An internal sanctions and AML policy for an Asia group

An Asia group without a documented sanctions and AML (anti-money laundering) policy is not merely under-governed. It is a credit risk. Correspondent banks in Hong Kong, Singapore and Europe will decline or gate payment channels when they cannot read a counterparty's compliance posture. For a Mainland-linked group operating through a Hong Kong holding entity, that means blocked remittances, frozen correspondent relationships and, in the sharper cases, a formal request for remediation before the account reopens.

An internal sanctions and AML policy for an Asia group is the documented compliance architecture – procedures, ownership, screening logic and escalation routes – that allows a multi-jurisdictional group to demonstrate to banks, regulators and counterparties that it manages sanctions and money-laundering risk systematically. The governing instruments in Hong Kong are the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the United Nations Sanctions Ordinance. The policy must be calibrated to the group's actual footprint: where it holds, where it books revenue, where it banks, and which sanctions regimes apply across each layer of that structure.

This page sets out the service Lockhart & Yip provides: the trigger that brings the instruction in, the route we run, the decisions the client must own, and the cross-border interface that makes a Hong Kong-seated policy architecturally distinct from a European or US compliance programme.

When does a foreign principal actually need this?

The clearest trigger is a banking event. A correspondent bank issues a request for information, flags a payment, or declines to process a transaction involving a counterparty whose ownership structure runs through a jurisdiction on a watchlist. The group's in-house team produces a policy document. The bank sends it back. The document was written for a single jurisdiction and does not address the group's actual multi-layer structure.

That scenario is common. In our cross-border practice, we see it most frequently when a group has grown its holding structure – BVI parent, Hong Kong intermediate, operating entities in the Mainland or Southeast Asia – without updating its compliance architecture to match. The policy on file was adequate for a domestic business. It is not adequate for a group with payment flows crossing the Mainland–Hong Kong boundary and correspondent banking relationships that span multiple clearing currencies.

A second trigger is a change of structure. A group that re-domiciles a holding entity to Hong Kong, admits a new investor from a sanctions-sensitive geography, or acquires a target with Mainland or Middle Eastern assets will need to revisit its screening and escalation procedures. The beneficial ownership (ultimate natural person ownership and control) picture changes, and so does the risk profile the bank is being asked to accept.

A third trigger is proactive. Funds and institutional counterparties increasingly require a group to exhibit a documented policy as a condition of onboarding or as a recurring audit point. A group that cannot produce one loses the relationship. The commercial cost is immediate.

Hong Kong implements United Nations sanctions under the United Nations Sanctions Ordinance. It does not give domestic effect to unilateral measures of other states – a point that matters for groups whose counterparties, banking relationships or investors span jurisdictions that apply different sanctions regimes. The policy must reflect this distinction clearly, because the bank reading it will apply its own institutional overlay regardless of what Hong Kong law requires.

What instruments govern the position in Hong Kong?

Two statutes anchor the policy. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance establishes the customer due diligence, record-keeping and suspicious-transaction reporting obligations that apply to financial institutions and designated non-financial businesses and professions in Hong Kong. The United Nations Sanctions Ordinance gives domestic effect to UN Security Council sanctions designations. Together they set the floor. The policy must address both.

Above the statutory floor sit the relevant regulators' AML guidelines. The Hong Kong Monetary Authority publishes guidelines for authorised institutions – the banks and licensed money-service operators that process payment flows. The Securities and Futures Commission publishes parallel guidelines for licensed corporations. Where a group entity holds a regulated status in Hong Kong, the applicable guidelines become part of the compliance standard the group is expected to meet.

Virtual-asset considerations arise where the group has any digital-asset exposure. The VATP licensing regime (mandatory licensing for centralised virtual-asset trading platforms under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance) commenced on 1 June 2023, and VATPs are subject to customer due diligence and the FATF travel rule for virtual-asset transfers. A group with treasury or investment exposure to virtual assets needs to address this in its policy, or its bank will raise it.

