Hong Kong

Employers keep a record of each employee's wage and employment history for the preceding 12 months at the place of business or work, and retain it for six months after the employee leaves. The guide gives a fine of $10,000 for failing to keep records.

Employers and employees each contribute 5% of relevant income; for monthly-paid staff the relevant income is at least $7,100 and capped at $30,000 (employer contribution $1,500 above the cap). The employer deducts the employee's share and sends a remittance statement with each payment, and gives employees a monthly pay-record within seven working days.

The Concise Guide says employers must not dismiss an employee for giving evidence or information in proceedings about enforcing the Ordinance, work accidents or work safety breaches, or penalise employees for union membership and activity; the offence carries a fine of $100,000. Hong Kong has no separate whistleblower protection statute in the sources read.

The Labour Department's Concise Guide says wages fall due when the wage period ends and should be paid as soon as practicable and no later than seven days afterwards; interest is payable on wages unpaid after seven days. Wilful failure to pay wages without reasonable excuse carries a fine of $350,000 and three years' imprisonment.

Per the ICAC's legal page, section 9 of the Prevention of Bribery Ordinance bars an agent, usually an employee, from soliciting or accepting any advantage when handling the principal's affairs without the principal's permission. Sections 4 and 10 cover public bodies and prescribed officers.

Under the Code of Practice, serious incidents affecting critical computer systems are notified within 12 hours of becoming aware (para 7.3.4) and other incidents within 48 hours (Annex E); a phone-first notification must be followed by the form within 48 hours (7.3.6(b)) and a written report is due within 14 days (7.3.7(a)). This duty, not the PDPO, is the mandatory incident-reporting rule for critical infrastructure operators; the Code gives banking as one example of a sector.

Anti-money laundering regime in Hong Kong as stipulated in the Anti-Money Laundering and Counter-Terrorist Financing Ordinance requires the adoption of risk-based compliance programs, which include Customer Due Diligence, transaction monitoring, and record keeping for a period of six years. Organizations are supposed to have a Compliance Officer and a Money Laundering Reporting Officer responsible for ensuring internal controls and filing Suspicious Transaction Reports to the Joint Financial Intelligence Unit, with penalties for not complying of HK$10 million and seven years' imprisonment.

With respect to the timing of the AML document retention rule of Hong Kong, a rigid statutory period of at least five years should be set forth, wherein the trigger factor of the period depends solely on the category of the document to be stored [AMLO Cap 615 Hong Kong]. In terms of Customer Due Diligence (CDD) documents and account opening documents, the five-year period starts on the exact date when the business relationship is ended. Meanwhile, in the case of transaction documents, the five-year period commences on the date when the transaction is completed, no matter what status the account is having [AMLO Cap 615 Hong Kong]. In practice, the time periods may go beyond five years due to other regulatory mandates of different sectors (such as the Customs and Excise Department), as well as the Hong Kong Companies Ordinance, not to mention the indefinite period of those files linked to an ongoing JFIU investigation.

Para 6.2.1 of SPM GS-1 says that, as a minimum, authorised institutions should make climate-related disclosures aligned with TCFD recommendations; paras 6.2.7 and 6.2.8 expect first disclosures by mid-2023 and at least annual disclosure, with a comply-or-explain approach possible (6.2.10 to 6.2.11).

Para 4.7.4 of the HKMA AML Guideline expects verification to be completed within 30 working days of the relationship being established and the relationship terminated if verification is still uncompleted 120 working days after it began. Para 4.7.5 says the bank should terminate the relationship as soon as reasonably practicable, avoid further transactions and consider an STR to the JFIU where verification cannot be completed.

The CDD/KYC requirement in Hong Kong is a risk-based preventative statutory obligation which acts as a strict gatekeeper for financial crime [AMLO Cap 615 Hong Kong]. The requirement makes it a total responsibility of the institutions and compliance officers to identify the identity of customers before any business relation or transaction can be made, totally disallowing any anonymity or false accounts [AMLO Cap 615 Hong Kong]. This obligation is not a strict checklist but rather a requirement where the institutions will have to make a risk-based approach – conducting EDD on risky accounts as well as looking through corporate structures to expose any ultimate beneficial owners who hold over 25% stake. In summary, if the institution fails to meet these requirements, the legal mandate requires them to block the transaction and end the business relations while considering the necessity of filing a suspicious activity report.

Para 1.3.2 of SPM SA-2 says authorised institutions planning to outsource a banking-related business area, or change its scope, should discuss the plan with the HKMA in advance and show that the main issues in section 2 are addressed. Para 2.9.1 asks them to notify the HKMA if overseas authorities seek access to customer data.

Para 4.9.10 requires senior management approval and reasonable measures to establish source of wealth and funds for non-Hong Kong PEPs; para 4.9.11 requires enhanced ongoing monitoring. Para 4.9.19 lets the bank, after a risk-based assessment, stop applying those measures to a former Hong Kong or international organisation PEP who no longer presents a high risk.

