lie outside the BVI: Hong Kong banks publish BVI checklists, and Hong Kong payment institutions publish BVI onboarding routes. Incorporation in the British Virgin Islands covers the business company, government fees, registration time and annual filings.

Aruba

Aruba is among the lightest jurisdictions in this guide by statute. The Landsverordening persoonsregistraties (AB 2011 no. 37) creates no regulator, no breach notice and no registration. Breaches of its purpose, security, disclosure and transfer rules carry a criminal fine of the third category (Art. 26). Its sensitive categories omit biometric data (Art. 6(2)), and Art. 8 imposes security duties. A transfer abroad is barred only where the Minister declares that privacy could be seriously harmed (Art. 24(2)).

Aruba is part of the Kingdom of the Netherlands and lies outside the EU. Residents' payments abroad are subject to exchange licensing and a 1.3% commission. Four local banks operate, and the large international payment institutions do not list Aruba.

In October 2026, a formation package for an Aruban company was priced at about USD 3,500, including notarial costs and excluding the business licence and director licence application fees. Domiciliation and local management cost about USD 6,000 a year, plus 10% for general office expenses. The Chamber of Commerce charges about USD 65 a year. The first year therefore comes to about USD 9,600 before licence fees and the office surcharge, and later years to about USD 6,100. Formation takes 6 to 12 weeks once the due diligence and incorporation documents are complete. The precise price depends on the business to be carried on.

Curaçao

Curaçao's law has administrative fines but no breach notice. The Landsverordening bescherming persoonsgegevens (A.B. 2010 no. 84) has been in force since 1 October 2013, with a supervisory body, the College bescherming persoonsgegevens (Art. 41). The College may impose administrative fines of up to Cg 10,000 for breaches of Arts. 4(3), 27, 28 and 64(1), which include the data subject's rights of access and correction (Art. 54). The same breaches are criminal offences, punishable by up to six months' imprisonment where intentional (Art. 63). Biometric data is not a special category (Art. 16). Transfers outside the Kingdom need an adequate level of protection (Art. 51) or a derogation under Art. 52, which includes explicit consent and contract necessity. The ordinance has no data protection officer duty and no general notification duty.

Residents' payments abroad bear a 1% licence fee. Trust service providers licensed by the Central Bank of Curaçao and Sint Maarten can supply the local director and registered office, and they screen applicants and their activities against sanctions lists. Agents commonly ask whether a company will serve online gaming operators or other regulated businesses before they quote. Local banks hold the accounts, and the large international payment institutions do not list Curaçao.

In October 2026, a formation package for a Curaçao B.V. was priced at about EUR 5,000, including notarial and government registration fees. Help with opening a bank account cost about EUR 1,500. A registered office with a corporate local director cost about EUR 550 a month. The first year therefore came to about EUR 13,100 (about USD 14,700), or about EUR 11,600 without bank help. An office surcharge and turnover tax (O.B.) may be added to agents' fees. Incorporation usually takes about two weeks once the onboarding file is complete and due diligence is cleared, and the bank account is usually the longest step.

Antigua and Barbuda

Antigua and Barbuda's Data Protection Act, 2013 (No. 10 of 2013) is narrow. Personal data means information in respect of commercial transactions that is processed or held in the ways the Act lists (s. 2). Sensitive personal data covers health, sexual orientation, political opinions, religious or similar beliefs and alleged offences, plus any category the Minister adds by order. Biometric data is not listed. The Act has no registration, data protection officer, breach notice or transfer rule. The Information Commissioner appointed under the Freedom of Information Act 2004 exercises the Act's powers (s. 21). The Act has no commencement section and is treated as in force.

Enforcement is criminal. Unlawful processing of sensitive personal data carries a fine of up to EC$200,000, three years' imprisonment, or both (s. 18(3)). The general penalty is up to EC$50,000 or three years on summary conviction, and EC$100,000 or five years on indictment (s. 23(1)). A body corporate faces fines of up to EC$200,000 on summary conviction and EC$500,000 on indictment (s. 23(2)).

Banking is thin, and the large international payment institutions do not list Antigua and Barbuda.

Saint Kitts and Nevis

The Data Protection Act, 2018 (No. 5 of 2018) commences by ministerial order under s. 1(2), and no order has been made. Once in force, it would rely on criminal penalties, with no breach notice and no transfer limits. Banking is thin, and the large international payment institutions do not list Saint Kitts and Nevis.

