Anti-Money Laundering Compliance in Hong Kong: A Guide for Corporates and Financial Institutions

Hong Kong maintains one of the world's most comprehensive anti-money laundering and counter-terrorist financing (AML/CFT) regimes, reflecting its status as a leading international financial centre and a key member of the Financial Action Task Force (FATF). Compliance with AML/CFT obligations is not optional: violations can result in criminal prosecution, substantial fines, regulatory sanctions, and reputational damage. This guide provides a practical overview of the AML/CFT framework for financial institutions, designated non-financial businesses and professions (DNFBPs), and corporates operating in Hong Kong.

The Legal Framework

Hong Kong's AML/CFT regime is built on several key ordinances:

• Drug Trafficking (Recovery of Proceeds) Ordinance (Cap. 405): The original money laundering ordinance targeting drug trafficking proceeds
• Organised and Serious Crimes Ordinance (Cap. 455) (OSCO): Extends money laundering offences to proceeds of all indictable offences, including corruption, fraud, and theft. Section 25 OSCO is the key money laundering offence provision.
• United Nations (Anti-Terrorism Measures) Ordinance (Cap. 575): The principal counter-terrorist financing legislation
• Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (AMLO): The comprehensive framework imposing customer due diligence (CDD) and record-keeping obligations on financial institutions and designated non-financial businesses and professions (DNFBPs)

The Primary Money Laundering Offence

Under Section 25 of OSCO, it is an offence to deal with property knowing or having reasonable grounds to believe it represents the proceeds of an indictable offence. The offence is broad:

• "Dealing" includes receiving, acquiring, disposing of, converting, using, managing, possessing, and transferring
• The mental element is actual knowledge OR "reasonable grounds to believe" — i.e., a person can be convicted even if they did not actually know the property was proceeds of crime, if a reasonable person in their position would have suspected it
• The maximum penalty is 14 years' imprisonment and a fine of HK$5 million

The tipping-off offence under Section 25A OSCO makes it a crime to disclose to any person information likely to prejudice an investigation into suspected money laundering, once a suspicious transaction report (STR) has been filed or where one knows that a disclosure is likely to be made to law enforcement.

Regulated Entities Under AMLO

AMLO imposes specific CDD and record-keeping obligations on two categories of entities:

Financial Institutions (FIs)

AMLO Schedule 2 applies to "financial institutions," which include:

• Authorised institutions (banks and restricted licence banks licensed by the HKMA)
• Licensed corporations (entities licensed by the SFC under the SFO)
• Authorised insurers and approved insurance agents (regulated by the Insurance Authority)
• Money service operators (MSOs — money changers and remittance companies licensed by the Customs and Excise Department)
• Stored value facility licensees (regulated by the HKMA)
• Licensed VASPs (virtual asset service providers regulated by the SFC under the VASP licensing regime)

Designated Non-Financial Businesses and Professions (DNFBPs)

AMLO Schedule 2 also applies to DNFBPs, which include:

• Accountants: Certified public accountants (CPAs) in public practice
• Legal professionals: Solicitors and barristers when carrying out certain transactions on behalf of clients (e.g., real estate transactions, management of client money, formation of companies and trusts)
• Real estate agents: When acting in real estate purchase/sale transactions above the threshold
• Trust and company service providers (TCSPs): Providers of formation, directorship, and nominee services for companies and trusts
• Dealers in precious metals and stones: When making cash transactions above HK$120,000

Customer Due Diligence (CDD) Obligations

CDD is the cornerstone of AML/CFT compliance. Regulated entities must apply CDD measures when:

• Establishing a business relationship with a new customer
• Conducting an occasional transaction above the applicable threshold (generally HK$120,000 for cash transactions; US$1,000 for wire transfers)
• There is a suspicion of money laundering or terrorist financing, regardless of the amount
• There is doubt about the accuracy or adequacy of previously obtained CDD information

Standard CDD Measures

Standard CDD involves:

• Identity verification: Obtaining and verifying the customer's identity using reliable, independent source documents (e.g., passport, HKID for individuals; certificate of incorporation and constitutional documents for companies)
• Beneficial ownership: Identifying and verifying the beneficial owner(s) of a company or trust (persons who own or control more than 25% of the entity, or who otherwise exercise effective control)
• Purpose of relationship: Understanding the nature and purpose of the business relationship
• Ongoing monitoring: Monitoring transactions and the business relationship on an ongoing basis to ensure consistency with the customer's profile

Enhanced Due Diligence (EDD)

EDD applies to higher-risk customers and situations, including:

• Politically Exposed Persons (PEPs): Individuals who hold or have held prominent public functions (e.g., government officials, judges, military officers, senior executives of state-owned enterprises) and their family members and close associates. EDD for PEPs requires senior management approval, enhanced source of funds/wealth verification, and more frequent ongoing monitoring.
• High-risk jurisdictions: Customers from or transactions with jurisdictions identified by FATF as high-risk (e.g., jurisdictions on FATF's "black list" or "grey list") require EDD
• Non-face-to-face transactions: Customers who are onboarded remotely (without physical identification) require enhanced identity verification measures
• Complex or unusual transactions: Transactions with no apparent economic purpose, or that are inconsistent with the customer's profile, require enhanced scrutiny and documentation

Simplified Due Diligence (SDD)

SDD may be applied in limited circumstances where the money laundering/terrorist financing risk is assessed as low — for example, for listed companies on a recognised stock exchange (whose beneficial ownership is already publicly disclosed) or for certain regulated financial institutions. SDD does not mean that no CDD is conducted; it means that the level of CDD can be reduced.

