DEV Community: Accorp Partners

Equal Stakes, One APR: How Two Indian Investors File Jointly or Authorise a Single Filer

Accorp Partners — Fri, 16 Oct 2026 07:10:19 +0000

“Two of us own the company. So who files the APR?” The question comes up the first time two Indian investors share a foreign entity. The answer sits in one short instruction on RBI’s own APR form, and most finance teams never read it. Get it wrong and nobody files, because each side assumes the other has it covered. That is how a routine annual return becomes a FEMA compliance problem.

What the RBI instruction says. Every resident who makes overseas direct investment in a foreign entity must report on it each year. Where more than one resident has invested in the same entity, Instruction 4 to the APR form settles who files. The resident holding the highest stake files. If holdings are equal, the APR may be filed jointly, or the investors can authorise one of them to file for all. This is a rule about responsibility, not about splitting the report. There is one APR for each foreign entity, filed through the AD bank by 31 December, and not one APR per investor.

Working out the highest stake. The test compares each Indian investor’s own shareholding in the foreign entity. If Company A holds 40%, Company B holds 35% and a foreign partner holds 25%, Company A files. If A and B each hold 30% and the foreign partner holds 40%, the stakes are equal, so you file jointly or authorise one. One detail catches people out: the capital structure paragraph of the form shows the combined stake of all Indian residents, so in the first example the APR would show 75% Indian even though Company A holds 40%. The form reports the combined holding, while the highest-stake test picks the filer.

Equal stakes: two ways to handle it. Filing jointly keeps both investors visibly involved, but it needs two boards, two sets of signatories and possibly two AD banks to move in step. Authorising one filer is usually more practical, with one owner and one timeline. Pick the investor with the stronger finance team or the easier bank relationship. Choosing the filer also decides whose auditor signs, so settle it before the audit starts, not after.

What the filer takes on. Being the filer means owning more than the submission. The form asks the filer to confirm that all earlier APRs for the entity have been filed, so a gap in one investor’s record can hold up the filing for everyone. Shareholding changes during the year must be reported, and leaving them out counts as not submitting the APR at all. And the control answer decides whether unaudited accounts are ever possible.

The audit in a jointly owned company. Audited financial statements of the foreign entity are the default basis, and the exception needs both no control and no audit mandate in the host country. In a joint venture that is open to argument, so treat an audit as the working assumption. One audit of the entity serves the APR for every Indian investor. The practical work is agreeing who instructs the auditor, how the fee is split, and who chases the books, especially when the foreign partner runs the accounts.

Put it in writing. A short authorisation note should name the foreign entity and each investor’s UIN, the years it covers, who signs and which board approvals are needed, a date by which final accounts must reach the filer well before 31 December, how audit costs and any late fee are shared, and what happens if the filer sells down or changes AD bank.

Where it goes wrong. Nobody files, because each investor assumes the other has it. A late APR can be regularised with a flat late submission fee of Rs 7,500 per return for up to three years, after which compounding is needed, and banks have reportedly held back further remittances until pending APRs are cleared. Stakes also shift: a capital top-up can make a different investor the highest holder, so recheck the position every year.

The rule is short, but it only works if someone owns it. Decide before December, record the decision, and put a yearly recheck in the calendar.

Read the complete guide, including the full stake examples and authorisation checklist:
https://accorppartners.com/blogs/apr/equal-stakes-one-apr-how-two-indian-investors-file-jointly-or-authorise-a-single-filer

SOC 2 Isn’t Enough for Japan: What APPI’s Cross-Border Transfer Rules Require

Accorp Partners — Thu, 15 Oct 2026 07:05:11 +0000

Every SaaS company selling into Japan eventually has the same conversation with a customer’s legal team: your SOC 2 report looks solid, but how are you handling APPI’s cross-border transfer requirements? If your compliance program was built around US and European buyers, this question can catch you off guard. A clean SOC 2 report does not touch it at all, and assuming it does is one of the more common and more expensive mistakes companies make when Japan becomes a real part of their pipeline.