Saint Lucia

Saint Lucia's Data Protection Act (Act 11 of 2011, amended by Act 2 of 2015) is only partly in force. S.I. 4/2023 brought Part I, ss. 32 to 43 of Part III, Part VI and paragraphs (a) to (g) of Schedule 2 into force on 31 January 2023. The provisions in force cover the data protection principles, collection, consent, sensitive data, accuracy, use, security and destruction (ss. 32 to 43). The security duty in s. 42 carries no breach notice. Fingerprints and DNA appear in the definition of personal data, and the definition of sensitive personal data does not include them (s. 2).

Several Parts have not commenced:

  • the Data Protection Commissioner (Part II);
  • registration of data controllers (Part IV, from s. 46);
  • data subjects' rights (Part V);
  • offences and penalties (Part VII, s. 71);
  • the transfer rule (s. 45).

The remaining provisions can start by ministerial order. Banking is thin, and the large international payment institutions do not list Saint Lucia.

Saint Vincent and the Grenadines

Saint Vincent and the Grenadines has no private-sector data protection law. The Privacy Act 2003 (No. 18 of 2003) is a public-sector Act that has not been brought into force. The Economic Substance Act 2020 applies to companies that carry on relevant activities.

The vehicles offered for international business are the business company (BC) and the limited liability company (LLC). Annual fees are paid in advance in December for the coming year, rather than on the anniversary of incorporation. Each year a business company files four returns:

  • a declaration of intellectual property assets;
  • financial statements or a declaration of solvency;
  • an income tax return, which is declaratory, with no tax payable;
  • an economic substance return.

Financial statements go to the Financial Services Authority where net assets exceed XCD 2 million.

In October 2026, formation packages ran from about USD 700 for an LLC to about USD 4,600 for a business company with a full first-year filing package, with a median near USD 2,000. Annual renewal fees ran from about USD 500 to about USD 1,900. The mandatory annual filings may be priced separately, at about USD 800 a year. Incorporation takes from 24 hours to five business days once the agent's due diligence is complete. Supporting documents must usually be notarised, and some agents need the originals by post. Correspondent banking is thin across the Eastern Caribbean.

Dominica

Dominica has no data protection law and no bill. Two banks operate, and correspondent banking is thin across the Eastern Caribbean. The citizenship-by-investment programme draws bank scrutiny of Dominica-linked entities.

Montserrat

Montserrat is a UK overseas territory with no data protection Act. None appears in the Attorney General's revised Acts, which have a cut-off of 1 January 2025. The Companies Act 2023 came into force under S.R.O. 14 of 2024. One local bank operates, and the Exchange Control Act remains in force.

Pacific

Marshall Islands

The Republic of the Marshall Islands (RMI) has no private-sector data protection law and a registry built for non-resident entities. The Personal Data Protection Act 2025 (P.L. 2025-43) took effect on 7 October 2026. It binds core Government ministries and agencies and third parties acting for them, and no other controller.

The RMI appears on none of the lists. The Council moved it from the EU tax blacklist to Annex II on 10 October 2019, after it adopted economic substance rules, and it now appears on neither Annex. The 2024 mutual evaluation by the Asia/Pacific Group on Money Laundering rated three immediate outcomes Low: legal persons and arrangements, money-laundering prosecutions, and confiscation. The other eight were rated Moderate. That result meets a published FATF review trigger.

The Business Corporations Act (52 MIRC Chapter 1) provides the non-resident domestic corporation, and the Limited Liability Company Act (52 MIRC Chapter 4) the non-resident domestic LLC. An entity is non-resident when it does no business in the Republic (s. 2(j)). An entity that keeps an office, officers, bank accounts, advisers, books or meetings in the Republic does not do business there for this purpose. Trading in goods or services for or with residents does count (s. 2(q)). Section 12 exempts non-resident entities from Marshall Islands taxes, withholding, tax reporting and exchange controls. Distributions they pay to non-residents are also exempt. The LLC Act applies the exemption to LLCs (s. 70(3)). Both Acts adopt Delaware's non-statutory law for non-resident entities (BCA s. 13; LLC Act s. 71).

