A German resident who owns a Cayman company can pass every Cayman substance test there is and still owe full German tax on the Cayman income. Germany's CFC rules don't care what Cayman thinks counts as substance.

That's the trap the brass-plate era left behind. A mailbox company in a zero-tax jurisdiction, no employees, no office, no real activity, worked for decades. A decade of BEPS actions, EU Code of Conduct pressure, tightened economic substance legislation and now Pillar Two has closed most of that road for anyone with meaningful revenue.

Key Numbers to Know (2026)

• UAE Free Zone substance requirements: local presence, qualifying activity, adequate employees

• BVI Economic Substance Act: requires "adequate" employees, expenditure and physical presence for relevant activities

• Cayman Economic Substance Law: broadly similar to BVI

• UAE 9% corporate tax on non-qualifying income: in effect since 2023

• EU Blacklist (Annex I): rotating list of "non-cooperative" jurisdictions

• EU Greylist (Annex II): jurisdictions committed to reform

• CFC rules in force: most EU countries, the US (GILTI), UK, Australia, Canada

• OECD Pillar Two 15% global minimum tax: phasing in for multinationals with €750M+ revenue

What Substance Actually Requires, By Jurisdiction

"Adequate employees" and "adequate expenditure" are the phrases that show up in every substance statute and mean almost nothing on their own. In practice, regulators are looking for something closer to one full-time local hire and a real lease — not a coworking mailbox and a part-time contractor on paper.

• UAE Free Zone (for 0% rather than 9% tax)
  What qualifies as substance: Physical office, adequate number of qualified employees in the UAE, qualifying activities from a defined list, adequate operating expenditure locally, core income-generating activity performed in the UAE

• BVI / Cayman (for "relevant activities" — holding, financing, IP, distribution)
  What qualifies as substance: Adequate operating expenditure in the jurisdiction, physical office presence, qualified employees, core income-generating activity performed locally

• Panama
  What qualifies as substance: Genuine operating presence and activity, not just registration — increasingly scrutinised as brass-plate structures draw attention

None of this is a box-ticking exercise you can outsource entirely to a formation agent. The activity has to be real, because the next layer of attack doesn't care whether you cleared the local test.

The CFC Attack Vector

Even a structure that clears every local substance requirement can still get pulled back home. Your own country's Controlled Foreign Corporation rules can attribute the offshore company's income to you personally, regardless of what the offshore jurisdiction itself requires — which is exactly what happens to the German-Cayman owner above.

CFC rules generally target:

• Passive income — interest, dividends, royalties, capital gains

• Income from related-party transactions

• Income earned by companies with no genuine business activity

Active operating income from a real business is generally less exposed, but "generally less exposed" is not "exempt." Substance still matters even when CFC risk is lower.

What Actually Works for Online Business Owners in 2026

Real substance in the low-tax jurisdiction, meaning you actually move there, establish a real office, and hire real employees, still works. So does matching your personal residency to your structure — if you're the sole owner and operator, live where the company operates.

What doesn't work is the artificial split: personal residency in a high-tax country paired with a company in a zero-tax one. That combination is usually the worst of both worlds today, not the best. Jurisdictions that can still work cleanly include the UAE with genuine substance, Puerto Rico's Act 60 for an actual relocation, Panama with real substance, and some Cyprus and Malta structures — all conditional on the substance actually being there.

What Doesn't Work Anymore

• Brass-plate BVI or Cayman companies for active online business

• UK non-doms running income through offshore companies, post-2025 reform

• German, French or Italian residents "owning" a UAE company they never visit

• Any structure that requires believing something untrue about where you actually work

Testing Your Structure Before Someone Else Does

Whether your current structure would survive a substance challenge is worth finding out before a tax authority asks the question for you. On a scoping call, FTR pressure-tests your existing setup against current CFC and substance rules for your specific jurisdictions — bring your entity documents and a rough sense of where your time is actually spent, and you'll leave knowing exactly where the gaps are. Book one here.

General information only, not a substance opinion on your structure. Rules differ by jurisdiction and change often — confirm your position with a qualified adviser before relying on any of this.