DEV Community: Accorp Partners

SOC 2 Under Quebec’s Law 25: What Changes If You’re Selling Into Quebec Specifically

Accorp Partners — Fri, 06 Nov 2026 08:32:55 +0000

A SaaS vendor sends its SOC 2 Type 2 report to a Quebec client and assumes the compliance conversation is done. Then the client’s privacy officer asks for a cross-border transfer analysis under Section 17 of Law 25, plus contract clauses the vendor’s standard DPA does not have.

The core point. A SOC 2 report shows that your security controls work. Law 25 puts a separate legal duty on the Quebec client: complete a Privacy Impact Assessment before personal information leaves Quebec. Your report is supporting evidence, not that assessment.

What counts as a transfer. It is broader than storage location. Sending personal information to your API for processing counts, and so does support staff outside Quebec accessing client data for troubleshooting. A vendor with excellent data residency can still trigger the requirement.

Canadian is not the same as Quebec. Law 25 draws the line at Quebec, so a vendor hosted entirely in Ontario or British Columbia still triggers the same assessment.

What the client’s PIA needs from you:

A data flow map showing where data is stored, processed and accessed, including subprocessors.
A current subprocessor list.
Contract clauses on cross-border transfers.
The physical locations of support and operations staff.

The CLOUD Act overlay. A US-headquartered vendor with Canadian hosting can still be compelled by US authorities to produce data, which a Quebec privacy officer must weigh. A SOC 2 report does not address that jurisdictional risk.

What to do. Keep your subprocessor list current, map your data flows, prepare Section 17-aware contract language instead of a generic DPA, and remember that “Canadian” does not mean “Quebec-compliant by default.”

Read the full guide with the FAQs:
https://accorppartners.com/blogs/soc-2/soc-2-under-quebecs-law-25-what-changes-if-youre-selling-into-quebec-specifically

APR for a Spanish Subsidiary: What Your AD Bank Will Ask For

Accorp Partners — Tue, 27 Oct 2026 07:43:16 +0000

An Indian company with a small S.L. in Barcelona opens its annual filing calendar in October and finds the AD bank’s checklist already waiting. Half the items have Spanish names attached, and nobody knows whether the local accounts filed months earlier will do the job. Mostly, they will not, at least not as they stand.

The bank’s first question. Which entity and which investment? It wants the UIN linked to your Form FC, the Spanish company’s legal name and tax number, and your stake. If you hold the company through a holdco, the APR is filed for the direct foreign entity, not the operating company beneath it.

The document pack. Annual accounts (cuentas anuales), an audit report signed by an auditor on the official ROAC register, a shareholder register, share certificate evidence, remittance advices and the signed APR draft. Every document answers one reconciliation question: do what you report, what you remitted and what the company published all agree?

Spanish audit versus APR audit. Spain requires a statutory audit only above certain thresholds, so small companies can file abbreviated accounts. The RBI rule is separate: where the Indian investor controls the foreign entity, the APR needs audited statements, even if Spanish law does not. A locally exempt S.L. still needs an audit if you control it.

Where banks challenge numbers. Spanish filings are public, so a bank can compare your accounts with those deposited at the registry. Common causes of mismatch are draft accounts used for the APR while a later signed set was filed locally, or equity that does not agree with the Form FC.

Practical tips. Verify the auditor’s ROAC registration before signing the engagement letter, ask early whether the bank wants certified translations, and request the audited accounts in spring, not October.

Full guide with the document table and pre-submission checklist:
https://accorppartners.com/blogs/apr/apr-for-a-spanish-subsidiary-what-your-ad-bank-will-ask-for

SOC 2 for German Financial Clients: Where DORA and NIS2 Actually Fit In

Accorp Partners — Mon, 26 Oct 2026 07:53:46 +0000

You have a solid SOC 2 report, the German bank’s security team seems satisfied, and then their risk team asks: “Are you DORA compliant, and what about NIS2?”

A SOC 2 Type 2 report shows your controls work. German financial institutions, however, must prove their entire ICT supply chain can withstand disruption, which is a different question.