The Net Profit Tax Act, 2025 (P.L. 2025-38) imposes net profit tax at 16% for tax years beginning on or after 1 October 2026 (ss. 705 and 749(2)). A "resident person" includes a domestic corporation (s. 702). Section 711(3) preserves exemptions in other laws that were in force at commencement, which supports the survival of the s. 12 exemption. The Act also sources in the Republic a fee for independent services paid by a resident person (s. 704(3)(h)). Such a fee bears non-resident tax at 10%, as do royalties, and management fees bear 16%, all collected by withholding (ss. 708 and 743). An LLC is not a corporation formed under the Business Corporations Act. It is a resident person only if it counts as an unincorporated body formed in the Republic, a description that fits it awkwardly, so an LLC stands on firmer ground than a corporation. No official guidance on the interaction had been published by October 2026.

Under the Economic Substance Regulations, 2018, an RMI entity is a relevant entity unless it is both centrally managed and controlled outside the Republic and tax resident outside it (s. 2(s)(i)). Tax residence must be shown by objective evidence (s. 8(4)). Distribution and service centre business covers services to an entity in the same Group in connection with business outside the Republic (s. 2(c)). The Group follows the consolidated-accounts definition in s. 602 of the Country-by-Country Reporting Act, 2018, with no revenue threshold. The test requires board meetings in the Republic with a quorum physically present, adequate employees, premises and expenditure there, and core income-generating activity carried on there (ss. 4 and 5). Penalties reach US$50,000 for one financial period and US$100,000 for the next, with revocation and dissolution (s. 7(2)). Every non-resident domestic entity files an annual economic substance report within 12 months of its anniversary date.

An LLC keeps records of its members, managers and beneficial owners, meaning natural persons holding more than 25% or controlling by other means. It produces them to the registered agent within 60 days on demand and attests each year to the Registrar that they are kept. The penalty for failure is a fine of up to US$50,000 and cancellation (LLC Act s. 22(1)).

The Cybercrimes Act 2025 (P.L. 2025-40) applies where a computer or data was lawfully accessible in the Republic, or where conduct or its result occurs there (s. 503(1)). Unauthorised access is a second-degree felony (s. 504(1)), and a domestic or foreign LLC may be convicted (ss. 502(j) and 533). The Electronic Transactions Act 2025, in force since 21 April 2025, provides that electronic records, contracts and signatures are not denied legal effect solely because they are in electronic form (ss. 808, 816 and 818). Signatures made outside the Republic have the same effect (s. 819).

Three banks operate domestically, two local banks and a branch of a US bank, and only one keeps a correspondent relationship with a US bank. A non-resident entity banks abroad in practice. One international payment institution and Hong Kong banks publish routes for RMI companies. Incorporation in the Marshall Islands covers the non-resident domestic corporation, the LLC, registration times and record-keeping.

Federated States of Micronesia

The Federated States of Micronesia has no national data protection law in the public laws of its 23rd and 24th Congress. A non-citizen may not engage in business without a Foreign Investment Permit (FSM Code, Title 32, s. 204). The states regulate the sectors not reserved to the nation. Two US dollar banks operate, both supervised by the US Federal Deposit Insurance Corporation.

Samoa

Samoa has no data protection law, and no bill appears in Parliament's lists for 2024 to 2026. The Miscellaneous (Removal of Tax Exemption for International Companies) Amendment Act 2026 removes the tax exemption that international companies enjoyed. Samoa is off the EU tax list. Four banks operate, and capital transactions need Central Bank approval. One international payment institution and Hong Kong banks publish routes for Samoan companies.

Fiji

Fiji has no data protection law, and no such bill appears in Parliament's lists. A foreign investor registers its company under the Companies Act 2015 and reports to Investment Fiji (Investment Act 2021, s. 6). Under the Reserve Bank's Exchange Control Guidelines, effective 1 January 2026, banks may approve service payments abroad of up to F$1,000,000 per invoice against a tax clearance certificate. A company's foreign-currency account needs Reserve Bank approval. Six banks hold licences, and one international payment institution publishes a route for Fijian companies.

Cook Islands

The Cook Islands has no data protection law. On 20 May 2026 the Prime Minister's Office said the Government intends to bring forward a Privacy Bill. Banking is thin.