Why SOC 2 and APPI solve different problems. A SOC 2 Type 2 report tells a customer that an independent CPA firm tested your controls over a real review period: access management, encryption, monitoring and incident response. It says nothing about the legal basis for moving personal data about a person in Japan outside the country. A Japanese legal team treats these as two separate questions. SOC 2 answers “can we trust your controls”, while APPI answers “do you have a lawful basis to move our users’ data to servers outside Japan”.

APPI applies even without an office in Japan. If you handle personal data of individuals located in Japan while providing goods or services to people or companies there, APPI applies to you wherever you are based. A US or Indian SaaS company selling entirely remotely is in scope the moment it processes data from users in Japan.

What counts as a cross-border transfer. Making data accessible to a foreign entity over a network counts as provision, not just physically handing it over. Even a Japanese subsidiary’s data being accessible to its foreign parent company can trigger the transfer rules. For SaaS companies, this usually means any customer data from Japanese users that is stored on or accessible from infrastructure or personnel outside Japan, including standard offshore cloud hosting.

Three paths to a lawful transfer.

First, destination whitelisting. If the receiving country is designated by Japan’s Personal Information Protection Commission as adequate, transfers can proceed without individual consent. The list is narrow, covering the EU and UK, so for most US and Indian companies this route is not available.

Second, individual consent with mandatory disclosure. Generic consent buried in a privacy policy is not enough. The business must name the destination country and explain how that country’s data protection regime differs from Japan’s. If the exact country cannot be specified, the business must explain why and give alternative information. Consent without this disclosure is treated as invalid.

Third, a system conforming to the standards. A business can transfer data without consent if a contractual or systemic arrangement ensures the foreign recipient handles data with measures equivalent to APPI’s. The catch is an ongoing duty: the business must check at least once a year that the equivalent protection is still in place, and must provide information about it to data subjects on request.

Why this trips up strong SOC 2 programs. Legal and privacy teams usually handle consent language while security teams manage the SOC 2 audit, and if the two do not meet, a company can pass its SOC 2 cycle every year while staying non-compliant with APPI. Typical gaps are consent that never named the destination country, or no one owning the annual monitoring cycle.

What to do. Map where Japanese user data actually goes, including your own foreign parent and affiliates. Choose a transfer mechanism deliberately. Put the annual monitoring on a calendar with an owner if you use the systemic route. Keep privacy notices specific to each destination country. And bring your SOC 2 auditor and privacy counsel together so a Japanese buyer gets one coherent answer.

Read the complete guide, including the FAQs:
https://accorppartners.com/blogs/soc-2/soc-2-isnt-enough-for-japan-what-appis-cross-border-transfer-rules-actually-require

Form APR vs Form ODI Part II: Which Name Does Your AD Bank Use in 2026?

Accorp Partners — Wed, 14 Oct 2026 08:08:54 +0000

Ask five finance teams what they file every December for their overseas subsidiary, and you will hear “the APR”, “ODI Part II”, “the ODI form” and “Form APR”. All of them are referring to the same document. Whether your bank writes one name or the other on its checklist changes nothing about what you must submit, but it can change which template you are handed.

The short answer is one report, two labels. The Annual Performance Report is the yearly return an Indian investor files for each foreign entity it holds under ODI. Since the overseas investment framework took effect on 22 August 2022, RBI’s prescribed format is titled “Annual Performance Report (APR)”. Before that, the same report was filed in a form called ODI Part II. So “Form APR” is the current name, and “ODI Part II” is the older name that never quite went away.

How the confusion started. The 2022 framework replaced the old FEMA Notification 120 regime, but old habits outlast legal changes. The label “ODI Part II” survives in RBI’s own late-fee table, which still reads “Form ODI Part-II/APR” for the flat Rs 7,500 fee, in bank checklists written before 2022, and in practitioner guides that use both names.

What the current Form APR contains. More useful than the name is what the document holds: the period covered and the UIN, the capital structure of the foreign entity, changes in shareholding during the year, two years of financial position, repatriation and retained earnings, details of any step-down subsidiary, a declaration by the Indian investor, a signed block by the statutory auditor or a chartered accountant with a UDIN, and an AD bank block.

