If this were to become a regular occurrence, then the adoption of the IBAC's standards and auditing under IS-BAO guidelines would be advisable to demonstrate commitment to best practice. Under some regulatory authorities this is about to be mandated, Bermuda is one. The operation will require an Ops Manual, which will include FTL requirements.
So far private operations are not required to comply with the IS-BAO. This could be
one of the alternatives in the future when private operations of high performance aircraft will require a safety management system, which is included in the IS-BAO.
It's difficult for the Bermuda CAA to achieve a satisfactory oversight of the VP-B registered fleet and one of the solution they found is to suggest adopting the IS-BAO, which would spare them to audit foreign operators in order to comply with the ICAO SMS requirements. The deadline for VP-B operators to either have an approved SMS or an IS-BAO registration was set to the 31st of october 2009. I doubt this is the case. In the Middle East there's only one IS-BAO operator, two implementation consultants and one auditor...for how many VP-B aircraft in the region?
In the particular case of the initial question the point was about legally conducting such flights without an AOC. It is legal since the point is to fly the owner of the aircraft, meaning private operations as long as other passengers are free guests of this owner. So far there is no need for an operation manual or an IS-BAO registration. As I said the only legal issue would be to have a proper employment contract with the owner.