West Africa

Liberia

Liberia has no data protection law. The National Digital Strategy 2025 to 2029 of the Ministry of Posts and Telecommunications records the Data Protection Act as "yet to be enacted", so a law may follow. Non-resident corporations are formed through the international corporate registry, whose published materials state a tax exemption for them. Resident corporations register with the Liberia Business Registry. The 2023 mutual evaluation by the Inter-Governmental Action Group against Money Laundering in West Africa rated ten of eleven immediate outcomes Low. Banking is thin, and at least one international payment institution blocks payments to Liberia.

Other jurisdictions reviewed

The jurisdictions below, apart from the British Virgin Islands, were tested on the same criteria and are not covered country by country. They fall into four groups: light-law places on a watchlist, light-law places where banking or currency outweighs the law, places with heavier data protection law, and places named on the international lists.

Watchlist

All five pass the list check, and banking is weak in each.

  • Grenada. Position in October 2026: Data Protection Act No. 1 of 2023 passed; no commencement order made; Parliament dissolved on 2 October 2026. Why it stays on the watchlist: Commencement and final terms depend on the next Parliament.
  • Sint Maarten. Position in October 2026: No data protection ordinance identified, and none among the draft ordinances listed on 1 March 2026. Why it stays on the watchlist: Small banking market.
  • Tonga. Position in October 2026: No data protection bill in Parliament's 2025 and 2026 lists; four licensed banks; Foreign Exchange Control Act 2018. Why it stays on the watchlist: Exchange control and thin banking.
  • Solomon Islands. Position in October 2026: No data protection law; Exchange Control Act 1976. Why it stays on the watchlist: Exchange control and remote banking.
  • Caribbean Netherlands (Bonaire, Sint Eustatius, Saba). Position in October 2026: Wet bescherming persoonsgegevens BES: own supervisor; biometric data not special (Art. 16); transfers outside the EU need adequacy (Art. 42), with consent and contract derogations (Art. 43); no administrative fines; a criminal fine only for breach of the local-representative duty (Art. 41) and administrative enforcement orders (Art. 51(2)). Why it stays on the watchlist: Whether a screen that excludes EU territory covers islands that are part of an EU Member State although outside most EU law.

Light law, weak banking or currency

These nine also pass the list check. Banking, currency or reputation weighs more than the light law.

  • Cambodia. Data law: No data protection law; a draft was validated on 5 August 2026. Practical obstacle: Poor banking after US action against a Cambodia-based payments group; reputational risk.
  • Maldives. Data law: No law; a government bill is before a parliamentary committee (June 2026). Practical obstacle: Foreign-currency shortages and rationing; a Foreign Currency Act amendment ratified on 31 August 2026 ties trading to Monetary Authority rates; weak 2025 mutual evaluation.
  • Bhutan (national). Data law: No national data protection regulation (National Data Governance Framework 2025, cl. 2.3.2), although that document asks entities to report breaches within 72 hours. Practical obstacle: Foreign investment approval; thin convertible-currency banking after the 2023 reserve pressures.
  • Tajikistan. Data law: 2018 law is light: small fines and consent for transfers. Practical obstacle: Shallow foreign-exchange market; rule-of-law risk; at least one payment institution blocks payments.
  • Turkmenistan. Data law: 2017 law with a data localisation duty. Practical obstacle: Foreign-exchange controls; the authorities did not publish the 2026 IMF staff report; at least one payment institution blocks payments.
  • Niue. Data law: No data protection law. Practical obstacle: No banking route for a foreign-owned company.
  • Nauru. Data law: No data protection law. Practical obstacle: One bank, with delays in onboarding non-individual accounts.
  • Tuvalu. Data law: No data protection law. Practical obstacle: One bank holds the only correspondent banking relationships.
  • Kiribati. Data law: No data protection law. Practical obstacle: The financial supervisor is not expected to be fully operational until mid-2027.

Heavier data protection law

These 40 regimes carry more of the five features, or fall outside the scope of a light-law comparison.

