Hong Kong

Anti-money laundering regime in Hong Kong as stipulated in the Anti-Money Laundering and Counter-Terrorist Financing Ordinance requires the adoption of risk-based compliance programs, which include Customer Due Diligence, transaction monitoring, and record keeping for a period of six years. Organizations are supposed to have a Compliance Officer and a Money Laundering Reporting Officer responsible for ensuring internal controls and filing Suspicious Transaction Reports to the Joint Financial Intelligence Unit, with penalties for not complying of HK$10 million and seven years' imprisonment.

With respect to the timing of the AML document retention rule of Hong Kong, a rigid statutory period of at least five years should be set forth, wherein the trigger factor of the period depends solely on the category of the document to be stored [AMLO Cap 615 Hong Kong]. In terms of Customer Due Diligence (CDD) documents and account opening documents, the five-year period starts on the exact date when the business relationship is ended. Meanwhile, in the case of transaction documents, the five-year period commences on the date when the transaction is completed, no matter what status the account is having [AMLO Cap 615 Hong Kong]. In practice, the time periods may go beyond five years due to other regulatory mandates of different sectors (such as the Customs and Excise Department), as well as the Hong Kong Companies Ordinance, not to mention the indefinite period of those files linked to an ongoing JFIU investigation.

The CDD/KYC requirement in Hong Kong is a risk-based preventative statutory obligation which acts as a strict gatekeeper for financial crime [AMLO Cap 615 Hong Kong]. The requirement makes it a total responsibility of the institutions and compliance officers to identify the identity of customers before any business relation or transaction can be made, totally disallowing any anonymity or false accounts [AMLO Cap 615 Hong Kong]. This obligation is not a strict checklist but rather a requirement where the institutions will have to make a risk-based approach – conducting EDD on risky accounts as well as looking through corporate structures to expose any ultimate beneficial owners who hold over 25% stake. In summary, if the institution fails to meet these requirements, the legal mandate requires them to block the transaction and end the business relations while considering the necessity of filing a suspicious activity report.

The temporal value of the HK’s obligation regarding suspicious transaction reporting requires that a report should be submitted "as soon as is reasonably practicable." Since this requirement is an immediate statutory obligation, there is no pre-established schedule or multi-day period of grace. Instead, regulators anticipate prompt internal notification of the MLRO and reporting directly to the JFIU. When the suspicion is generated before the execution of a transaction, the timeliness of reporting becomes vital since the company needs to freeze the transaction instantly in order to receive "Authorized Consent" from the JFIU, as handling of suspicious funds before submitting a report is the primary form of money laundering offense. Moreover, when a report is made, the typical five-seven-year cycle of data deletion is suspended and the records need to be kept forever until the case is closed by the law enforcement agency.