What DORA requires. DORA is an EU regulation that has applied to financial entities since January 2025. For vendors, four things matter most: a Register of Information covering every ICT arrangement and subcontractor chain, direct oversight of critical ICT providers, threat-led penetration testing for systemically important institutions, and incident classification within four hours with reporting to BaFin.

What NIS2 adds. Germany transposed NIS2 through its NIS-2 Implementation and Cybersecurity Strengthening Act, in force since December 2025. It focuses on supply chain security, with incident reporting running through the BSI, a separate channel from DORA’s BaFin notification.

DORA takes precedence. Where the two overlap for a financial entity, DORA works as lex specialis, so banks, insurers and payment providers usually have DORA driving their vendor questions.

Where SOC 2 falls short. It does not cover DORA’s contractual requirements (audit rights, exit strategies, subcontracting disclosure), the four-hour incident timeline or threat-led penetration testing.

What to prepare: DORA-ready contract terms, an incident process that supports a four-hour window, a current subprocessor list, and honest wording about what your SOC 2 report covers.

Read the full guide with the FAQs:
https://accorppartners.com/blogs/soc-2/soc-2-for-german-financial-clients-where-dora-and-nis2-actually-fit-in

Which Countries Don’t Require a Statutory Audit? A Country-Wise Table for APR Filers

Accorp Partners — Fri, 23 Oct 2026 07:27:34 +0000

“Our subsidiary is audit-exempt in that country, so there is nothing to audit for the APR.” AD banks hear this every autumn, and it is right only about half the time.

Under Regulation 10(4) of the Overseas Investment Regulations, 2022, unaudited statements can support the APR only if both conditions hold: the Indian investor has no control over the foreign entity, and the host country does not require an audit. A wholly owned subsidiary is controlled by definition, so a local exemption alone does not remove the audit.

Quick country snapshot for small private subsidiaries:

United States: no general audit requirement, but a controlled entity still needs an audit for the APR.
United Kingdom: exempt if two of three size tests are met, with group tests and a 10% member right to demand an audit.
Singapore: exempt if two of three size tests are met for two years, plus the group test.
Hong Kong: no exemption, every active company is audited by a practising CPA.
Australia: small companies are generally exempt, but not when foreign-controlled.
UAE: mainland LLCs must be audited, free zone rules depend on the zone.
Canada: the auditor can be waived, but the waiver must be renewed every year.

Example: an Indian company owns 100% of a Singapore company that is exempt from a local audit. The first test passes, but the second fails because 100% ownership means control, so the APR still needs audited statements.

The exemption belongs to the country, but the audit duty belongs to the investor.

Full guide with the complete country table:
https://accorppartners.com/blogs/apr/which-countries-dont-require-a-statutory-audit-a-country-wise-table-for-apr-filers

Do You Need SOC 2 and BSI C5? A Decision Framework for Companies Selling Into Germany

Accorp Partners — Thu, 22 Oct 2026 07:04:51 +0000

Every SaaS company chasing German enterprise deals eventually hits the same fork in the road. Your SOC 2 report is solid, deals close fine in the US and UK, and then a German procurement team asks a question your sales team did not expect: do you have C5? If you have never worked with BaFin-regulated banks, German public sector buyers or companies under strict German data protection expectations, it can feel like a new mountain appearing out of nowhere. It is not quite that, but deciding whether you need both frameworks, and in what order, is better done deliberately than deal by deal.

What BSI C5 is. C5, the Cloud Computing Compliance Criteria Catalogue, was created in 2016 by Germany’s Federal Office for Information Security and revised as C5:2020. It is a cloud-specific framework with roughly 120 controls across 17 domains, covering physical security, access management, incident response, business continuity and more. Like SOC 2, it comes in Type 1 and Type 2 flavours, and as of mid-2025 the BSI moved to require Type 2 reports for full C5 compliance.