  • Singapore. Fines up to S$1 million, or 10% of Singapore turnover where it exceeds S$10 million; three-day breach notice; DPO; regulator guidance restricts the collection of identification numbers, passport numbers included.
  • Malaysia, including Labuan. Since 2025: breach notice, DPO, transfer rules, biometric data sensitive; fines up to RM1 million.
  • Bahrain. Prior written authorisation for biometric data used to verify identity (Art. 15).
  • Saudi Arabia. Fines up to SAR 5 million; breach notice; transfer regulation; biometric data sensitive.
  • Mauritius. Mandatory registration; 72-hour breach notice; biometric data special.
  • Seychelles. Administrative fines; 72-hour breach notice; biometric data special; weak banking.
  • Belize. Data Protection Act 2021 (No. 45 of 2021): GDPR-style text, not yet commenced; weak banking.
  • DIFC and ADGM. Own GDPR-style regimes inside the UAE.
  • Oman. Prior Ministry permit for biometric data (Art. 5); DPO; 72-hour breach notices; transfers need explicit consent, adequate protection and a risk assessment (Ministerial Decision 34/2024, Arts. 37 to 40); Royal Decree 68/2026 confines the law to data of natural persons in Oman (Art. 2), a limit that is untested.
  • Qatar. Law No. 13 of 2016 onshore and in the Qatar Free Zones; the Qatar Financial Centre has GDPR-style regulations, with biometric data sensitive and a 72-hour breach notice.
  • Sri Lanka. Main duties (Parts I and III) start on 1 January 2027; biometric data special; fines up to LKR 10 million.
  • Bangladesh. Personal Data Protection Act 2026, deemed in force from 6 November 2025; biometric and genetic data sensitive; foreign-exchange controls; at least one payment institution blocks payments.
  • Philippines. Registration with the National Privacy Commission above employee or data-volume thresholds or where processing is likely to pose a risk (NPC Circular 2022-04); 72-hour breach notice; criminal penalties; government ID numbers are sensitive.
  • Thailand. GDPR-style; 72-hour breach notice; biometric data sensitive; fines up to THB 5 million.
  • Indonesia. Fines up to 2% of annual revenue; breach notice within 3 x 24 hours; biometric data is specific (sensitive) data.
  • Japan. Consent needed for most transfers abroad; breach reports; a surcharge system added by the July 2026 amendment.
  • South Korea. Turnover-based penalty surcharges.
  • Macau. Notice to the regulator within eight days of starting; prior authorisation for sensitive data; transfers only to adequate places or under a statutory derogation.
  • Mongolia. Only listed state bodies may collect biometric data (Art. 10.1), with one employer exception for non-fingerprint biometrics on consent (Art. 10.2); transfers abroad barred without a law, treaty or consent (Art. 14.1).
  • Israel. Amendment 13 (14 August 2025): financial sanctions, DPO duties, biometric data of special sensitivity.
  • Egypt. Licensing regime and executive regulations (2025); foreign-exchange controls; at least one payment institution blocks payments.
  • Georgia. GDPR-style law; regulator permit for contract-based transfers; DPO duties; 72-hour breach notice; at least one payment institution blocks payments.
  • Armenia. Prior notice to the regulator before biometric processing; permission for transfers to non-adequate countries.
  • Azerbaijan. State registration of information systems; transfer restrictions.
  • Kazakhstan, including the AIFC. AIFC: GDPR-style; sensitive data on written consent or a Commissioner's permit (s. 10); a DPO, resident in Kazakhstan unless a group employee abroad, for systematic high-risk processing (s. 10-1); at least one payment institution blocks payments.
  • Uzbekistan. Data localisation rule (Art. 27-1) and a state register of databases; at least one payment institution blocks payments.
  • Kyrgyzstan. New Digital Code in force in 2026; at least one payment institution blocks payments.
  • Barbados. Act 2019-29: registration (s. 50), breach notice to the Commissioner where feasible within 72 hours (s. 63), biometric data sensitive (s. 2); commencement by proclamation (s. 100), not yet made; at least one payment institution restricts Barbados.
  • Jersey. GDPR-equivalent: registration, 72-hour breach notice, fines up to GBP 10 million.
  • Guernsey. GDPR-equivalent law with registration and an annual levy.
  • Isle of Man. GDPR applied by 2018 regulations.
  • Gibraltar. Gibraltar GDPR.
  • China. Personal Information Protection Law: fines up to RMB 50 million or 5% of turnover; biometric data sensitive and needs separate consent; transfer mechanisms; facial recognition rules from 1 June 2025.
  • Bhutan: Gelephu Mindfulness City. Applies Singapore's Personal Data Protection Act 2012 as amended from time to time (Application of Laws Act 2024, Sch. A, item 13); no licensed bank yet.
  • Jamaica. Data Protection Act 2020, in force since 1 December 2023: registration, DPO, 72-hour breach notice, biometric data sensitive, fines up to 4% of turnover; at least one payment institution restricts Jamaica.
  • Andorra. Llei 29/2021 (GDPR-style): 72-hour breach notice, biometric data special, fines up to EUR 100,000 for very serious breaches.
  • San Marino. Law 171/2018 (GDPR-style): 72-hour breach notice, DPO, biometric data special.
  • Tunisia. Organic Law 2004-63: declaration and authorisation regime.
  • Comoros, including Anjouan and Mohéli. A 2014 law requires prior authorisation for biometric identity checks (Art. 43(b)); Anjouan's offshore banks were found to operate illegally in 2010, and the central bank bans offshore banking.
  • Liechtenstein. The GDPR applies through the EEA Agreement.