SPM OR-2 (31 May 2022) has the board approve the framework, the list of critical operations, the tolerance for disruption and the severe but plausible scenarios, reviewed at least annually (3.3). Section 9.2 allows one year to build the framework and up to three further years to become fully resilient.

The temporal value of the HK’s obligation regarding suspicious transaction reporting requires that a report should be submitted "as soon as is reasonably practicable." Since this requirement is an immediate statutory obligation, there is no pre-established schedule or multi-day period of grace. Instead, regulators anticipate prompt internal notification of the MLRO and reporting directly to the JFIU. When the suspicion is generated before the execution of a transaction, the timeliness of reporting becomes vital since the company needs to freeze the transaction instantly in order to receive "Authorized Consent" from the JFIU, as handling of suspicious funds before submitting a report is the primary form of money laundering offense. Moreover, when a report is made, the typical five-seven-year cycle of data deletion is suspended and the records need to be kept forever until the case is closed by the law enforcement agency.

Para 1.25 of the HKMA AML Guideline states that disclosing a matter likely to prejudice a follow-up investigation, while knowing or suspecting a disclosure has been made, is an offence under DTROP, OSCO and UNATMO, with up to 3 years' imprisonment and a fine. Para 1.24 gives 3 months and a $50,000 fine for failing to disclose.

Para 4.1.9(b) of the SFC AML Guideline requires customer due diligence before occasional transactions of HK$120,000 or more and wire transfers of HK$8,000 or more (or equivalent). A footnote to para 4.1.11 says licensed corporations and SFC-licensed VASPs should not carry out occasional transactions.

Anyone operating a remittance or money-changing business in Hong Kong must hold a C&ED licence. Operating without one is an offence under section 29 of the AMLO (indictment: HK$1,000,000 and 2 years; summary: HK$100,000 and 6 months). Licences normally last 2 years and renewal must be submitted at least 45 days before expiry. A compliance officer and MLRO must be appointed.

Issuing fiat-referenced stablecoins in Hong Kong is a regulated activity and requires an HKMA licence under the Stablecoins Ordinance, in force since 1 August 2025. Applicants are directed to the HKMA's licensing explanatory notes.

Section 8Q of the PSSVFO requires SVF licensees to meet the minimum criteria in Schedule 3; Part 2, section 6(2)(b) concerns adequate and appropriate systems of control to comply with the HKMA's SVF AML guideline. In July 2025 the HKMA fined 33 Financial Services Limited HK$1.6 million under section 33Q for gaps in purpose-and-nature information, CDD on business entities and outsourced identification.

Centralised virtual asset trading platforms that operate in Hong Kong, or actively market to Hong Kong investors, must be licensed by the SFC under the Securities and Futures Ordinance and the AMLO. The SFC suggests a single consolidated application through WINGS; the page lists a $4,740 application fee for a licensed VA service provider under the AMLO.

A person dealing in precious metals, stones, precious products or precious-asset-backed instruments with transactions totalling HK$120,000 or more must register with the Commissioner of Customs and Excise; Category B registrants (cash and non-cash) are subject to AML/CTF supervision. Unregistered dealing carries up to HK$100,000 and 6 months. Eligible non-Hong Kong dealers file a cash transaction report within 1 day of the transaction or before leaving Hong Kong.

For financial years starting on or after 1 January 2025 all listed issuers disclose Scope 1 and Scope 2 emissions and Main Board issuers report the Part D climate requirements on a comply-or-explain basis; Hang Seng Composite LargeCap constituents report them mandatorily from 1 January 2026.

In terms of the lawful basis, notice, and data subject rights in Hong Kong, the model is a hybrid one, which includes event triggered, ongoing, and retention requirements and is governed by the Personal Data (Privacy) Ordinance (PDPO). The notice requirement is entirely event triggered, in the sense that it requires the display of Personal Information Collection Statement (PICS) at the point in time when the information is collected, while Data Access Requests (DARs) result in a strict, non-repeating 40-day statutory period of compliance. Ingested data is subject to an ongoing requirement to ensure continuous accuracy and non-excessiveness of data, with respect to its initial business purpose and a strict retention requirement that requires personal data not to be retained any longer than needed. However, the privacy deletion mandate is regularly superseded by the Anti-Money Laundering Ordinance (AMLO), which legally requires data to be stored for 5 to 7 years after the account or transaction closure.

The breach notification requirement for personal data in Hong Kong is an event-driven and voluntarily followed best practice guided by the Personal Data (Privacy) Ordinance (PDPO) and not a hard-and-fast statute . The regime only kicks into gear when the company realizes there has been a data breach which creates the risk of serious damage to the data subjects and thus triggers the voluntary notification of both the regulatory body and the individuals "as soon as practicable." While the generic response timeframe for such notification is a flexible administrative guideline and not a set calendar count down (typically averaging about 12 days for prompt response), companies are required to provide immediate and provisional notification without waiting for the completion of long forensic audits. The voluntary timeframe changes to an obligatory one should the data breach be related to critical infrastructure or HKMA licensed banks and the failure to resolve the security loophole that precipitated such a breach may even lead to the issuance of a statutory Enforcement Notice by the privacy regulator.