Question one: who is actually asking for it? C5 is effectively mandatory for cloud providers selling to German government agencies and public sector bodies. It is also becoming a hard requirement in regulated sectors: German healthcare regulation under SGB V now requires cloud providers handling certain health and social data to hold a C5 report, and BaFin-regulated financial institutions increasingly expect it as DORA reshapes how banks and insurers think about ICT vendor risk. Outside those categories, many commercial German buyers are still satisfied by a well-documented SOC 2 Type 2 report. Check your real pipeline. If C5 keeps coming up from public sector, healthcare or financial services prospects, that is a real signal. If it came up once, informally, from a single commercial buyer, it is not yet worth restructuring your roadmap around.

Question two: how much of your SOC 2 work carries over? More than most teams expect. C5 was built with reference to ISO 27001, the Cloud Security Alliance’s Cloud Controls Matrix and the BSI’s own IT-Grundschutz catalogues, and the BSI has stated that a C5 audit can be combined with a SOC 2 audit, reusing parts of the system description and audit results where controls overlap. Major cloud providers already maintain combined reports. For a company with a mature SOC 2 program, the extra work is mostly about closing German-specific gaps: transparency about jurisdiction and data processing location, subcontractor disclosure, and more prescriptive identity governance and encryption specifics than SOC 2’s outcome-based criteria usually demand.

Question three: what does running both really cost? The incremental cost rarely sits in rebuilding your controls. It sits in audit logistics: a separate independent auditor, a separate though overlapping evidence cycle, and ongoing maintenance, since C5 reports are typically renewed annually. For a lean compliance team, the real question is not whether C5 is hard, but whether your current operation can absorb a second audit cycle without both starting to feel rushed.

A practical decision framework. Pursue C5 now if your pipeline includes German public sector, healthcare or BaFin-regulated buyers where C5 is a stated requirement rather than a preference, and you already have a reasonably mature SOC 2 Type 2 history. Hold off and lean on SOC 2 if your German pipeline is mostly commercial buyers whose security teams are happy with a strong SOC 2 report and no deal has C5 as a hard gate. Build both in parallel if you see signals from several buyer segments and have the capacity to combine evidence collection from the start. Wait and monitor if C5 has come up only informally and your German pipeline is still early, because building a second attestation reactively is considerably more expensive than sequencing it once the pattern is clear.

How to present your SOC 2 to German buyers. Even if you decide C5 is not yet worth pursuing, be precise about what your report covers. A response that says plainly “our SOC 2 Type 2 report covers these controls, C5-specific transparency disclosures are not yet in scope, and here is how we address data location and subcontractor visibility separately” reads as far more credible than vague reassurance, and it keeps the door open if that buyer later requires C5.

Read the complete guide, including the FAQs:
https://accorppartners.com/blogs/soc-2/do-you-need-soc-2-and-bsi-c5-a-decision-framework-for-companies-selling-into-germany

Can the CPA Who Keeps Your Books Also Audit Them? Auditor Independence for APR

Accorp Partners — Tue, 20 Oct 2026 10:31:29 +0000

A common setup for an Indian-owned US company: a small CPA firm handles the monthly bookkeeping. When APR season arrives, someone asks, “Why not have them audit it too? They already know the numbers.” It sounds efficient. It is also where many files run into trouble. Whether one firm can do both depends on what “keeping the books” actually means, which country’s rules apply, and who makes the accounting decisions, the firm or your management.

The short answer: it depends on who makes the decisions. Professional codes do not ban bookkeeping and audit by the same firm outright for private companies. What they ban is a firm marking its own homework. The AICPA Code calls this the self-review threat: the risk that a CPA will not properly evaluate a service the firm performed and will rely on it when forming an audit judgment. If the firm built the ledger, the audit of that ledger has a blind spot. For a listed company or other public interest entity, the international code prohibits bookkeeping for an audit client. Most Indian-owned foreign subsidiaries are private, so limited, safeguarded bookkeeping is possible, and the conditions matter.