Excluded by the lists

These 29 jurisdictions appeared on at least one of the lists, or in Annex II of the EU tax conclusions, on 16 October 2026. Hong Kong and China are absent because the US Treasury programmes that name them designate persons only. OFAC entries are shown for information, and a programme that designates persons only does not by itself place a jurisdiction here.

  • Iran; North Korea. FATF call for action (countermeasures); EU AML list; OFAC programmes.
  • Myanmar. FATF call for action (enhanced due diligence); EU AML list; OFAC Burma programme.
  • Kuwait. FATF grey list.
  • Iraq. FATF grey list (added June 2026); OFAC Iraq programme (targeted).
  • Lebanon; Syria; Yemen. FATF grey list; EU AML list; OFAC programmes.
  • Viet Nam. FATF grey list; EU AML list; EU tax list, Annex II.
  • Lao PDR; Nepal. FATF grey list; EU AML list.
  • Papua New Guinea. FATF grey list.
  • British Virgin Islands. FATF grey list; EU AML list; EU tax list, Annex II (covered above).
  • Monaco. FATF grey list; EU AML list.
  • Afghanistan. EU AML list; OFAC Afghanistan programme.
  • Trinidad and Tobago. EU AML list.
  • Russia. EU tax list, Annex I; EU AML list; OFAC programmes.
  • Vanuatu. EU tax list, Annex I; EU AML list.
  • American Samoa; Anguilla; Guam; Palau; Turks and Caicos Islands; US Virgin Islands. EU tax list, Annex I.
  • Panama; Jordan; Türkiye; Brunei; Morocco. EU tax list, Annex II (commitments).

Indicative incorporation costs

The figures below are package prices for standard companies in October 2026, rounded. Medians and middle ranges are calculated from those prices. Most first-year figures cover formation, the initial government or registry fees and the first year of registered office and agent services. Some packages leave out the first annual fee, and a few include VAT, help with a bank account or a local licence. Certification, notarisation, apostille and courier costs and enhanced due diligence fees are usually extra. Prices move with the ownership structure, the risk rating and the activity, so each range is a starting point for a quote.

  • United Arab Emirates: RAK ICC company. First year: About USD 1,450 to USD 6,600; middle half USD 2,500 to USD 4,100; median about USD 3,100. Annual renewal: Centred on about USD 2,400. Time to register: Three to seven working days after a complete file; one to two weeks end to end. Notes: Registry fee AED 3,250 with the first year and about AED 3,950 on renewal; extra registry charges for layered ownership and high-risk files; 5% VAT on agents' fees.
  • The Bahamas: International Business Company. First year: About USD 1,200 to USD 3,900; middle half USD 2,000 to USD 3,300; median about USD 2,500. Annual renewal: About USD 1,100 to USD 2,250; median about USD 1,450. Time to register: About 48 hours to 15 business days; most often about one week. Notes: Government fee USD 350 or USD 1,000 a year; substance filing services USD 150 to USD 950 a year where not included; VAT at 10% may apply; some packages exclude the first annual fee.
  • Saint Vincent and the Grenadines: LLC or business company. First year: About USD 700 to USD 4,600; median about USD 2,000. Annual renewal: About USD 500 to USD 1,900. Time to register: 24 hours to five business days after due diligence. Notes: Mandatory annual filings about USD 800 a year where priced separately; annual fees paid in December for the coming year; some packages exclude the first annual fee.
  • Curaçao: B.V. with a local director (one package). First year: About EUR 13,100 (about USD 14,700) with help opening a bank account; about EUR 11,600 without. Annual renewal: Not stated; the first-year rate for registered office and local director was about EUR 550 a month. Time to register: About two weeks after due diligence; the bank account takes longer. Notes: Formation about EUR 5,000, including notarial and registration fees; an office surcharge and turnover tax may be added.
  • Aruba: company with domiciliation and local management (one package). First year: About USD 9,600 before licence application fees and the 10% office surcharge. Annual renewal: About USD 6,100 plus the office surcharge. Time to register: 6 to 12 weeks. Notes: Formation about USD 3,500; domiciliation and local management USD 6,000 a year; Chamber of Commerce about USD 65 a year.

