Hong Kong's Beneficial Ownership Rules: What Has Changed?

Hong Kong's beneficial ownership rules have not been overhauled in a single dramatic reform, but they have been refined through a series of targeted amendments, enforcement actions, and updated guidance from the Companies Registry (CR) since the regime was first introduced in 2018. The core obligation remains: every Hong Kong company must identify and record its "significant controllers" in a Register of Significant Controllers (RSC), and this register must be available for inspection by law enforcement upon request.

The most consequential change in recent years is not a new law, but a shift in enforcement posture. The CR and the Hong Kong Police have actively prosecuted companies for failing to maintain or update their RSC, signalling that the regime is no longer a paper exercise. As of the latest available CR Annual Report, the Registry conducted thousands of inspections and referred numerous cases for prosecution. If you have not reviewed your RSC since incorporation, you are exposed to real criminal liability.

The Legal Foundation: What the Law Actually Requires

The beneficial ownership regime is grounded in Part 5A of the Companies Ordinance (Cap. 622), which was added by the Companies (Amendment) Ordinance 2018. This Part requires every Hong Kong company (other than a listed company) to take "reasonable steps" to identify individuals who hold significant control over the company. A "significant controller" is defined as an individual who:

• Holds, directly or indirectly, more than 25% of the company's shares;
• Holds, directly or indirectly, more than 25% of the company's voting rights;
• Holds the right to appoint or remove a majority of the board of directors; or
• Otherwise exercises significant influence or control over the company.

The CR's "Guidance on the Register of Significant Controllers" (GN 7) provides the authoritative interpretation of these provisions. It is essential to read this guidance alongside the legislation, because the CR has clarified several practical points that are not immediately obvious from the statute text.

"A company must take reasonable steps to identify its significant controllers. The steps include sending a notice to any person whom the company knows or has reasonable cause to believe is a significant controller, or knows or has reasonable cause to believe may know the identity of a significant controller." — Companies Registry, Guidance on the Register of Significant Controllers (GN 7), paragraph 2.1

What Has Actually Changed Since 2018?

The headline change is the introduction of the RSC itself, but several important refinements have followed. First, the CR has updated its guidance notes multiple times, most notably to clarify the treatment of nominee shareholders and the interaction between the RSC and the company's own records. Second, the CR has integrated the RSC requirement into its electronic filing and inspection systems, making it easier for authorised officers to access registers during investigations.

Third, and most significantly, there has been a marked increase in enforcement. In 2023 and 2024, the CR reported that it had conducted over 4,000 inspections of company records and referred more than 100 companies for prosecution for non-compliance with the RSC provisions. Penalties for non-compliance are not trivial: a company and every responsible officer (typically the directors and the company secretary) commit an offence if the company fails to maintain an RSC, and each is liable on conviction to a fine of up to HK$25,000, with a further daily fine of HK$700 for continuing contravention.

Ongoing Compliance Execution

Ongoing statutory obligations are handled seamlessly through Captime's dedicated Hong Kong company secretary service, providing a licensed local representative and automated annual return management.

Who Must Be Recorded: The "Significant Controller" Test

The test for who must be recorded is broader than many business owners assume. It is not limited to shareholders holding more than 25% of the issued shares. The definition also captures individuals with the right to appoint or remove a majority of directors, and those who exercise "significant influence or control" over the company. This latter category is deliberately wide and can include founders who have stepped back from day-to-day management but retain veto rights over major decisions, or individuals who control the company through a chain of entities.

The CR's guidance is explicit that the analysis must be conducted at the level of the individual, not the entity. If a corporate shareholder holds 60% of a company, the company must look through that corporate shareholder to identify the individual who ultimately controls it. This "look-through" requirement is a common source of non-compliance, particularly where there are multi-layered offshore holding structures.