Why independence matters more for an APR. First, the AD bank relies on the report. It cannot re-audit the subsidiary, so it looks at who signed and whether that person is eligible. Second, there is no unaudited fallback. Where you control the entity, Regulation 10(4) of the Overseas Investment Regulations, 2022 requires audited statements, and a wholly owned subsidiary is controlled by definition. Third, the consequences fall on the Indian parent. A report the bank will not accept counts as an APR not filed, which puts FEMA compliance and new remittances at risk.

How the rulebooks treat it. Under the AICPA Code, bookkeeping is a non-attest service that a CPA can provide to an audit client only if the client assumes all management responsibilities, names someone with suitable skill to oversee the work, evaluates the results and accepts responsibility for them. Under the IESBA Code, bookkeeping for a non-public-interest audit client is allowed only if it is routine or mechanical and the threats are reduced to an acceptable level, for example by using people who are not on the audit team and having an independent reviewer check the work. The UK, Singapore and other codes follow the same architecture, so ask your auditor which local code governs and confirm the position in writing.

What crosses the line. Setting accounting policies, originating or changing journal entries, and approving how transactions are classified are management decisions, and a firm that makes them cannot then audit the result. Ordinary help is different: posting entries your management approved, or explaining a standard during the audit, does not usually create a problem if your management stays in charge. The test is simple. Did your finance team decide, or did the auditor decide and your team approve without understanding?

The Indian side. Section 144 of the Companies Act, 2013 bars the statutory auditor of an Indian company from providing accounting and bookkeeping services to the company, its holding company or its subsidiary company. Whether “subsidiary” reaches an overseas entity is debated, and careful firms treat it as reaching, which is the safer reading.

Compilation is not a shortcut. A compilation under US standards does not require independence because it gives no assurance. For that reason it cannot stand in for an audit where the Indian parent has control.

If you want one firm on both sides. For a small subsidiary, two separate firms is usually the cleanest answer. If you keep one, insist on separate teams, management approval of every journal entry, written engagement terms that say who owns each decision, a written independence assessment before fieldwork starts, and a short memo on the choice kept on file for the AD bank.

Read the complete guide, including the questions CFOs and AD banks ask:
https://accorppartners.com/blogs/apr/can-the-cpa-who-keeps-your-books-also-audit-them-auditor-independence-for-apr

Selling SaaS Into Japan: How SOC 2 Reporting and ISMAP Actually Fit Together

Accorp Partners — Mon, 19 Oct 2026 07:09:37 +0000

Every SaaS company chasing government or enterprise contracts in Japan eventually hears the same question from a prospect’s procurement team: are you ISMAP registered? If your sales conversations so far have mostly involved US and European buyers who ask for a SOC 2 report and move on, this can feel like a separate compliance track appearing out of nowhere. It is not unrelated, and the two frameworks share real common ground, but it helps to know exactly where SOC 2 ends and ISMAP begins before it slows down a deal you thought was nearly closed.

What ISMAP is. The Information System Security Management and Assessment Program is a cloud assessment program run by the Japanese government and launched in 2020. It is often called Japan’s FedRAMP. Services that meet the government’s security requirements are registered on a public list, and government agencies are expected to procure cloud services from that list. For Japanese public sector contracts, registration is effectively a precondition, and private buyers increasingly treat it as an informal trust signal too.

Why it looks scarier than it is. The standard framework has roughly 1,200 controls, built on ISO 27001 and extended with cloud-specific requirements from ISO 27017. Next to a SOC 2 audit that is scoped around a few Trust Services Criteria, that sounds like a different universe. In practice, a large share of the requirements are governance and management criteria that a mature security program already covers, and ISMAP’s later chapters map directly onto ISO 27001’s Annex A. Because SOC 2’s Security, Availability and Confidentiality criteria overlap heavily with ISO 27001, more than half of ISMAP’s control set maps back to controls that a company with a solid SOC 2 Type 2 report has probably already built and evidenced.