The Significant Controllers Register requirement – in force since 1 March 2018 under the Companies Ordinance (Cap. 622) – sits adjacent but is related: accurate beneficial ownership records in the group are a precondition for a credible sanctions screening process. A policy that cannot map the group's ultimate beneficial owners is not a policy.

The cross-border interface: why Hong Kong as the hub changes the architecture

A European group applying a single-jurisdiction AML policy to a Hong Kong intermediate holding entity will produce a document that satisfies neither the Hong Kong regulator nor the group's correspondent bank. The reason is structural. Hong Kong's sanctions posture is calibrated to UN measures only. A policy drafted to OFAC standards – applying US unilateral designations as if they were universal obligations – will overstate the legal position in Hong Kong and may create compliance obligations the group cannot operationally sustain across its Mainland and Southeast Asian counterparties.

The reverse problem also arises. A group that assumes its Mainland-standard compliance process satisfies Hong Kong's Anti-Money Laundering and Counter-Terrorist Financing Ordinance requirements is operating without a proper read of the Hong Kong position. The Mainland and Hong Kong operate under different legal systems. The Mainland has its own AML regime and its own sanctions posture. Neither is automatically read across to the other. A group with holding entities and operating entities on both sides of the boundary needs a policy that explicitly addresses each layer and the interface between them.

Payment channels are where this abstract architecture becomes concrete. A Hong Kong correspondent bank processing a USD clearing payment will apply its own institutional overlay, which typically references OFAC, EU and UN designations simultaneously. The group's policy does not need to replicate that overlay as a matter of Hong Kong law. But it does need to demonstrate that the group understands which counterparties and transactions carry elevated risk, that it screens accordingly, and that it has a documented escalation route when a screen produces a potential match.

This is the compliance-only framing that governs all of our work in this area. The objective is a policy that accurately describes the group's legal obligations, calibrated to the jurisdictions in which it operates, so that banks and regulators can read it and form a confident view of the group's risk management posture.

For a detailed read on Hong Kong's sanctions posture and its practical effect on cross-border transactions, see our guide on Hong Kong's sanctions posture and cross-border transactions. For the related due diligence considerations where a deal involves a UK counterparty, see our guide on sanctions due diligence for deals touching the United Kingdom.

The sequence above describes the standard structural position. Your group's matter turns on the entities actually engaged, the jurisdictions in which they hold licences or bank accounts, and the counterparty profile – which is where the drafting choices are won or lost.

To map the cross-border interface for your group and identify the architecture the policy needs to address, contact us at info@lockhartyip.com.

The route we run: step by step

Our engagement opens with a structure review. We need to understand the group as it actually is: the number of entities, their jurisdictions of incorporation, who holds what, where banking relationships sit, and what payment flows cross a jurisdictional boundary. We read the existing corporate documents, the beneficial ownership records, and any prior compliance documentation the group holds. This stage typically produces a short written diagnosis.

The second step is a risk assessment. We map the group's counterparty profile – customers, suppliers, financial intermediaries, investors – against the sanctions and AML risk categories that are relevant given the group's actual footprint. A group with no exposure to designated geographies, no involvement in the financial sector, and a domestic customer base has a materially different risk profile than a group with Mainland China operations, Middle Eastern investors and a USD clearing account. The risk assessment determines how detailed the policy needs to be and which sections need the most precision.

The third step is drafting. We prepare a policy document that covers: the group's sanctions screening obligations (calibrated to the applicable regimes, with the Hong Kong/UN posture made explicit); the AML customer due diligence requirements; the beneficial ownership mapping and record-keeping procedures; the transaction monitoring approach; the escalation and reporting chain; and the review cycle. Where the group holds a regulated entity in Hong Kong – a licensed corporation, an authorised institution, or a VATP – we coordinate that section with locally licensed Hong Kong firms who advise on the specific regulated-entity obligations. The internationally applicable sections are our work; the Hong Kong-regulated-status sections are handled together with those firms.