Which name does your AD bank use? No public source can tell you for a specific bank, since a branch may use whatever wording its ODI desk has always used. Ask for the bank’s ODI checklist and the template it wants uploaded. If the checklist says “ODI Part II” but the template has the fields above, the bank is simply using the old name for the current form. If the template lacks the step-down subsidiary section, the declarations or the auditor and bank blocks, you may have an older layout, so ask the bank to confirm it is the format RBI prescribed in 2022.

Why the wrong template can cost you. Failing to report step-down subsidiary or shareholding changes amounts to non-submission of the APR, and an old template will never remind you. It may also leave out declarations such as confirming that share certificates reached the AD bank within six months. And if the bank finds the problem late, you will be redoing it against the December deadline, alongside the audit sign-off.

Keep the naming consistent. In engagement letters, a safe wording is “for the Annual Performance Report under the Overseas Investment Regulations, 2022”, which is accurate under either name. In your own records, use one label, for example “APR (Form APR, earlier Form ODI Part II)”.

Read the complete guide, including a quick checklist for this December:
https://accorppartners.com/blogs/apr/form-apr-vs-form-odi-part-ii-which-name-does-your-ad-bank-use-in-2026

Does Your SOC 2 Report Actually Satisfy Australia’s APP 8?

Accorp Partners — Tue, 13 Oct 2026 08:07:26 +0000

Every SaaS company selling into Australia eventually runs into this conversation. A prospect’s privacy team reads your SOC 2 report, seems happy with the security posture it describes, and then asks a different question: how are you handling APP 8?

If your compliance program was built around US and European buyers who ask for a SOC 2 report and move on, this can feel like a curveball. It is really a separate legal requirement, and assuming SOC 2 covers it tends to surface at the worst moment, during an Australian customer’s final legal review.

What APP 8 requires. Australian Privacy Principle 8 governs the cross-border disclosure of personal information under the Privacy Act 1988. Before an Australian business discloses personal information to a recipient outside Australia, it must take reasonable steps to make sure that recipient handles the information consistently with the Australian Privacy Principles. For most SaaS companies this happens constantly, through offshore cloud storage, CRM and marketing tools on US infrastructure, payment processors and AI tools on overseas servers.

Why accountability is the central idea. Under section 16C of the Privacy Act, if an overseas recipient does something that would have breached the APPs had the Australian business done it directly, the Australian business is treated as having breached the APPs itself. Accountability does not move to the vendor. So an Australian company cannot close the matter by pointing to a vendor’s privacy policy or SOC 2 report.

Where SOC 2 helps. A well-documented SOC 2 Type 2 report shows sustained operation of access controls, encryption and monitoring. That gives an Australian customer’s privacy team useful evidence for their own reasonable-steps assessment of you as a vendor. It supports the process, but it does not replace it.

Where SOC 2 falls short. Three things sit outside what a SOC 2 auditor examines. First, Data Processing Agreements with enforceable terms equivalent to the APPs. Second, privacy policy disclosure of overseas recipients and the countries data may be sent to. Third, the accountability chain itself, which stays with the Australian entity whatever the vendor’s controls look like.

The exceptions rarely apply cleanly. APP 8 has exceptions for informed consent, a reasonable belief that the recipient’s country has substantially similar protection, and recipients with an Australian link. Buried boilerplate does not count as informed consent, and the similar-protection test needs real analysis, so for most foreign SaaS vendors the reasonable-steps obligation is the working framework.

What to do in practice. Inventory every system that touches Australian personal information. Put Data Processing Agreements in place with your own overseas subprocessors. Name the categories of recipients and the countries in your privacy policy instead of using generic wording. And present your SOC 2 report as supporting evidence, stating clearly that your DPA and disclosure framework separately address APP 8.

