Understanding Hong Kong's New Anti-Money Laundering Requirements

Hong Kong's anti-money laundering (AML) framework has been substantially reinforced, and the obligations now extend far beyond banks. If you operate a company, act as a corporate service provider, or run a designated non-financial business (DNFBP), you are likely within the scope of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (AMLO) and its associated guidelines.

The latest amendments, which came into effect through the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022, introduced a new licensing regime for trust or company service providers (TCSPs) and expanded the definition of "virtual asset" services. The Companies Registry (CR) and the Customs and Excise Department (C&ED) are the primary supervisors for TCSPs and DNFBPs respectively, and they expect full compliance with the updated Guideline on Compliance of Anti-Money Laundering and Counter-Financing of Terrorism.

This post explains the practical steps your business must take to meet these requirements, with a focus on customer due diligence, record-keeping, and the reporting of suspicious transactions.

The Scope: Who Is Now a "Relevant Entity"?

The AMLO applies to a defined list of "relevant entities," and the 2022 amendments broadened this list. You are subject to the full AML regime if you are a financial institution, a DNFBP (such as a lawyer, accountant, real estate agent, or precious metals dealer), or a TCSP.

The most significant change for many business owners is the mandatory licensing of TCSPs. Since 1 March 2023, no person may carry on a business of providing trust or company services in Hong Kong without a licence from the Companies Registry. This applies to any entity that, for a fee, provides registered office services, acts as a nominee shareholder or director, or forms companies.

The CR's Guideline on Compliance of Anti-Money Laundering and Counter-Financing of Terrorism for TCSPs states explicitly:

"A TCSP should adopt a risk-based approach to the prevention of money laundering and terrorist financing. This means that the TCSP should identify, assess and understand the money laundering and terrorist financing risks to which it is exposed, and take appropriate measures to mitigate those risks."

If you are a company secretary or a corporate service provider, you must hold a valid TCSP licence. Operating without one is a criminal offence, punishable by a fine and imprisonment. If you are a business owner who simply uses a corporate service provider, you should verify that your provider holds a valid licence, as your own compliance obligations may depend on theirs.

Customer Due Diligence: The Non-Negotiable First Step

Customer due diligence (CDD) is the cornerstone of the AML regime, and the AMLO sets out mandatory identification and verification steps that must be completed before you establish a business relationship or carry out a transaction.

You must identify and verify the identity of your customer using reliable, independent source documents, data, or information. For an individual, this means obtaining a valid passport or Hong Kong identity card. For a company, you must obtain its certificate of incorporation, business registration certificate, and the memorandum and articles of association. You must also identify the beneficial owner — any individual who ultimately owns or controls more than 25% of the shares or voting rights, or who otherwise exercises control over the company.

The verification must be completed before the business relationship is established. The AMLO does not permit you to "start work" and verify later, except in limited, low-risk circumstances. If you cannot complete CDD, you must not establish the relationship, and you must consider whether to make a suspicious transaction report (STR) to the Joint Financial Intelligence Unit (JFIU).

For higher-risk customers, such as politically exposed persons (PEPs) or customers from jurisdictions with weak AML controls, you must apply enhanced due diligence (EDD). This includes obtaining additional information on the source of funds and source of wealth, and obtaining senior management approval before establishing the relationship.

Ongoing Monitoring and Record-Keeping: Beyond the Onboarding Stage

AML compliance is not a one-off exercise. The AMLO requires you to conduct ongoing due diligence on your business relationship, which means scrutinising transactions to ensure they are consistent with your knowledge of the customer and their business and risk profile.

You must keep the customer's identification documents and transaction records up to date. If you become aware that a customer's information is no longer accurate, you must take steps to re-verify it. For example, if a corporate customer changes its directors or shareholders, you should obtain updated registers and confirm the beneficial ownership structure.

Record-keeping obligations are strict. You must retain all CDD records for at least five years after the end of the business relationship, and all transaction records for at least five years after the transaction is completed. The records must be sufficient to reconstruct individual transactions and to provide evidence of the customer's identity.

The CR's guideline is clear on this point:

"Records should be kept in a form that enables the TCSP to comply swiftly with any information requests made by the relevant authorities, and to provide a complete picture of the TCSP's business relationship with its customer."

Failure to keep proper records is a criminal offence. In practice, this means you should maintain a central, organised file for each client, containing the CDD documents, transaction records, and any risk assessments or EDD notes.

Suspicious Transaction Reporting: Your Duty to File

The most serious obligation under the AMLO is the duty to report suspicious transactions. If you know or suspect that property is proceeds of crime, or that it is linked to terrorist financing, you must make a disclosure to the JFIU as soon as reasonably practicable.

The threshold for suspicion is lower than you might think. You do not need proof; a reasonable suspicion based on the facts and circumstances is sufficient. Indicators include unusual transaction patterns, a customer who is evasive about the source of funds, or a transaction that has no apparent economic or lawful purpose.