Suspicious Transaction Reporting

Any person (not just regulated entities) who knows or suspects, or has reasonable grounds to believe, that property represents proceeds of crime or is connected with terrorist financing is required to make a Suspicious Transaction Report (STR) to the Joint Financial Intelligence Unit (JFIU). The JFIU is a joint unit of the Hong Kong Police Force and the Customs and Excise Department.

Key points:

• STRs must be filed as soon as reasonably practicable after the suspicion arises
• Filing an STR provides a "consent" defence — once an STR is filed and the JFIU does not withhold consent within a specified period, the person can proceed with the transaction without being liable for the money laundering offence under Section 25 OSCO
• Tipping off is prohibited: the person filing the STR must not inform the customer or any other person about the STR
• Financial institutions and DNFBPs are required to have internal reporting procedures (compliance officer, internal escalation process) for suspicious activity identification and STR filing

Record-Keeping

Regulated entities must retain CDD records and transaction records for a minimum of 5 years from the date of the transaction or the end of the business relationship, whichever is later. Records must be sufficient to enable reconstruction of the transaction and to provide evidence in the event of a money laundering investigation.

Beneficial Ownership Register (BOR)

Under the Companies (Amendment) Ordinance 2018 (in force 1 March 2018), all Hong Kong-incorporated companies and non-Hong Kong companies registered under Part 16 of the Companies Ordinance must maintain a Significant Controllers Register (SCR) (equivalent to a beneficial ownership register). The SCR must identify persons with significant control (broadly, persons holding more than 25% of shares or voting rights, or otherwise having significant control) and be kept at the registered office or company secretarial office. The SCR must be made available to law enforcement upon request.

In 2023, the government signalled its intention to introduce a centralised beneficial ownership register accessible by law enforcement and other competent authorities, in line with FATF recommendations. Businesses should prepare for increased transparency requirements in this area.

Sanctions Compliance

In addition to AML/CFT obligations, regulated entities in Hong Kong must comply with financial sanctions imposed by the United Nations and implemented in Hong Kong through the United Nations Sanctions Ordinance (Cap. 537) and associated subsidiary legislation. Key obligations include:

• Screening customers and transactions against UN, OFAC, EU, and HK-specific sanctions lists
• Freezing assets of designated persons and entities
• Not dealing with or making funds available to sanctioned persons
• Reporting suspected sanctions violations to the HKMA (for banks), SFC (for licensed corporations), or relevant regulator

Regulatory Enforcement and Penalties

Breaches of AMLO obligations are subject to criminal prosecution and regulatory enforcement:

• Criminal penalties: Failure to comply with AMLO obligations by a financial institution can result in a fine of up to HK$1 million per breach (for the institution) and criminal liability for directors and senior management who consented to or connived in the breach
• Civil sanctions: Regulators (HKMA, SFC, Insurance Authority, C&ED) can impose pecuniary penalties, public reprimands, and suspension or revocation of licences for AML/CFT failures
• High-profile enforcement actions: The HKMA and SFC have issued significant financial penalties to major financial institutions for AML control failures in recent years, sending a clear message about the priority regulators place on AML/CFT compliance

Practical Recommendations

• Risk-based approach: Implement a documented risk-based AML/CFT framework that categorises customers and transactions by risk level and calibrates the intensity of CDD accordingly
• Appoint a compliance officer: Designate a senior person responsible for AML/CFT compliance with appropriate authority and resources
• Train all staff: Ensure all customer-facing and compliance staff receive regular AML/CFT training covering red flags, STR procedures, and tipping-off risks
• Maintain robust records: Implement document management systems that ensure CDD and transaction records are accessible and retrievable for at least 5 years
• Conduct periodic reviews: Regularly review and update the AML/CFT programme in light of new risks, regulatory guidance, and typology reports from the JFIU and FATF
• Engage external advisers: Engage legal or compliance advisers experienced in Hong Kong AML/CFT law to review your programme, conduct gap analyses, and assist with STR filing where legal professional privilege is relevant

Conclusion

Hong Kong's AML/CFT regime is comprehensive and rigorously enforced. Whether you are a bank, licensed securities firm, VASP, law firm, accountancy practice, or trust company, compliance with AMLO and the underlying money laundering offence provisions is essential. The consequences of non-compliance — criminal prosecution, regulatory sanctions, reputational damage, and personal liability for senior management — are too severe to ignore.

Alan Wong LLP advises financial institutions, DNFBPs, and corporates on AML/CFT compliance programme development, CDD and beneficial ownership analysis, STR filing considerations, and regulatory enforcement response. Contact us to discuss your AML/CFT requirements.