The fourth step is a review session with the group's management. The policy must be owned by the people who run the group. A document that management cannot explain to a bank or a regulator is not a usable policy. We walk through the escalation route, the screening logic and the decision points so that the people responsible for signing off on transactions understand what the policy requires of them.

The fifth step – and the one that the group must drive – is implementation. The policy is only as good as the procedures that embed it in the group's daily operations. We advise on the implementation steps and the governance arrangements, but the group must make the operational decisions about systems, personnel and process.

A micro-scenario is useful here. A European industrial group with a BVI holding entity, a Hong Kong intermediate company and operating entities in the Mainland came to us in early 2026. Its principal correspondent bank had flagged the group's payment flows as insufficiently documented and requested a compliance file, including a current AML policy. The group had a policy, but it had been drafted for the European parent alone and made no reference to the Hong Kong intermediate or the Mainland operating entities. We ran a structure review, produced a risk assessment, and drafted a group-level policy that addressed the UN-sanctions posture of the Hong Kong entity, the customer due diligence requirements under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, and the escalation route for payment transactions that crossed the Mainland–Hong Kong boundary. The bank reviewed the file. The payment relationship was restored within one review cycle.

What the client must own

A sanctions and AML policy is a management document, not a legal opinion. Advisers can draft it, map the risk, and explain the framework. But several decisions must be made and owned by the group itself, and no amount of advisory work substitutes for that ownership.

The first is the beneficial ownership picture. The group must be able to map its ultimate beneficial owners accurately, including any indirect or layered ownership through holding entities in multiple jurisdictions. The Significant Controllers Register requirement in Hong Kong reflects a principle that applies across the banking relationship too: a bank will want to see that the group knows who ultimately owns and controls it. If the group cannot answer that question cleanly, the policy cannot address it credibly.

The second is the escalation owner. The policy must name – by role, not by name of the current individual – the person responsible for making compliance decisions when a screen flags a potential match. That person must understand what the policy requires and must have the authority to act. In our experience, this is the most frequent gap in policies drafted without management engagement. The document is technically correct but operationally hollow: no one knows what to do when the flag appears.

The third is the review cycle. Sanctions designations change. Counterparty profiles change. The group's structure changes. A policy that was accurate twelve months ago may be materially incomplete today. The group must commit to a review cycle – typically annual, with event-driven reviews when the structure or counterparty profile changes materially – and must document that reviews have been conducted.

The fourth is training. The policy must be communicated to the people in the group whose work it affects. This does not require a formal training programme for every employee. It does require that the people who approve payments, onboard customers, and manage banking relationships understand the escalation route and know what to flag.

What advisers bring is the legal analysis, the drafting, the cross-border calibration, and the coordination with locally licensed firms on the regulated-entity layer. What management must bring is the factual picture of the group, the commitment to embed the policy operationally, and the willingness to make the escalation function work in practice.

If an earlier policy filing produced an adverse bank response or a regulatory question that was not resolved, a second read can identify where the document fell short and what the routes still open. Stalled remediation files benefit from a fresh structural analysis before the next submission.

To discuss a remediation situation or a policy that needs rebuilding from the structure up, write to us at info@lockhartyip.com.

Common mistakes by foreign principals

The most persistent error is importing a single-jurisdiction policy without recalibrating it to Hong Kong. A US parent whose compliance programme is built around OFAC designations will produce a policy that overstates the legal obligations of the Hong Kong entity and creates operational friction with Mainland counterparties that is not legally required. The bank will still apply its own OFAC overlay; but the group's policy should reflect the group's actual legal obligations, not the bank's institutional risk appetite.

The second error is treating the policy as a one-time document. Advisers on our desk regularly see policies that were accurate at drafting and have not been touched since. The group has changed – new investors, new entities, new counterparties – but the policy still describes the structure as it was. When the bank asks for a current compliance file, the group submits a document that is three years out of date. That is a worse outcome than having no document, because it suggests active misrepresentation rather than simple absence of a programme.

The third error is separating the policy from the beneficial ownership records. A policy that describes a screening process but does not reference how the group maintains and updates its ownership picture will satisfy neither the statutory requirement under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance nor the bank's onboarding standard. The two are structurally linked.