ISMAP-LIU is the lighter path most SaaS companies need. ISMAP-LIU, for Low-Impact Use, is a streamlined version designed for SaaS services handling lower-risk data, generally Confidentiality class-2 information. Instead of nearly 1,200 requirements, external assessment narrows to roughly 148 controls across 230 requirements. The remaining governance-level requirements are handled through an internal audit tested once per three-year cycle rather than externally assessed each time. For a typical business application, that is the more realistic and proportionate target.

How much of your SOC 2 work transfers. A lot, but not everything. During the Control Description Validation phase, a registered third-party assessor reviews your documented controls, and this is where existing SOC 2 or ISO 27001 documentation is reused instead of rewritten. Access management, logging and monitoring, incident response, change management and vendor risk are the same categories your SOC 2 auditor already tested. What does not carry over automatically is ISMAP’s structured data classification and cloud governance layer, and the fact that all ISMAP documentation must be submitted in Japanese, so translation is a real line item, not an afterthought.

Where the two diverge. SOC 2 is an attestation: a CPA firm’s opinion that you share selectively with buyers who ask for it. ISMAP is a registration model, where an approved service appears on a public list that procurement teams reference directly. The assessors also differ. A SOC 2 auditor is a licensed CPA firm working under AICPA standards, while ISMAP assessments must be performed by assessors on the official ISMAP Assessor List. Registration is then maintained through annual audits.

A sensible order of work. Build and maintain a strong SOC 2 Type 2 report first, since both international buyers and much of the ISMAP control mapping lean on it. Decide early whether ISMAP-LIU rather than full ISMAP matches your risk classification and target buyer, because that single decision changes the project scope by nearly an order of magnitude. Budget for Japanese documentation. And engage an ISMAP-approved assessor early in scoping so gaps between your SOC 2 evidence and ISMAP’s requirements surface before the assessment, not during it.

Even before you pursue ISMAP formally, it helps to be explicit with Japanese prospects about what your SOC 2 report already demonstrates, framed in ISO 27001-aligned language their security team recognises.

Read the complete guide, including the FAQs:
https://accorppartners.com/blogs/soc-2/selling-saas-into-japan-how-soc-2-reporting-and-ismap-actually-fit-together

Equal Stakes, One APR: How Two Indian Investors File Jointly or Authorise a Single Filer

Accorp Partners — Fri, 16 Oct 2026 07:10:19 +0000

“Two of us own the company. So who files the APR?” The question comes up the first time two Indian investors share a foreign entity. The answer sits in one short instruction on RBI’s own APR form, and most finance teams never read it. Get it wrong and nobody files, because each side assumes the other has it covered. That is how a routine annual return becomes a FEMA compliance problem.

What the RBI instruction says. Every resident who makes overseas direct investment in a foreign entity must report on it each year. Where more than one resident has invested in the same entity, Instruction 4 to the APR form settles who files. The resident holding the highest stake files. If holdings are equal, the APR may be filed jointly, or the investors can authorise one of them to file for all. This is a rule about responsibility, not about splitting the report. There is one APR for each foreign entity, filed through the AD bank by 31 December, and not one APR per investor.

Working out the highest stake. The test compares each Indian investor’s own shareholding in the foreign entity. If Company A holds 40%, Company B holds 35% and a foreign partner holds 25%, Company A files. If A and B each hold 30% and the foreign partner holds 40%, the stakes are equal, so you file jointly or authorise one. One detail catches people out: the capital structure paragraph of the form shows the combined stake of all Indian residents, so in the first example the APR would show 75% Indian even though Company A holds 40%. The form reports the combined holding, while the highest-stake test picks the filer.

Equal stakes: two ways to handle it. Filing jointly keeps both investors visibly involved, but it needs two boards, two sets of signatories and possibly two AD banks to move in step. Authorising one filer is usually more practical, with one owner and one timeline. Pick the investor with the stronger finance team or the easier bank relationship. Choosing the filer also decides whose auditor signs, so settle it before the audit starts, not after.

What the filer takes on. Being the filer means owning more than the submission. The form asks the filer to confirm that all earlier APRs for the entity have been filed, so a gap in one investor’s record can hold up the filing for everyone. Shareholding changes during the year must be reported, and leaving them out counts as not submitting the APR at all. And the control answer decides whether unaudited accounts are ever possible.

