Customer Due Diligence Requirements for TCSPs in Hong Kong Under Cap. 615

Customer Due Diligence for TCSPs Hong Kong

Every licensed trust or company service provider in Hong Kong must perform customer due diligence before establishing a business relationship with a client. The obligation arises under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615). Schedule 2 sets out the minimum steps: identify and verify the client, identify and verify the beneficial owner, understand the purpose and intended nature of the business relationship, and monitor activity throughout that relationship.

Customer due diligence is not a one-off check at onboarding. It is a continuous compliance function. The Registrar of Companies enforces it through inspections and, where necessary, disciplinary action.

Hong Kong TCSP CDD Requirements

The Hong Kong TCSP CDD requirements are set out in Schedule 2 to Cap. 615. A licensee must apply customer due diligence measures when:

• establishing a business relationship with a client
• carrying out an occasional transaction that involves a total amount of HK$120,000 or more, whether carried out in a single operation or several operations that appear to be linked
• there is a suspicion of money laundering or terrorist financing, regardless of the transaction amount
• the licensee doubts the veracity or adequacy of any previously obtained client identification data

Complete the CDD measures before the business relationship is established. In limited circumstances, the licensee may complete verification after establishment, provided this is necessary to avoid interrupting the normal course of business and the delay is managed with appropriate risk-mitigation procedures. The licensee must complete the verification as soon as practicable.

Hong Kong CDD for TCSP: The Four Core Steps

Hong Kong CDD for TCSP licenseees comprises four mandatory components. Document each one and retain the records for the prescribed period.

1. Identify and verify the client

Obtain the client's full name, date of birth (for a natural person), place of incorporation or registration (for a legal person), and the address of the registered office or principal place of business. For a natural person, verify identity using an official document such as a Hong Kong identity card or a valid passport. For a company, inspect the certificate of incorporation, the business registration certificate, or an equivalent document from the jurisdiction of incorporation.

2. Identify and verify the beneficial owner

A beneficial owner is any natural person who ultimately owns or controls the client. For a company, this includes any individual who holds more than 25% of the issued shares or voting rights, or who otherwise exercises significant influence or control. Take reasonable measures to identify the beneficial owner and verify that person's identity. If no natural person is identified as the beneficial owner, identify the senior managing official and verify that person's identity.

3. Understand the purpose and intended nature of the business relationship

Obtain information about the source of funds and the source of wealth of the client and any beneficial owner. Understand the expected pattern of transactions, including the type, volume and frequency of activity. This information lets the licensee assess whether a transaction is consistent with the client's profile.

4. Conduct ongoing monitoring

Scrutinise transactions throughout the business relationship to ensure they are consistent with the licensee's knowledge of the client, its business and its risk profile. Keep client information up to date. Where a material change occurs, undertake fresh CDD measures.

Hong Kong TCSP Identity Verification

Hong Kong TCSP identity verification must be based on reliable, independent source documents. For a natural person, acceptable documents include:

• Hong Kong permanent identity card
• Hong Kong identity card (non-permanent)
• valid passport issued by any jurisdiction
• recognised travel document

For a legal person, verify:

• the certificate of incorporation or equivalent
• the business registration certificate
• the memorandum and articles of association or constitutional documents
• the register of directors and register of shareholders, where available

Also verify that any person purporting to act on behalf of the client has the authority to do so. Check the power of attorney, board resolution or equivalent document.

Risk Assessment and Enhanced Due Diligence

Conduct a risk assessment of each client before or at the time of establishing the business relationship. The assessment must consider the client's country of residence or incorporation, the nature of its business, the source of funds, and any connection to a politically exposed person (PEP).

A PEP is an individual who holds a prominent public position in Hong Kong or another jurisdiction, or who has held such a position in the past 12 months. Family members and close associates of a PEP are also treated as PEPs. When a client or beneficial owner is a PEP, the licensee must:

• obtain senior management approval before establishing the business relationship
• take adequate measures to establish the source of wealth and source of funds
• conduct enhanced ongoing monitoring of the business relationship

Enhanced due diligence also applies where the client is from a jurisdiction with insufficient anti-money laundering and counter-terrorist financing measures, or where the client presents a higher risk of money laundering or terrorist financing.

Record Keeping and the Prescribed Period

Keep all records obtained through customer due diligence for at least seven years after the business relationship ends. This period is the prescribed period under Cap. 615. The records must include:

• a copy of the evidence of identity verification
• the file containing the client's business correspondence
• the results of any analysis undertaken to identify beneficial owners
• details of any suspicious transaction reports made to the Joint Financial Intelligence Unit

Keep the records in a form that allows the licensee to reconstruct the business relationship and respond promptly to any enquiry from the Registrar of Companies or law enforcement.

Ongoing Monitoring and Suspicious Transaction Reporting

Ongoing monitoring is not a static exercise. Review the client's transaction activity against the expected pattern established at onboarding. If a transaction appears unusual or inconsistent with the client's profile, consider whether it gives rise to a suspicion of money laundering or terrorist financing. Where a suspicion arises, make a suspicious transaction report to the Joint Financial Intelligence Unit. Do not tip off the client.

Consequences of Non-Compliance

Failure to comply with the customer due diligence requirements under Cap. 615 is an offence. The Registrar of Companies may revoke or suspend a TCSP licence, impose a financial penalty, or refer the matter for prosecution. A licensee that fails to apply CDD measures, fails to keep records, or fails to report a suspicious transaction may be liable to a fine and imprisonment.

Practical Steps for Licensees

Maintain a written CDD policy that sets out the procedures for identity verification, beneficial owner identification, risk assessment, ongoing monitoring and record keeping. Review the policy at least annually. Update it to reflect changes in the law or the licensee's business. Train staff regularly on the CDD requirements and on how to identify suspicious activity.

The Registrar of Companies publishes guidance notes on the CDD obligations under Cap. 615. Consult these notes and, where necessary, seek legal advice on the application of the requirements to specific client types or business structures.