Read the complete guide, including the FAQs:
https://accorppartners.com/blogs/soc-2/does-your-soc-2-report-actually-satisfy-australias-app-8-what-cross-border-data-rules-really-require

The APR Deadline Countdown: What to Do in October, November and December

Accorp Partners — Mon, 12 Oct 2026 09:54:44 +0000

Every year the same pattern repeats. Companies with overseas subsidiaries treat 31 December as a single date, when it is really the finish line of a three-month process. The APR form and the AD Bank submission take very little time once everything is ready. What eats the calendar is the audit of the foreign subsidiary’s financials, which usually runs 60 to 90 days once a qualified auditor is engaged.

Here is how to split the work across the three months.

October is when the clock starts. Confirm your ODI structure, including your UIN, last year’s APR history and any change in shareholding or step-down subsidiaries. Engage the right auditor for the jurisdiction: a licensed US CPA for a US entity, and an ICAEW or ACCA-qualified professional for a UK entity. A report signed by the wrong type of professional is rejected by the AD Bank. Start collecting the subsidiary’s balance sheet and profit and loss statement, and deal with any prior-year defaults now.

November is where most delays happen. The audit should be underway, not just started. Answer auditor queries within days, not weeks. Reconcile draft figures against your original ODI records, covering the amount invested, shareholding, loans and guarantees. If you have subsidiaries in more than one country, track every audit against the same finish line. Book the Indian CA review now, so you are not hunting for availability in December.

December is execution, not preparation. Assemble the full dossier before submitting: audited financials, the signed auditor certification, a UIN that matches across every document, and a correctly filled Form ODI Part II. Submit in the first half of the month so there is room to handle a bank rejection, and keep following up until you hold a stamped acknowledgement, not just a submission confirmation.

If it is already December and the audit has not started, the timeline is tight but not lost. Every step needs to move with urgency, and having one team coordinate the audit, CA review and submission helps.

Read the complete month-by-month guide, including FAQs on prior-year defaults and reconciliation:
https://accorppartners.com/blogs/apr/the-apr-deadline-countdown-what-to-do-in-october-november-and-december

Delaware Flip Founders: Do You Owe APR on Your US Parent Shares?

Accorp Partners — Fri, 09 Oct 2026 08:02:29 +0000

Somewhere between the term sheet and the closing call, the lawyers say the words “we’ll flip to Delaware.” A US parent is formed, founder shares are swapped, the Indian company becomes its subsidiary, and everyone moves on to the fundraise. What rarely gets discussed is that you, still a resident of India, now hold equity in a foreign company. That brings a yearly RBI filing with it.

Under the Overseas Investment Rules, 2022, a person resident in India who acquires unlisted equity in a foreign entity is treated as making overseas direct investment (ODI). So a founder’s allotment of US parent shares counts as an investment, even if the shares came through a swap or were issued at par. Once it counts as ODI, the Annual Performance Report (APR) follows every year for as long as you hold the shares.

Whether you actually have to file depends on three tests.

Test one is FEMA residency. FEMA has its own definition, different from the income tax test. A founder who has genuinely relocated to the US is generally outside the framework, while a founder still living and working in India is inside it.

Test two is stake and control. A resident holding less than 10% of the foreign entity, with no control and no other financial commitment, is not required to file. But control is defined broadly. A co-founder with 8% and a board seat, veto rights or a voting agreement may still be treated as having control. Loans to the US company or personal guarantees also remove the exemption.

Test three is who files when several co-founders are residents. The investor with the highest stake files, or the investors designate one person and give the AD bank an undertaking.

When you have control, the APR must be based on audited financial statements of the US company. Delaware has no statutory audit requirement for most private companies, but RBI’s requirement is separate, and the audit must come from a licensed professional in the host country, which means a US CPA firm.

The APR is due by 31 December each year. A late filing can be regularised with a flat late submission fee of Rs 7,500 per return if you opt for it within three years of the due date. Beyond that, compounding is slower and costlier.

Read the complete guide, including a quick self-check before 31 December:
https://accorppartners.com/blogs/apr/delaware-flip-founders-do-you-owe-apr-on-your-us-parent-shares

APR for Hong Kong Companies: Who Can Sign the Audit?