The reporting obligation applies regardless of whether the transaction was completed. If you form a suspicion during the CDD process and decide not to proceed with the relationship, you should still consider making a report. The AMLO provides a "safe harbour" for disclosures made in good faith, protecting you from liability for breach of confidentiality.

It is a criminal offence to "tip off" a customer that a report has been made. You must not disclose to the customer, or to any third party, that a suspicious transaction report has been filed or that an investigation is underway.

Practical Steps for Compliance: A Checklist for Your Business

To operationalise these requirements, you should implement a structured AML programme. The AMLO does not prescribe a one-size-fits-all approach, but the regulators expect a risk-based system that is proportionate to the size and nature of your business.

First, conduct a formal risk assessment of your business. Identify the types of customers you serve, the jurisdictions you deal with, and the products or services you offer. Document the risks and the measures you will take to mitigate them.

Second, appoint a compliance officer and a money laundering reporting officer (MLRO). The MLRO is responsible for receiving internal reports of suspicious activity and deciding whether to file an STR with the JFIU. In a small company, this may be the same person, but the roles should be clearly defined.

Third, train your staff. The AMLO requires that you take "all reasonable measures" to ensure your employees are aware of the law and the procedures in place. Training should cover the identification of suspicious activity, the internal reporting process, and the penalties for non-compliance.

Fourth, conduct independent audits of your AML systems. The frequency and scope of the audit should be based on your risk assessment, but a periodic review is essential to ensure your controls remain effective.

Penalties and Enforcement: The Cost of Non-Compliance

The penalties for AML breaches are severe, and enforcement has increased in recent years. The AMLO provides for both criminal and regulatory sanctions.

Criminal penalties for failing to conduct CDD, keep records, or report suspicious transactions can include a fine of up to HK$1,000,000 and imprisonment for up to seven years for individuals. For corporations, the fines are higher, and directors and officers can be held personally liable if the offence was committed with their consent or connivance.

The Companies Registry also has disciplinary powers over TCSPs. It can suspend or revoke a licence, and it can impose disciplinary fines. In 2024, the CR revoked the licences of several TCSPs for serious breaches, including failure to conduct adequate CDD and failure to maintain proper records.

The message is clear: AML compliance is not a box-ticking exercise. The regulators are actively inspecting, and they are willing to take enforcement action.

The Role of HSIC Codes in Your AML Risk Assessment

When conducting your risk assessment, you should consider the nature of your business activities. The Hong Kong Standard Industrial Classification (HSIC) Version 2.0, maintained by the Census and Statistics Department, provides a framework for classifying business activities, and it is increasingly used by regulators and financial institutions to assess risk.

For example, if your company is classified under HSIC 6619 — "Other activities auxiliary to financial service activities" or HSIC 6910 — "Legal activities", you may be subject to higher expectations from your bank or from regulators. Conversely, a low-risk trading company under HSIC 4610 — "Wholesale on a fee or contract basis" may face less scrutiny.

Using the correct HSIC code is not just a statistical matter; it affects how your business is perceived in the AML context. An inaccurate or misleading classification can raise red flags with your bank or with the authorities. You should verify your company's HSIC code and ensure it accurately reflects your principal business activity. You can check your classification using the HSIC Code Finder at /hsic-finder.

Conclusion: Act Now, Not Later

The AML regime in Hong Kong is comprehensive, and the obligations apply to a wide range of businesses. The key takeaway is to take a proactive, documented approach. Conduct your risk assessment, implement your CDD procedures, train your staff, and keep your records in order.

If you are a TCSP, ensure your licence is valid and your systems meet the CR's expectations. If you are a business owner, verify that your service providers are compliant and that your own internal procedures are adequate.

The cost of compliance is modest compared to the cost of enforcement. A fine, a licence revocation, or a criminal conviction can destroy a business. Start your compliance review today, and if you are uncertain about any aspect of the AMLO, seek professional advice from a qualified lawyer or an accredited AML consultant.

Q: Do I need a TCSP licence if I provide company secretarial services as a side service to my accounting practice? A: Yes. If you provide trust or company services — including acting as a company secretary, providing a registered office, or forming companies — for a fee, you must hold a TCSP licence from the Companies Registry, regardless of whether it is your primary business. The only exemption is for licensed professionals (such as lawyers and accountants) who provide these services in the course of their professional practice, but they must still comply with the AMLO's CDD and record-keeping obligations. Q: What is the minimum record-keeping period under the AMLO? A: You must keep customer due diligence records for at least five years after the end of the business relationship, and transaction records for at least five years after the transaction is completed. The records must be sufficient to reconstruct the transaction and to identify the customer. Q: What should I do if I suspect a transaction is suspicious but I am not sure? A: You should make an internal report to your Money Laundering Reporting Officer (MLRO) immediately. The MLRO will assess the information and decide whether to file a suspicious transaction report with the Joint Financial Intelligence Unit. The threshold for suspicion is low — you do not need proof, only reasonable grounds to suspect. It is better to report and be protected by the safe harbour than to remain silent and risk prosecution.