Prices within each range differ with what the package includes. The cheapest packages often leave out registry fees, the first annual fee or substance filings. The most expensive add bank account introductions, local directors or compliance services. Costs also rise with:

  • a corporate shareholder, or more than one layer of ownership;
  • a high-risk rating by the registry or the agent, which can bring enhanced due diligence fees;
  • a local director or local management, which agents in Curaçao and Aruba price in;
  • annual economic substance and accounting filings;
  • certification, apostille or embassy attestation of documents, and certified translations.

The list gives ranges for three jurisdictions and single packages for Aruba and Curaçao, and no figures for the other jurisdictions in this guide. Government fees for Hong Kong, Bermuda, the Cayman Islands and the BVI appear on the incorporation pages linked in their country notes.

Documents usually requested

Registered agents in the UAE, The Bahamas, Saint Vincent and the Grenadines and Curaçao request much the same file, and published bank checklists follow the same pattern. The detail varies with the agent's risk rating and with whether any owner is a company.

For each individual

Each shareholder, director, company secretary and beneficial owner usually provides:

  • a passport copy, often certified by a notary, lawyer or banker, and, for some agents, valid for at least six months;
  • proof of residential address dated within the last two or three months: a utility bill, bank statement or tenancy agreement;
  • a CV or professional profile;
  • a declaration of the source of funds and source of wealth, with supporting evidence where asked;
  • a bank reference letter, and for some agents a professional or character reference from a lawyer or accountant;
  • bank statements for the last three to six months, which some agents request;
  • the agent's KYC forms, with declarations on beneficial ownership and politically exposed person status;
  • a second identity document, which some agents request.

For the company

  • two or three proposed names, in order of preference;
  • a description of the business, its target markets, expected customers and counterparties, and expected transaction volumes;
  • the share capital and the shareholding;
  • the names of the directors and secretary, with their signed consents;
  • an ownership chart traced to the natural persons;
  • a specimen signature on the registry's own form where required, notarised if signed abroad.

For a corporate shareholder

  • the certificate of incorporation and the memorandum and articles;
  • registers of directors and shareholders;
  • a certificate of good standing and a certificate of incumbency, usually dated within the last three to six months;
  • a board resolution approving the investment, sometimes notarised;
  • the personal documents above for its directors and beneficial owners.

Corporate documents issued abroad are usually notarised and apostilled, or attested by an embassy, in the home country. Documents in another language need certified English translations.

For the bank account

Banks run their own checks after incorporation. They identify the directors, signatories and beneficial owners, often at a 10% ownership threshold. They ask for a certificate of incumbency or a registry extract dated within six months, evidence of the business, and the source of wealth and funds. One Hong Kong bank requires at least one director to visit a branch. Some local banks ask why the company banks in their jurisdiction. Several payment institutions exclude shell companies and transactions with no genuine commercial purpose.

Questions asked before a quote

Agents commonly ask several questions before they quote:

  • what the company will do, for whom and in which markets;
  • whether it will be privately held or part of a group;
  • how many shareholders, directors and beneficial owners there will be, and their nationality and residence;
  • whether any activity is regulated, including services to gaming operators;
  • whether a local director is needed, or only a registered office;
  • the expected timing.

Dated changes that could move the comparison

The list below gives dated and pending changes that could alter a jurisdiction's position.

