Why is PayPal blocking my account according to U.S. tax law, if I&#39;ve a UK account only? I've opened PayPal account for my business and in My Profile I've clearly selected the UK address. My phone is UK, my bank accounts are UK and the balance is shown in GBP. So this is very clear to PayPal that my account is UK based. However I've received the following e-mail which says: Your account access will remain limited until you add more information about your business. Why do I need to add this information? The Foreign Account Tax Compliance Act (FATCA), a U.S. tax law, requires financial institutions like PayPal to collect additional information from customers when a new business account is opened. You need to add this information even if your business or your customers are not United States taxpayers or located in the United States. We collect this information for regulatory and compliance purposes. By adding &quot;more information&quot; they mean to download U.S. form W-8BEN-E, fill it in completely and upload or fax it to PayPal, however I don't want to fill some U.S. form, simply because I'm not from the U.S and I don't want to share my confidential personal details with the foreign country. To clarify, my business doesn't have any clients from the US and my business is registered in the UK. And as an owner of the business I've never been to the U.S. So my question is, why am I affected by a U.S. tax law? Do I really need to comply with U.S. tax law (having the business in the UK)? The above quote from the e-mail says that I need to add this information even though my business isn't located in the U.S. However on the FATCA FAQ page (requires log-in) it says: For accounts held outside the United States that belong to non-US persons, financial institutions such as PayPal must gather information from account holders providing that they are not US persons. For me this is contradictory to the previous quote (because here they ask me to prove I'm not a U.S. person) so I'm confused as to what I should do. In other words, can my UK business somehow ignore FATCA requirements or not? Currently I'm forced to comply to the country compliance act tax (by filling W-8BEN-E) where I've nothing to do with it, which doesn't make any sense.
The reason that you are being asked to comply with a US law is because PayPal, a US company, is required to comply with US laws. If you do not comply, it is likely that they will be non-compliant and subject to sanctions. For more background, FATCA reporting is used to identify businesses that a company does business with. In this scenario PayPal does business with you, 'Kenorb Inc', and so must prove to the regulatory agencies that you are not a US based company, hence the need for the W-8BENE. In a similar way - people from other countries cannot simply ignore UK law when dealing with your business. As for your quotes - they are not contradictory.
Yes it is kind of possible what country would the legal action need to originate from? Would one file in the US and note the foreign defendant or would one file, as a foreigner, in the home country of the defendant? You can go either way. It is not obtaining the judgment that is the biggest trouble here, but enforcing it. You will need: A UK mailing address. Services like ScanMyPost will suffice. Some money to pay the court fees. Time, tenacity and patience to follow through the procedure and fill all necessary forms. Be lucky in that the defendant actually has something to pay the debt with. There are two stages: Obtain a court judgment in your favour. Unless the defendant pays you, enforce the judgment. Obtaining court judgment in the UK In the UK, the "small claims court" functions are executed by HM Courts &amp; Tribunals Service. The specific service is called "Claim for money" which can be filed online via their old or new system. So, basically, you file the online form, pay the fee by credit card and wait for defendant's response. If they do not respond, you ask the court to make a judgment (in my case it took 10 weeks from filing claim to getting judgment). If the defendant responds and defends themselves, expect much longer wait and uncertain outcome. Enforcement So, you and the defendant have both received court judgment saying that they must pay you. But they are not paying. There is a range of options you can choose from: County Court Warrant of Control (claims from £50 to £5,000). Court bailiff will go to the defendant's address and try to seize goods that can be easily sold. High Court Writ of Control (claims from £600). Attachment of earnings order (you ask the court to order the defendant's employer to deduct his earnings in your favour). Third-party debt order (a.k.a. "Garnishee Order") — if you know the defendant's bank account details. Read about potential pitfalls here. Charging order: you will only get paid if the defendant sells their land. Bankrupt the defendant (big court fees!). Alternatively, you could always hire a UK lawyer but then you would probably not need this answer.