Accorp Partners — Thu, 08 Oct 2026 08:24:30 +0000

Ask a Hong Kong auditor whether your company needs an audit and the answer is almost always yes. Ask an Indian CA the same question about the Annual Performance Report (APR) and you may hear that their certificate is enough. Both cannot be right, and this gap causes most of the rejected APR filings on Hong Kong subsidiaries.

Hong Kong has no small-company audit exemption. Under the Companies Ordinance, every Hong Kong company must have its accounts audited every year, whatever its turnover. The only real exception is a company that has formally declared itself dormant. RBI’s unaudited route applies only where the Indian investor has no control and the host country does not require an audit, so an active Hong Kong subsidiary needs audited statements regardless of shareholding.

The audit report must be signed by a Certified Public Accountant (Practising) registered with the HKICPA and holding a current practising certificate. This rules out an Indian chartered accountant, a US CPA, a UK ACA or a Singapore ISCA member, and the firm that only prepared the accounts unless it is properly appointed and independent. Before engaging anyone, check the HKICPA public register and ask for the practising certificate number.

A dormant company still counts as an overseas investment, so an APR is still due each year. Where you control it, the cautious approach is to have a CPA (Practising) sign off the nil-activity statements, and to confirm the treatment with your AD bank before December.

On timing, a 31 March year-end matches the Indian year. A typical cycle is fieldwork from July to September, the signed report by October, and the APR sent to the AD bank in November, with 31 December as the outer limit.

AD banks usually reject filings over small mismatches. Check that the Unique Identification Number is identical everywhere, one currency is used throughout, the share capital matches your remittance records, step-down subsidiaries are disclosed, and related-party loans reconcile to the audited notes.

A late APR can be regularised with a flat late submission fee of Rs 7,500 per return if you opt for it within three years of the due date. After that, compounding is slower and costlier.

Read the complete guide here:
https://accorppartners.com/blogs/apr/apr-for-hong-kong-companies-who-can-sign-the-audit

SOC 2 Confidentiality Criteria: What Counts as Confidential Data (And What Doesn't)

Accorp Partners — Wed, 07 Oct 2026 08:15:46 +0000

Confidentiality is one of the five SOC 2 Trust Services Criteria, and it is also the most misunderstood. Many teams assume it means keeping customer data safe in general, when it actually has a much narrower definition.

Confidentiality applies to information your company has specifically committed, through a contract, NDA or written policy, to protect from unauthorized disclosure. This usually includes trade secrets, pricing models, product roadmaps, customer data that a contract labels confidential, partner information shared under NDA, and system configuration details.

The line most companies get wrong is Confidentiality versus Privacy. Privacy covers personal information tied to an individual. Confidentiality covers business or third-party information you have agreed to protect. Mixing the two can cost weeks of misdirected audit preparation.

When testing this criterion, auditors look at data classification, access restriction and reviews, encryption at rest and in transit, retention and secure disposal, and controls over third-party disclosure. In a SOC 2 Type 2 audit, they sample real instances across the audit period and ask for evidence that each control was followed.

Read the full guide here:
https://accorppartners.com/blogs/soc-2/soc-2-confidentiality-criteria-what-counts-as-confidential-data-and-what-doesnt

Company Incorporation in India – A Simple Guide for Founders

Accorp Partners — Mon, 18 May 2026 11:02:54 +0000

Company incorporation in India is the legal process of registering a business as a recognised entity. It allows founders to operate their business in a structured and compliant manner under the applicable legal framework.

The process usually begins with selecting the right type of business structure based on ownership, control, and long-term goals. This decision plays an important role in how the company will function, how decisions will be made, and how the business will grow in the future.

Once the structure is decided, the incorporation process involves completing the necessary documentation and legal formalities required to officially register the company. After successful incorporation, the business becomes a separate legal entity capable of operating in its own name.

Proper incorporation also helps in building credibility, maintaining transparency, and ensuring that the business follows the required regulatory framework from the beginning.

For a structured breakdown of company incorporation in India:
Accorp Partners – https://accorppartners.com/services/incorporation/india-incorporation