Practical Steps: How to Comply With the Current Regime

Compliance is not a one-off exercise. The law requires the RSC to be kept up to date, and the company must take reasonable steps to identify any new significant controllers within a reasonable time of their becoming significant. In practice, this means reviewing your register at least annually, and whenever there is a change in shareholding, board composition, or control arrangements.

The register itself must contain specific information for each significant controller, including their name, correspondence address, identity document number, the date on which they became a significant controller, and the nature of their control. The company must also record the steps it took to identify its significant controllers, which is a critical evidential point if the CR ever challenges the adequacy of your efforts.

Your company secretary should be the first point of contact for maintaining the RSC. Under the Companies Ordinance, the company secretary has a statutory duty to ensure the company complies with its obligations under Part 5A. If your secretary is not proactively reviewing your RSC, you should ask why.

Enforcement and Penalties: The Real Risk

The penalties for non-compliance are set out in section 653P of the Companies Ordinance (Cap. 622). Every responsible officer of the company commits an offence if the company fails to comply, and the officers are personally liable. This is a critical point: it is not just the company that faces a fine; individual directors and the company secretary can be prosecuted personally.

The CR has also made clear that it will not accept ignorance as a defence. The obligation to take "reasonable steps" is an active one. If you have not sent a notice to a suspected significant controller, or if you have not reviewed your register in the past year, you are likely not taking reasonable steps.

"A company which fails to comply with any of the requirements under Part 5A of the Companies Ordinance commits an offence, and every responsible officer of the company also commits an offence." — Companies Registry, Guidance on the Register of Significant Controllers (GN 7), paragraph 7.1

Interaction With Other Regimes: AML and the CR

The RSC regime sits alongside Hong Kong's broader anti-money laundering (AML) framework. The Companies and Clerks (Amendment) Ordinance 2018, which introduced Part 5A, was explicitly designed to align Hong Kong with the Financial Action Task Force (FATF) recommendations on beneficial ownership transparency. This means the CR's expectations are informed by international standards, and the regime is subject to periodic mutual evaluation by FATF.

For companies that are also subject to the AML regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) — for example, if they are licensed by the SFC or registered with the HKMA — the RSC is not a substitute for customer due diligence. However, the RSC is a useful source of information for your own compliance team, and it is increasingly referenced in transaction due diligence by banks and counterparties.

What Has NOT Changed: The Core Obligations Remain Stable

It is worth emphasising that the fundamental structure of the regime has not changed since 2018. The definition of significant controller, the requirement to maintain a register, and the inspection rights of law enforcement are all unchanged. What has changed is the level of scrutiny and the willingness of the authorities to prosecute. The CR's annual reports show a steady increase in inspections and prosecutions, and there is no indication that this trend will reverse.

There have also been no changes to the requirement that the RSC be kept at the company's registered office or another prescribed location in Hong Kong, and that it be open for inspection by law enforcement officers without a warrant. This is a significant difference from the regime in some other jurisdictions, where registers are publicly accessible. In Hong Kong, the register is not public; only authorised officers of the CR, the Police, the ICAC, and certain other authorities may inspect it.

Practical Takeaway: Review Your Register Today

The single most important action you can take is to review your Register of Significant Controllers now, not when the CR comes knocking. Check that it is complete, that it identifies all significant controllers correctly, and that it records the steps you took to identify them. If you are unsure whether your register is compliant, ask your company secretary for a copy and a written confirmation of compliance.

If you are forming a new company, ensure that the RSC is set up correctly at incorporation and that your incorporation service provider includes this as a standard part of the process. The cost of getting it wrong is a fine and potential personal liability for directors; the cost of getting it right is a few hours of administrative work.

For a full breakdown of the HSIC codes relevant to your business — which you will need for your Business Registration Certificate and for statistical reporting to the Census and Statistics Department — use our HSIC Code Finder at /hsic-finder. It will help you identify the correct code under HSIC Version 2.0, ensuring your company records are accurate and consistent with your RSC filings.