Update: AML obligations for a Hong Kong corporate services provider

Corporate services providers operating in Hong Kong are subject to one of the most detailed anti-money laundering (AML) and counter-terrorist financing regimes in the Asia-Pacific region. Enforcement activity has intensified. The regulators are examining not just whether a provider has written policies, but whether those policies are being applied to the actual client population – including multi-jurisdictional structures where the beneficial owner sits offshore and the operating entity sits in the Mainland.

The governing instrument is the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, which imposes customer due diligence, record-keeping, ongoing monitoring and suspicious-transaction reporting obligations on all registered trust and company service providers in Hong Kong. Failure to meet these obligations exposes a provider to regulatory action, licence suspension, and in serious cases, criminal liability. The cross-border dimension – where a Hong Kong company administers structures with Mainland, BVI or Cayman elements – is where regulatory scrutiny now concentrates.

This briefing covers what the current obligations require, who across the cross-border corridor is affected, and what action is warranted now.

What the current regime requires

The Anti-Money Laundering and Counter-Terrorist Financing Ordinance applies to every entity registered as a trust or company service provider in Hong Kong. The obligations fall into four operational categories.

First, customer due diligence (CDD) – the process of identifying the client, verifying identity, and identifying the ultimate beneficial owner – is mandatory before a business relationship commences and on an ongoing basis. For corporate clients with layered offshore holding structures, this means tracing through the chain to the natural person in control. A BVI holding company with a Cayman intermediate and a Hong Kong subsidiary does not simplify that obligation; it extends it.

Second, enhanced due diligence (EDD) applies to higher-risk relationships. Politically exposed persons, clients from designated higher-risk jurisdictions, and relationships with complex or unusually large transaction volumes all trigger EDD. The provider must document the rationale for the risk rating and keep it current.

Third, ongoing monitoring requires that transaction patterns be reviewed against the client's stated business profile. A mismatch – substantial inflows inconsistent with the entity's declared activity – must be investigated and, where suspicion arises, reported.

Fourth, suspicious transaction reports (STRs) must be filed with the Joint Financial Intelligence Unit where there are grounds to suspect that a transaction involves proceeds of an indictable offence or is connected to terrorist property. The obligation to file is not discretionary once the threshold of suspicion is crossed.

Hong Kong implements United Nations sanctions. It does not give domestic effect to unilateral measures of other states. Compliance work in this area focuses on UN-designated parties and the United Nations Sanctions Ordinance, not on the extraterritorial lists of other jurisdictions. That distinction matters for corporate services providers advising cross-border groups.

Who is affected across the corridor

The practical impact falls on three categories of provider.

A corporate services provider administering Hong Kong companies for Mainland Chinese groups faces the most acute scrutiny. Regulators are examining whether CDD has been conducted on the actual beneficial owners – individual shareholders and controllers – rather than on the corporate entities presented as the immediate client. Where a group has restructured its holding chain through the BVI or Cayman Islands, the provider is expected to have mapped the full ownership structure and documented the beneficial owners at the natural-person level.

Providers servicing family-office structures with assets spread across Hong Kong, Singapore and offshore centres face EDD exposure. The combination of high-net-worth principals, multi-jurisdictional asset pools, and periodic large capital movements is a risk-rating trigger.

Providers that also act as registered agents or directors are treated as conducting regulated services. The obligations attach to the provider in that capacity, not merely to the corporate entity being administered.

In our cross-border AML practice, we regularly see providers that have adequate written policies but inadequate application at the file level. Regulators do not distinguish the two: an unfiled CDD record is treated as no record at all.

What to do now

The immediate priorities are straightforward. First, conduct a file review of the current client population. For each active relationship, confirm that the CDD file is complete, current, and includes verification of the ultimate beneficial owner at the natural-person level. Where a relationship was onboarded before the current standards were applied, update the file.

Second, review the risk-rating methodology. Where clients have been rated lower risk by default, reassess against the current regulatory guidance. Offshore holding structures, Mainland-connected principals, and cross-border payment flows are all factors that can move a rating.

Third, review the suspicious-transaction reporting log. If the log is empty, that is not itself a problem – but it requires explanation. A provider processing cross-border transactions over an extended period with no STRs filed should be able to demonstrate that each transaction was assessed and that the assessment was documented.

For a structured assessment of your AML compliance position across the relevant jurisdictions, write to us at info@lockhartyip.com.

Our sanctions and AML practice works alongside the full cross-border AML and sanctions service. Providers with exposure to deal-related sanctions questions may also find our analysis on sanctions due diligence for UK-connected transactions and our guide to internal AML policy for Asian groups directly relevant.

Related practices

• Sanctions & AML – cross-border AML compliance, sanctions screening, and STR advisory
• Corporate Counsel – governance and compliance for Hong Kong and cross-border structures

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Sanctions Aml
• Sanctions Due Diligence Deal Touching United Kingdom Uk 3
• Internal Sanctions Aml Policy Asia Group Analysis

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.