Understanding Hong Kong's Anti-Money Laundering Regulations for Businesses

Hong Kong's AML regime applies to specific "designated non-financial businesses and professions" (DNFBPs) and financial institutions. If your business falls within these categories, you must comply with the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (AMLO) or face criminal penalties including fines up to HKD 1,000,000 and imprisonment for up to 7 years.

Eligibility: Which Businesses Are Regulated Under Hong Kong's AML Framework?

The AMLO applies to two categories of entities: financial institutions and DNFBPs. Financial institutions include banks, licensed corporations, authorized insurers, and money service operators. DNFBPs include:

• Lawyers and notaries (regulated by the Law Society of Hong Kong)
• Accountants and certified public accountants (regulated by the Hong Kong Institute of Certified Public Accountants)
• Real estate agents and estate agents (regulated by the Estate Agents Authority)
• Trust or company service providers (TCSPs) — must be licensed under the AMLO
• Dealers in precious metals and stones (DPMS) — must be registered with the Commissioner of Customs and Excise

Under section 5 of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), "a person must not carry on a business of providing trust or company services in Hong Kong unless the person is licensed by the Registrar."

If your business does not fall into these categories (e.g., a general trading company, restaurant, or consultancy), you are not directly regulated under the AMLO. However, all businesses must still comply with the underlying criminal offences of money laundering under the Organized and Serious Crimes Ordinance (Cap. 455) and the Drug Trafficking (Recovery of Proceeds) Ordinance (Cap. 405).

Ongoing Compliance Execution

Ongoing statutory obligations are handled seamlessly through Captime's dedicated Hong Kong company secretary service, providing a licensed local representative and automated annual return management.

Timelines: When Must You Register or Comply?

The compliance timeline depends on your business type:

For TCSPs

• Application deadline: You must apply for a TCSP licence before commencing business. The Companies Registry processes applications within 8–12 weeks.
• Renewal: Licences are valid for 1 year and must be renewed annually.
• Transitional period: Businesses operating before 1 March 2018 had a 6-month grace period to apply.

For DPMS

• Registration deadline: You must register with the Customs and Excise Department before starting business. Registration is valid for 3 years.
• Cash transaction reporting: Any single cash transaction of HKD 120,000 or more must be reported within 15 business days.

For Financial Institutions

• Ongoing obligations: Customer due diligence (CDD) must be conducted before establishing a business relationship. Enhanced due diligence (EDD) must be completed within 30 days for high-risk customers.

Cost Metrics: What Are the Fees and Penalties?

Registration and Licensing Fees

Penalties for Non-Compliance

Suitability: Who Needs Full AML Compliance vs. Who Does Not

You MUST comply with the AMLO if:

• You operate a trust or company service provider (e.g., corporate secretarial services, nominee services, trust administration)
• You deal in precious metals or stones with cash transactions exceeding HKD 120,000
• You are a lawyer, accountant, or real estate agent handling client funds or property transactions
• You operate a money service business (remittance, currency exchange)

You are NOT directly regulated under the AMLO if:

• You run a general trading company, restaurant, retail shop, or consultancy
• Your business does not handle client funds or provide financial services
• Your business does not involve high-value goods or professional services covered by the AMLO

However, all businesses must still:

• Report suspicious transactions to the Joint Financial Intelligence Unit (JFIU)
• Maintain records of transactions for at least 6 years under the Companies Ordinance (Cap. 622)
• Ensure they do not knowingly facilitate money laundering

Key Compliance Obligations Under the AMLO

1. Customer Due Diligence (CDD)

You must identify and verify your customers before providing services. This includes:

• Obtaining the customer's full name, date of birth, and residential address
• Verifying identity using a valid passport or Hong Kong identity card
• For corporate customers: obtaining the certificate of incorporation, business registration certificate, and register of directors and shareholders
• Understanding the nature of the customer's business and source of funds

2. Enhanced Due Diligence (EDD)

For high-risk customers (e.g., politically exposed persons, customers from high-risk jurisdictions), you must:

• Obtain senior management approval before establishing the relationship
• Take additional measures to verify the source of funds and wealth
• Conduct more frequent monitoring of the business relationship

3. Record-Keeping

Under section 20 of the AMLO, "a person must keep records of all transactions and customer identification data for a period of not less than 6 years after the transaction is completed or the business relationship ends."

Records must include:

• Copies of identification documents
• Transaction records (amount, date, parties involved)
• Correspondence related to the business relationship
• Risk assessment documentation

4. Suspicious Transaction Reporting (STR)

If you have reasonable grounds to suspect that property is proceeds of crime or linked to terrorist financing, you must file an STR with the JFIU. Failure to report is a criminal offence.

Q: Do I need an AML compliance officer for my small business? A: If you are a regulated entity under the AMLO (e.g., TCSP, DPMS, money service operator), you must appoint a compliance officer and a money laundering reporting officer. For non-regulated businesses, no formal appointment is required, but you should designate a point of contact for AML matters.

Q: What happens if I unknowingly facilitate money laundering? A: Ignorance is not a defence. Under the Organized and Serious Crimes Ordinance (Cap. 455), you can be convicted if you had reasonable grounds to suspect the property was proceeds of crime. This is why proper CDD and record-keeping are essential.

Q: How often must I update my AML policies? A: The AMLO requires that policies and procedures be reviewed at least annually. The Companies Registry and Customs and Excise Department may conduct inspections to verify compliance.

Q: Can I outsource AML compliance? A: Yes, you can outsource CDD and record-keeping to a third-party service provider, but you remain ultimately responsible for compliance. The service provider must be licensed (if required) and must comply with the AMLO.

Practical Steps to Achieve Compliance

1. Determine your status: Check if your business falls under the AMLO's definition of a financial institution or DNFBP. Use the HSIC code classification to confirm your business type.

2. Register or obtain a licence: If you are a TCSP, apply to the Companies Registry. If you are a DPMS, register with the Customs and Excise Department. If you are a money service operator, apply for a licence from the Customs and Excise Department.

3. Appoint key personnel: Designate a compliance officer, a money laundering reporting officer, and a deputy money laundering reporting officer (for regulated entities).

4. Develop written policies: Create AML/CTF policies covering CDD, EDD, record-keeping, and STR procedures. These must be approved by senior management.

5. Train your staff: Conduct AML training at least annually. Training must cover how to identify suspicious transactions and how to report them internally.

6. Implement monitoring systems: Use transaction monitoring software or manual checks to identify unusual patterns. For small businesses, a simple spreadsheet tracking transactions over HKD 120,000 may suffice.

7. Conduct a risk assessment: Assess your business's exposure to money laundering risk based on customer types, geographic regions, and product offerings. Document this assessment.

Common Pitfalls and How to Avoid Them

• Failing to verify beneficial owners: For corporate customers, you must identify any individual who owns or controls more than 25% of the company. This is often overlooked.
• Incomplete record-keeping: Many businesses keep records for only 3 years instead of the required 6 years. Set a calendar reminder for record retention.
• Not updating CDD: If a customer's circumstances change (e.g., change of address or directorship), you must update your records within 30 days.
• Ignoring cash transaction thresholds: Any single cash transaction of HKD 120,000 or more must be reported. This applies to DPMS and money service operators.

Conclusion

Hong Kong's AML regime is robust and enforced. If your business falls within the regulated categories, compliance is not optional — it is a legal requirement with severe penalties for non-compliance. For non-regulated businesses, while the full AMLO framework does not apply, you must still comply with the underlying criminal laws against money laundering and maintain proper transaction records.

-> Use the HSIC Code Finder at /hsic-finder to look up your specific code and confirm whether your business is regulated under the AMLO.