First of all, if your Delaware LLC earns money, you will pay tax in America on that money. America still taxes "foreigners" on American income, just not on"global" income. That is, unless the U.S. has a tax reciprocity treaty with your home country, Malaysia. I don't know about Malaysian law, but I am writing as an American about American law regarding the Seychelles (and I am not a lawyer). The following is only as an "example." If you set up an LLC in the Seychelles, you could, in theory, avoid American tax by accruing income there. In practice, if you did nothing but "banking" in the Seychelles, America would look at your lack of "value added" there, and could tax you on Seychelles income as if your corporation was American. The way to make such a claim stick (typically in a place like Ireland), is to set up a manufacturing or operating facility (e.g. call center) there so that you were shipping goods or services from your offshore operation. Then you'd have a strong claim in America that your operation actually earned most of its income abroad, and the U.S. company was just a holding company.
If you have an agreement with a company that specifies &quot;you agree to give me something of value, in case I give you something of value&quot;, you have a contract. In order for there to be a contract, there has to be actual acceptance of the offer. You can put out on a web page some contract stating those terms, and if you get positive acceptance of the contract (hence the standard click-through technology), then as long as you have done the thing promised, you can bill them for doing the thing promised. It's not clear what thing of value you are offering on the web page, since it's not &quot;doing actual work&quot;. Them sending you an email isn't you doing something. One thing you could do is block all incoming emails, and for money you agree to unblock emails from registered subscribers. Just announcing that you will bill anyone for emailing you does not create a contract, because the emailer need not have even seen your announcement. This is why e-contracts need a click-through button. It's legal to request money, but there is no legal obligation for them to comply. That will be $10, please.
When the data controller is from the EU/EEA/UK, the GDPR applies. Any website inherently processes personal data such as IP addresses. Thus, when transferring personal data into the US (e.g. because the website is hosted in the US), it is necessary to comply with the GDPR's Chapter V which covers international transfers. The US hoster would also have to be bound as a data processor per Art 28. There are multiple legal bases for international transfers into the US. There used to be an “adequacy decision” that allowed transfers without further conditions in the form of the EU–US Privacy Shield, but it was found invalid in the 2020 Schrems II ruling due to concerns about US mass surveillance. The next alternative are “appropriate safeguards” to protect the transfer, which generally requires that the data exporter and data importer (here: you and the hoster) sign standard contractual clauses (SCCs). But in the wake of Schrems II, it is clear that SCCs alone are not sufficient, and would generally require supplemental measures to protect the personal data. The concern is that an US company would not be legally able to comply with the SCCs they've signed. Art 49 has fallback legal bases for occasional transfers such as the data subject's explicit consent, which are not useful here. What most people do is pretend like SCCs are sufficient and hope that regulators turn a blind eye, at least until another adequacy decision is negotiated. However, guidance by regulators including EDPB recommendation 01/2020 explains that it's the responsibility of data controllers to analyze their specific transfers, adopt supplemental measures if necessary, or stop transfers if such measures are impossible. To cut the chase short: there are no technical measures that could help in a cloud or SaaS setting, and I would include webhosting in that setting. As a consequence, it's effectively impossible to be GDPR-compliant while relying on services that store or process personal data in the United States. It would therefore be prudent to migrate an US-hosted website to a server located in the EU/EEA or in a country that has an adequacy decision. Your registrar's information seems correct in this regard, though it is admittedly a bit self-serving for a company that offers web hosting itself. On to your specific questions/arguments. Is all of this irrelevant because you are not using an US “cloud” service? No. Don't get distracted by the word “cloud”. The issue is that you are using an US-based service that processes personal data in the clear. Can you avoid disclosing the international transfer because you aren't processing personal data? But you are most likely processing personal data. The GDPR's definition of personal data does not just include identifying information, but any information relating to identifiable persons. Identification includes being able to single out a person. IP addresses are likely (but not necessarily) a kind of personal data. In any case, your use of Google Analytics sets tracking cookies that definitely allow identification of visitors. Since you are performing an international transfer of personal data, you must inform the data subjects. Is copying a standard privacy policy sufficient? While transparency about processing activities is an important part of GDPR, it is only a part. Other parts include: having a clear purpose and legal basis for processing activities binding services who process personal data on your behalf as data processors per Art 28 (here: in particular hosting and analytics) finding and implementing appropriate security measures having a plan for dealing with data subject requests In any case, the privacy policy must fulfil all