The audit in a jointly owned company. Audited financial statements of the foreign entity are the default basis, and the exception needs both no control and no audit mandate in the host country. In a joint venture that is open to argument, so treat an audit as the working assumption. One audit of the entity serves the APR for every Indian investor. The practical work is agreeing who instructs the auditor, how the fee is split, and who chases the books, especially when the foreign partner runs the accounts.

Put it in writing. A short authorisation note should name the foreign entity and each investor’s UIN, the years it covers, who signs and which board approvals are needed, a date by which final accounts must reach the filer well before 31 December, how audit costs and any late fee are shared, and what happens if the filer sells down or changes AD bank.

Where it goes wrong. Nobody files, because each investor assumes the other has it. A late APR can be regularised with a flat late submission fee of Rs 7,500 per return for up to three years, after which compounding is needed, and banks have reportedly held back further remittances until pending APRs are cleared. Stakes also shift: a capital top-up can make a different investor the highest holder, so recheck the position every year.

The rule is short, but it only works if someone owns it. Decide before December, record the decision, and put a yearly recheck in the calendar.

Read the complete guide, including the full stake examples and authorisation checklist:
https://accorppartners.com/blogs/apr/equal-stakes-one-apr-how-two-indian-investors-file-jointly-or-authorise-a-single-filer

SOC 2 Isn’t Enough for Japan: What APPI’s Cross-Border Transfer Rules Require

Accorp Partners — Thu, 15 Oct 2026 07:05:11 +0000

Every SaaS company selling into Japan eventually has the same conversation with a customer’s legal team: your SOC 2 report looks solid, but how are you handling APPI’s cross-border transfer requirements? If your compliance program was built around US and European buyers, this question can catch you off guard. A clean SOC 2 report does not touch it at all, and assuming it does is one of the more common and more expensive mistakes companies make when Japan becomes a real part of their pipeline.

Why SOC 2 and APPI solve different problems. A SOC 2 Type 2 report tells a customer that an independent CPA firm tested your controls over a real review period: access management, encryption, monitoring and incident response. It says nothing about the legal basis for moving personal data about a person in Japan outside the country. A Japanese legal team treats these as two separate questions. SOC 2 answers “can we trust your controls”, while APPI answers “do you have a lawful basis to move our users’ data to servers outside Japan”.

APPI applies even without an office in Japan. If you handle personal data of individuals located in Japan while providing goods or services to people or companies there, APPI applies to you wherever you are based. A US or Indian SaaS company selling entirely remotely is in scope the moment it processes data from users in Japan.

What counts as a cross-border transfer. Making data accessible to a foreign entity over a network counts as provision, not just physically handing it over. Even a Japanese subsidiary’s data being accessible to its foreign parent company can trigger the transfer rules. For SaaS companies, this usually means any customer data from Japanese users that is stored on or accessible from infrastructure or personnel outside Japan, including standard offshore cloud hosting.

Three paths to a lawful transfer.

First, destination whitelisting. If the receiving country is designated by Japan’s Personal Information Protection Commission as adequate, transfers can proceed without individual consent. The list is narrow, covering the EU and UK, so for most US and Indian companies this route is not available.

Second, individual consent with mandatory disclosure. Generic consent buried in a privacy policy is not enough. The business must name the destination country and explain how that country’s data protection regime differs from Japan’s. If the exact country cannot be specified, the business must explain why and give alternative information. Consent without this disclosure is treated as invalid.

Third, a system conforming to the standards. A business can transfer data without consent if a contractual or systemic arrangement ensures the foreign recipient handles data with measures equivalent to APPI’s. The catch is an ongoing duty: the business must check at least once a year that the equivalent protection is still in place, and must provide information about it to data subjects on request.

Why this trips up strong SOC 2 programs. Legal and privacy teams usually handle consent language while security teams manage the SOC 2 audit, and if the two do not meet, a company can pass its SOC 2 cycle every year while staying non-compliant with APPI. Typical gaps are consent that never named the destination country, or no one owning the annual monitoring cycle.