  • 26 to 30 October 2026 (All). FATF plenary; the grey list may change.
  • Tax years beginning on or after 1 October 2026 (Marshall Islands). Net Profit Tax Act, 2025 applies, with non-resident tax withheld on fees, royalties and management fees paid by resident persons.
  • 1 January 2027 (Sri Lanka). Main duties of the Personal Data Protection Act start.
  • By 15 February 2027 (British Virgin Islands). Deadline for its request for an in-depth Global Forum review (EU tax list, Annex II).
  • 13 May 2027 (India). DPDP Act core duties and the 72-hour breach report to the Board start; penalties up to INR 250 crore.
  • Executive Regulations and a Cabinet decision on penalties (United Arab Emirates). Breach period and DPO triggers set by the regulations, penalties by the Cabinet decision (Art. 26); six months to comply once the regulations issue (Art. 29).
  • Ministerial notice (The Bahamas). Data Protection Act, 2025 commences, possibly in stages.
  • Date set by the Executive Yuan (Taiwan). 2025 amendments take effect: reporting to the regulator, the Art. 20-1 security regime and new fine bands.
  • Ministerial order (Saint Lucia). Commissioner, registration, rights, offences and transfer provisions commence.
  • Ministerial order (Saint Kitts and Nevis). Data Protection Act, 2018 commences.
  • Commencement order (Grenada). Data Protection Act No. 1 of 2023 commences; the next Parliament may revisit it.
  • Bill not yet introduced (Hong Kong). Reform proposals: mandatory breach notification, retention policies, administrative fines and direct regulation of processors.
  • Bill announced on 20 May 2026 (Cook Islands). Privacy Bill.
  • Not yet enacted (Liberia). Data Protection Act.
  • Court of Appeal ruling reported on 15 January 2026 (Timor-Leste). A data protection law.
  • Bill may be reintroduced (Pakistan). Data protection bill, after drafts in 2018, 2020 and 2023.
  • 2026 amendment Act (Samoa). Removal of the tax exemption for international companies.
Illia Prokopiev

Written by

Illia Prokopiev

Co-Founder and CEO

Illia is the Managing Partner and founder of Licentium. With over 11 years of practice, he has guided innovators through cross-border M&A deals and the disputes that follow, combining transactional skill with courtroom resolve. Admitted to the bar in 2017, he pivoted early to Web3, serving as legal advisor to prominent crypto projects and carrying AML/MLRO duties that anchored complex token, DAO, and compliance questions on solid regulatory ground. Certified in money laundering prevention and an active crypto investor, Illia blends market intuition with a global network of specialists, enabling Licentium to untangle licensing knots for crypto and AI ventures anywhere in the world.

More from the journal

See all

Bafin imposes fine on Nomura Holdings Inc. for WpHG breach

On 15 October 2026, Bafin fined Nomura Holdings Inc. €320,000 for failing to submit voting rights notifications during UniCredit S.p.A.’s takeover bid for Commerzbank AG in May and June 2026.

South African validators supplying crypto staking services to an Irish custodian

A hypothetical South African validator business wants to operate Ethereum infrastructure for an Irish crypto-asset service provider (CASP) authorised to hold customers' cryptoassets. The proposed contract leaves customer relationships and withdrawal credentials with the Irish custodian. The service can be structured as technical outsourcing, but the custodian must retain effective asset control and the signing system must enforce the supplier's limited role. Customer compensation after a validation failure remains a separate question from the supplier's contractual liability.

South African bullion for a Dubai gold token issuer

A hypothetical South African bullion business wants its gold to support a token issued in Dubai, outside the Dubai International Financial Centre. Each token would reference the value of a specified quantity of gold, with redemption rights against its issuer. The business must choose between establishing an issuer within its group and supplying bullion to an independent issuer that accepts the product's legal responsibilities.

Ready to launch without the regulatory guesswork?

Book a 30-minute consultation with a senior advisor and talk through your route.

Get started

Where to go from here

Try Licentium AI

Licentium's AI workspace for regulatory questions. Web3 and AI teams shipping fast.

Browse the Fintech Licensing Hub

Jurisdiction-by-jurisdiction guides on licensing pathways, timelines, and costs.

Talk to us

Book a 30-minute consultation. We'll map your path and tell you what's required.