points mentioned in Art 13 GDPR. Ideally, it should also cover the information obligations from Art 15. There are guidelines on transparency from the EDPB. If your privacy policy was drafted before 25 May 2018, it likely wasn't updated for GDPR. There is a staff-only private area. Whether or not there is any private area is not relevant for GDPR. GDPR is not about protecting private data in contrast to public data, but about processing of personal data, i.e. data that relates to persons. Also note that the staff members are data subjects as well. The only cookies are “technical cookies”. Very good! The ePrivacy directive is closely related to GDPR and addresses what kind of information you may use from user devices, including cookies or similar technologies like LocalStorage. This directive was implemented in the Italian Data Protection Code. You may only use cookies etc if they are strictly necessary for providing the service explicitly requested by the user (such as storing a language preference on your website), or if the user has given their consent. You are using Google Analytics, but only if the user gives consent. Since Google Analytics is an US-based service, some of the above concerns about international transfers apply. Relying on consent is good, though Art 7 GDPR gives some conditions for consent. In particular, the user must have a real choice. While analytics can probably be used without consent, setting cookies for analytics does require consent. As much as I loathe them, consent management tools can be useful here e.g. because they also help with keeping records of consent. In summary: While you have good data minimization practices, your website likely isn't GDPR-compliant in its current form. You can take some first steps toward better compliance, such as by avoiding unnecessary international transfers and updating the privacy policy to better align with Art 13 GDPR. Fines are unpredictable. Most data controllers are non-compliant in some way (probably including myself). But most data controllers don't end up getting fined. While fines should be “effective” and “dissuasive”, they also have to be proportionate to the infringement. Many data controllers have been able to substantially reduce or completely avoid fines by quickly remediating compliance issues when being contacted by their supervisory authority. I have yet to hear about a fine for data transfers into the US, but of course I have no idea what cases the supervisory authorities are currently investigating.
Are there such restriction for F-1 students who have been in the US for less than 5 years, who are non-resident aliens for tax purposes and are actually not citizens of the US but are citizens of another country? Short Answer For the most part, citizenship and immigration status are legally irrelevant to your eligibility to participate in an ICO (there are isolated exceptions related to international trade sanctions, and there are certain "sensitive" industries that usually wouldn't apply to an ICO). This said, no issuer of coins is required to make the offering available to everyone who is not prohibited by the applicable laws from participating. For example, if someone wants to make an ICO available to anyone but Canadians, that is their prerogative. But, in practice, most private ICOs require investors to be accredited investors, and few students on F-1 visas have the wealth, income or professional qualifications necessary to be accredited investors. Long Answer In an ICO made in the United States, the issuer (i.e. the person creating the coins) and the underwriter (i.e. the professionals retained to handle the ICO for the issuer, which will sometimes be the same person as the issuer) are electing to treat the coins as "securities" for the purposes of U.S. law which means that they can be issued only as a "public offering" upon registration with the SEC under the '33 Act or the '34 Act, or under an exception to those acts. While the statutes enumerate exceptions to the Acts, almost everyone sticks to trying to comply with one of the safe harbor exceptions created by SEC Regulation D. This protects the issuer and underwriter from legal liability for making an unregistered offering of a security that does not fall within an exception to the registration requirement, even though it is not unambiguously clear that cyptocurrency coins are "securities." They do this because the consequence for being wrong on this legal question of first impression are very severe and could lead to civil liability for all losses that coin holders experience, large civil penalties that cannot be discharged in bankruptcy, and criminal convictions. Eligibility to participate in a private offering made pursuant to the Regulation D exceptions to U.S. Securities laws (mostly the '33 Act and '34 Act) governing public offerings of securities that often require someone to be an "accredited investor" does not depend upon the immigration status or citizenship of the investor. A private ICO would ordinarily be made under a Regulation D exception. There are two Regulation D exceptions (one for offerings of less than $1,000,000 in the aggregate by an issuer, and another for intrastate offerings) which do not require you to be an accredited investor and there are other exceptions with allow a small number of non-accredited investors to participate if they are provided a professional advisor to counsel them in evaluating the offer. The most popular Regulation D exceptions for private offerings, however, are limited to accredited investors, which are available without regard to citizenship. A non-citizen could probably not participate in an offering made pursuant to the intrastate exemption, but this exception is quite unpopular for issuers and underwriters because very few offerings qualify under it and the boundaries for qualification are not well defined. I could imagine an ICO being made