A second micro-scenario: a Southeast Asian family-controlled group with a Cayman holding structure and a Hong Kong operational entity was onboarding a new institutional investor in late 2025. The investor's compliance team requested the group's AML policy and beneficial ownership records as a condition of completion. The group produced a policy drafted for the Cayman entity, with no reference to Hong Kong, and ownership records that did not reflect two recent transfers of shares at the Cayman level. We rebuilt the policy to address the Hong Kong intermediate entity, updated the beneficial ownership mapping, and coordinated with locally licensed Hong Kong counsel on the Significant Controllers Register position. The onboarding completed on schedule.

Decision matrix: what your group's situation calls for

The right scope for a sanctions and AML policy depends on the group's actual structure, activity and banking relationships. The decision points run as follows.

Where a group holds only non-regulated entities in Hong Kong – a pure holding intermediate with no licensed activity, no customer-facing operations – the policy needs to address beneficial ownership, transaction monitoring for intercompany flows, escalation for any payment to or from a sanctioned jurisdiction, and the review cycle. This is the baseline architecture. It is not minimal; it is correctly scoped for the risk profile.

Where the group holds a regulated entity in Hong Kong – a licensed corporation under the Securities and Futures Commission, an authorised institution under the Hong Kong Monetary Authority, or a licensed VATP under the SFC from 1 June 2023 – the policy must additionally address the specific customer due diligence and record-keeping standards set out in the applicable regulator's AML guidelines. This layer requires coordination with locally licensed Hong Kong firms. The international and cross-border architecture is our work; the regulated-entity obligations are handled together with those firms.

Where the group has significant Mainland China operations – operating entities, customer relationships, or payment flows that cross the Mainland–Hong Kong boundary in material volume – the policy must address the interface explicitly. That means a clear statement of which sanctions regime applies to which entity, a screening process that covers both UN designations (for the Hong Kong layer) and any Mainland-specific obligations (for the Mainland entities), and an escalation route that works across the boundary.

Where the group has exposure to virtual assets – whether through a VATP, a treasury allocation, or investment activity – the FATF travel rule and the customer due diligence requirements for virtual-asset transfers must be addressed. The stablecoin licensing regime under the Hong Kong Monetary Authority adds a further layer for groups involved in fiat-referenced stablecoin issuance; the current perimeter and commencement details should be verified before the policy is finalised.

The common thread across all four situations is that the policy must describe the group as it actually is. A policy that is accurate, complete and operationally embedded will satisfy a bank's compliance review. One that is generic, jurisdictionally misaligned or structurally out of date will not.

Self-assessment: is your current policy adequate?

Seven questions to put to the existing document:

• Does it name the specific jurisdictions in which the group holds entities, and identify which sanctions regime applies to each?
• Does it correctly state that Hong Kong implements UN sanctions and does not give domestic effect to unilateral measures of other states?
• Does it describe the group's beneficial ownership mapping process and reference the Significant Controllers Register position?
• Does it identify the escalation owner by role and describe the steps that person takes when a screen flags a potential match?
• Does it address the interface between the Hong Kong intermediate entity and any Mainland China operating entities?
• Does it set out a review cycle, and is there a record of the last review having been conducted?
• If any group entity is a licensed corporation, an authorised institution, or a VATP, does it address the applicable regulator's AML guidelines?

A "no" on any of these points is a gap. A gap in the document is a gap in the compliance posture that a bank or a counterparty will identify.

For a structured assessment of your group's current sanctions and AML policy across the relevant jurisdictions – Hong Kong, the Mainland, the offshore holding layer – and a map of what a remediated or freshly built policy would need to address, write to us at info@lockhartyip.com.

Related practices

Related practices

• Sanctions & AML – international sanctions compliance and AML advisory for cross-border groups
• Holding Structures – Hong Kong and offshore holding architecture for international groups
• Tech & Web3 – VATP licensing, virtual-asset AML, and regulatory engagement in Hong Kong

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.