What to do. Map where Japanese user data actually goes, including your own foreign parent and affiliates. Choose a transfer mechanism deliberately. Put the annual monitoring on a calendar with an owner if you use the systemic route. Keep privacy notices specific to each destination country. And bring your SOC 2 auditor and privacy counsel together so a Japanese buyer gets one coherent answer.

Read the complete guide, including the FAQs:
https://accorppartners.com/blogs/soc-2/soc-2-isnt-enough-for-japan-what-appis-cross-border-transfer-rules-actually-require

Form APR vs Form ODI Part II: Which Name Does Your AD Bank Use in 2026?

Accorp Partners — Wed, 14 Oct 2026 08:08:54 +0000

Ask five finance teams what they file every December for their overseas subsidiary, and you will hear “the APR”, “ODI Part II”, “the ODI form” and “Form APR”. All of them are referring to the same document. Whether your bank writes one name or the other on its checklist changes nothing about what you must submit, but it can change which template you are handed.

The short answer is one report, two labels. The Annual Performance Report is the yearly return an Indian investor files for each foreign entity it holds under ODI. Since the overseas investment framework took effect on 22 August 2022, RBI’s prescribed format is titled “Annual Performance Report (APR)”. Before that, the same report was filed in a form called ODI Part II. So “Form APR” is the current name, and “ODI Part II” is the older name that never quite went away.

How the confusion started. The 2022 framework replaced the old FEMA Notification 120 regime, but old habits outlast legal changes. The label “ODI Part II” survives in RBI’s own late-fee table, which still reads “Form ODI Part-II/APR” for the flat Rs 7,500 fee, in bank checklists written before 2022, and in practitioner guides that use both names.

What the current Form APR contains. More useful than the name is what the document holds: the period covered and the UIN, the capital structure of the foreign entity, changes in shareholding during the year, two years of financial position, repatriation and retained earnings, details of any step-down subsidiary, a declaration by the Indian investor, a signed block by the statutory auditor or a chartered accountant with a UDIN, and an AD bank block.

Which name does your AD bank use? No public source can tell you for a specific bank, since a branch may use whatever wording its ODI desk has always used. Ask for the bank’s ODI checklist and the template it wants uploaded. If the checklist says “ODI Part II” but the template has the fields above, the bank is simply using the old name for the current form. If the template lacks the step-down subsidiary section, the declarations or the auditor and bank blocks, you may have an older layout, so ask the bank to confirm it is the format RBI prescribed in 2022.

Why the wrong template can cost you. Failing to report step-down subsidiary or shareholding changes amounts to non-submission of the APR, and an old template will never remind you. It may also leave out declarations such as confirming that share certificates reached the AD bank within six months. And if the bank finds the problem late, you will be redoing it against the December deadline, alongside the audit sign-off.

Keep the naming consistent. In engagement letters, a safe wording is “for the Annual Performance Report under the Overseas Investment Regulations, 2022”, which is accurate under either name. In your own records, use one label, for example “APR (Form APR, earlier Form ODI Part II)”.

Read the complete guide, including a quick checklist for this December:
https://accorppartners.com/blogs/apr/form-apr-vs-form-odi-part-ii-which-name-does-your-ad-bank-use-in-2026

Does Your SOC 2 Report Actually Satisfy Australia’s APP 8?

Accorp Partners — Tue, 13 Oct 2026 08:07:26 +0000

Every SaaS company selling into Australia eventually runs into this conversation. A prospect’s privacy team reads your SOC 2 report, seems happy with the security posture it describes, and then asks a different question: how are you handling APP 8?

If your compliance program was built around US and European buyers who ask for a SOC 2 report and move on, this can feel like a curveball. It is really a separate legal requirement, and assuming SOC 2 covers it tends to surface at the worst moment, during an Australian customer’s final legal review.