under this exception but I am not aware of any that actually are be made in that manner. Generally, to be an accredited investor you must be a certain kind of business entity (e.g. a bank), or a member of a certain set of professions (e.g. lawyers and brokers), or have a certain net worth and/or income. To be an accredited investor, a person must demonstrate an annual income of $200,000, or $300,000 for joint income, for the last two years with expectation of earning the same or higher income. An individual must have earned income above the thresholds either alone or with a spouse over the last three years. The income test cannot be satisfied by showing one year of an individual's income and the next two years of joint income with a spouse. The exception to this rule is when a person is married within the period of conducting a test. A person is also considered an accredited investor if he has a net worth exceeding $1 million, either individually or jointly with his spouse. The SEC also considers a person to be an accredited investor if he is a general partner, executive officer, director or a related combination thereof for the issuer of unregistered securities. An entity is an accredited investor if it is a private business development company or an organization with assets exceeding $5 million. An organization cannot be formed with a sole purpose of purchasing specific securities. Also, if an entity consists of equity owners who are accredited investors, the entity itself is an accredited investor. In 2016, the U.S. Congress modified the definition of an accredited investor to include registered brokers and investment advisors. Also, if a person can demonstrate sufficient education or job experience showing his professional knowledge of unregistered securities, he is also considered an accredited investor. In contrast, in the case of a public offering, which must be registered with the SEC under the '33 Act or '34 Act, any adult of any nationality (except as noted below) can participate without being an accredited investor. Still, in general, a U.S. securities law perspective, an investor from the U.K. or France or South Africa is the same as a U.S. citizen, even though the tax treatment of the investment for a non-citizen is very different from the tax treatment of the investment for a U.S. citizen or permanent resident. The primary exception to this general rule is that there are some people in some countries who are prohibited from investing in U.S. securities as a consequence of international trade sanctions. These would include members of the families of certain government officials in Russia, Syria and Venezuela, for example. Usually, a private offering packet provided to potential investors (such as one I wrote a couple of months ago involving international investors as well as U.S. investors) will include a separate form in which potential investors certify to the issuer and underwriter of the offering that they are not prohibited from investing under these laws which are enumerated in the form. Non-citizens who are not resident aliens (i.e. who are not green card holders), are also usually required to make a disclosure related to income tax compliance that is different than the Form W-9 that has to be provided by U.S. citizens and green card holders. There are also certain industries (e.g. equity investments in Colorado legal marijuana dispensaries, or farms in some Great Plains states) in which non-resident non-citizens are simply prohibited from making investments entirely although there are no ICOs of which I am aware that would fit in that category.
united-kingdom To extend on @ohwilleke's answer about US inheritance tax, I can answer the UK side of things. UK inheritance tax does not apply to inheritances from abroad, unless that person was domiciled in the UK or some of their assets were in the UK. If you are not a UK resident for tax purposes (which, from the context of your question is unlikely), then you wouldn't even have to pay tax on the interest you earned from depositing the inheritance. If the deceased were taxed for being domiciled in the UK, and the US taxed your inheritance, you'd actually qualify for tax relief from HMRC based on what you'd already paid the IRS. If you are not domiciled in the UK for tax purposes, and neither was the decedent you would owe precisely zero to HMRC in the UK. More info can be found here: https://www.taxoo.co.uk/uk-resident-receiving-inheritance-from-abroad/
Your terms and conditions must comply with the laws in: Your jurisdiction (California) Your customer's jurisdiction (each of the US states, Canadian provinces and ultimately countries and sub-jurisdictions in Europe) If they do they will generally be enforceable; if they don't then they will not be enforceable and you may be exposing yourself to civil and criminal sanctions. While not immediately relevant to you, Australian Consumer Law has such sanctions to goods sold into Australia from anywhere in the world; I am not familiar with other jurisdictions. With respect to your comment that you will not accept returns or refunds, this would expose you to potential fines in Australia of $220,000 for an individual or $1,100,000 for a corporation - under Australian Consumer Law returns and refunds are a consumer right. I strongly suspect that most of the jurisdictions you are selling into would take a similar position. A general "catch-all" like "to the extent permitted by law" may reduce the risk of being prosecuted but it would not eliminate it entirely. Again, in Australia, the provision is that you must not engage in deceptive and misleading conduct - merely suggesting that you will not give a refund even with the limitation above - may still be deemed "deceptive and misleading" if the court feels that a reasonable consumer might assume that they are not entitled to a refund. You need professional legal advice on this.