What APP 8 requires. Australian Privacy Principle 8 governs the cross-border disclosure of personal information under the Privacy Act 1988. Before an Australian business discloses personal information to a recipient outside Australia, it must take reasonable steps to make sure that recipient handles the information consistently with the Australian Privacy Principles. For most SaaS companies this happens constantly, through offshore cloud storage, CRM and marketing tools on US infrastructure, payment processors and AI tools on overseas servers.

Why accountability is the central idea. Under section 16C of the Privacy Act, if an overseas recipient does something that would have breached the APPs had the Australian business done it directly, the Australian business is treated as having breached the APPs itself. Accountability does not move to the vendor. So an Australian company cannot close the matter by pointing to a vendor’s privacy policy or SOC 2 report.

Where SOC 2 helps. A well-documented SOC 2 Type 2 report shows sustained operation of access controls, encryption and monitoring. That gives an Australian customer’s privacy team useful evidence for their own reasonable-steps assessment of you as a vendor. It supports the process, but it does not replace it.

Where SOC 2 falls short. Three things sit outside what a SOC 2 auditor examines. First, Data Processing Agreements with enforceable terms equivalent to the APPs. Second, privacy policy disclosure of overseas recipients and the countries data may be sent to. Third, the accountability chain itself, which stays with the Australian entity whatever the vendor’s controls look like.

The exceptions rarely apply cleanly. APP 8 has exceptions for informed consent, a reasonable belief that the recipient’s country has substantially similar protection, and recipients with an Australian link. Buried boilerplate does not count as informed consent, and the similar-protection test needs real analysis, so for most foreign SaaS vendors the reasonable-steps obligation is the working framework.

What to do in practice. Inventory every system that touches Australian personal information. Put Data Processing Agreements in place with your own overseas subprocessors. Name the categories of recipients and the countries in your privacy policy instead of using generic wording. And present your SOC 2 report as supporting evidence, stating clearly that your DPA and disclosure framework separately address APP 8.

Read the complete guide, including the FAQs:
https://accorppartners.com/blogs/soc-2/does-your-soc-2-report-actually-satisfy-australias-app-8-what-cross-border-data-rules-really-require

The APR Deadline Countdown: What to Do in October, November and December

Accorp Partners — Mon, 12 Oct 2026 09:54:44 +0000

Every year the same pattern repeats. Companies with overseas subsidiaries treat 31 December as a single date, when it is really the finish line of a three-month process. The APR form and the AD Bank submission take very little time once everything is ready. What eats the calendar is the audit of the foreign subsidiary’s financials, which usually runs 60 to 90 days once a qualified auditor is engaged.

Here is how to split the work across the three months.

October is when the clock starts. Confirm your ODI structure, including your UIN, last year’s APR history and any change in shareholding or step-down subsidiaries. Engage the right auditor for the jurisdiction: a licensed US CPA for a US entity, and an ICAEW or ACCA-qualified professional for a UK entity. A report signed by the wrong type of professional is rejected by the AD Bank. Start collecting the subsidiary’s balance sheet and profit and loss statement, and deal with any prior-year defaults now.

November is where most delays happen. The audit should be underway, not just started. Answer auditor queries within days, not weeks. Reconcile draft figures against your original ODI records, covering the amount invested, shareholding, loans and guarantees. If you have subsidiaries in more than one country, track every audit against the same finish line. Book the Indian CA review now, so you are not hunting for availability in December.

December is execution, not preparation. Assemble the full dossier before submitting: audited financials, the signed auditor certification, a UIN that matches across every document, and a correctly filled Form ODI Part II. Submit in the first half of the month so there is room to handle a bank rejection, and keep following up until you hold a stamped acknowledgement, not just a submission confirmation.

If it is already December and the audit has not started, the timeline is tight but not lost. Every step needs to move with urgency, and having one team coordinate the audit, CA review and submission helps.

Read the complete month-by-month guide, including FAQs on prior-year defaults and reconciliation:
https://accorppartners.com/blogs/apr/the-apr-deadline-countdown-what-to-do-in-october-november-and-december