The Ultimate Guide to AML/CFT Obligations for Hong Kong Trust Companies

The Ultimate Guide to AML/CFT Obligations for Hong Kong Trust Companies

Last Reviewed: June 2025

Hong Kong Trust Company Service Providers (TCSPs) are legally required to maintain robust Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) programmes under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), Cap. 615. These obligations are non-negotiable, comprehensively enforced by the Companies Registry, and carry severe penalties for non-compliance — including licence suspension and criminal prosecution. If you operate a licensed TCSP or are preparing to apply for one, understanding every layer of your AML/CFT obligations is the foundation of a sustainable, compliant business.

---

What AML/CFT Framework Governs Hong Kong Trust Companies?

The primary legislative instrument governing TCSP regulatory compliance in Hong Kong is the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), which was significantly amended in 2018 to bring trust and company service providers into a formal licensing regime. The Companies Registry administers TCSP licensing and conducts supervisory inspections to assess AML/CFT compliance.

The Financial Action Task Force (FATF), the global standard-setter for AML/CFT policy, classifies TCSPs as Designated Non-Financial Businesses and Professions (DNFBPs). Hong Kong, as an FATF member jurisdiction, is required to ensure its TCSP sector meets FATF's Recommendations — particularly Recommendations 22 and 23, which directly address due diligence and record-keeping obligations for DNFBPs.

In addition to AMLO, TCSPs must observe:

• The United Nations Sanctions Ordinance — for screening clients against UN-mandated sanctions lists
• The Drug Trafficking (Recovery of Proceeds) Ordinance — for reporting suspicions related to drug-related proceeds
• The Organized and Serious Crimes Ordinance (OSCO) — which establishes the legal obligation to file Suspicious Transaction Reports (STRs)

Compliance with this legislative framework is not optional, and ignorance of its provisions does not constitute a defence in enforcement proceedings.

---

Core AML/CFT Obligations Every Hong Kong TCSP Must Fulfil

The following obligations represent the minimum compliance standard for all licensed TCSPs operating in Hong Kong. Each area is subject to scrutiny during Companies Registry inspections.

1. Customer Due Diligence (CDD)

TCSPs must conduct Customer Due Diligence before establishing a business relationship, before carrying out an occasional transaction at or above HKD 120,000, and whenever there is suspicion of money laundering or terrorist financing. CDD requires verifying the identity of the client, understanding the nature and purpose of the business relationship, and conducting ongoing monitoring of transactions.

For legal persons and arrangements — such as companies, partnerships, and trusts — CDD extends to identifying and verifying the beneficial owners who ultimately own or control 25% or more of the entity. This is a critical requirement that many newly licensed TCSPs underestimate in its complexity.

2. Enhanced Due Diligence (EDD)

EDD applies to higher-risk relationships, including Politically Exposed Persons (PEPs), clients from high-risk jurisdictions identified on FATF's grey or black lists, and relationships with unusual or complex structures. EDD requires obtaining senior management approval before proceeding, understanding the source of wealth and funds, and applying enhanced ongoing monitoring.

3. Risk-Based Approach (RBA)

All AML/CFT controls must be applied proportionately to the risk posed by each client and transaction. TCSPs are required to maintain a documented risk assessment framework that categorises clients and business relationships as low, medium, or high risk. The Companies Registry expects this framework to be operationally embedded — not simply a document that sits in a folder.

4. Suspicious Transaction Reporting (STR)

Where a TCSP knows, suspects, or has reasonable grounds to suspect that a transaction involves proceeds of crime or terrorist financing, it must file an STR with the Joint Financial Intelligence Unit (JFIU) as soon as reasonably practicable. Failure to report — or tipping off a client that a report has been filed — are both criminal offences under OSCO and the AMLO.

5. Record Keeping

All CDD documentation, transaction records, and internal compliance records must be retained for a minimum of six years from the date the business relationship ends or the transaction is completed. According to the Hong Kong Companies Registry's published guidance, this includes identification documents, business correspondence, and the results of any due diligence undertaken.

6. Ongoing Monitoring

A business relationship does not end at onboarding. TCSPs must continuously monitor client activity for consistency with the declared purpose of the relationship and update CDD information when circumstances change. Periodic reviews — at intervals calibrated to risk — are an explicit regulatory expectation.

---

Who Is Responsible for AML/CFT Compliance Within a TCSP?

Every licensed TCSP must appoint a Money Laundering Reporting Officer (MLRO). The MLRO is the designated individual responsible for receiving internal suspicious activity reports, making the determination on whether to file an STR with the JFIU, and overseeing the firm's day-to-day AML/CFT compliance. The MLRO must be a fit and proper person with sufficient seniority, resources, and AML/CFT knowledge to perform the role effectively.

Senior management of the TCSP bears ultimate responsibility for the firm's compliance culture. The Companies Registry expects a demonstrable tone from the top — including board-level engagement with AML/CFT risk and resource allocation adequate to meet compliance obligations.

For firms without a full-time in-house compliance resource, outsourced MLRO arrangements are a practical and increasingly common solution. Firms considering this route should review the detailed considerations covered in our article on outsourced MLRO services for Hong Kong TCSP companies.

---

How Does the Companies Registry Supervise TCSP AML/CFT Compliance?

The Companies Registry conducts both desk-based reviews and on-site inspections of licensed TCSPs. During an inspection, inspectors typically assess:

• The adequacy of the firm's written AML/CFT policies and procedures
• Whether CDD processes have been correctly applied across a sample of client files
• The quality and completeness of beneficial ownership records
• STR filing history and internal escalation procedures
• Staff training records and awareness levels
• The fitness of the MLRO and their access to resources

According to the Companies Registry's Annual Report 2023/2024, the Registry conducted a significant number of inspections of licensed TCSPs, with AML/CFT deficiencies identified as the most common ground for regulatory action. Firms found to have material compliance failures face a range of sanctions, from formal warnings to licence revocation.

---

AML/CFT compliance for Hong Kong TCSPs is not a checkbox exercise — it is a continuous operational discipline. The Companies Registry's inspection programme targets precisely the gap between written policies and actual day-to-day practice. Firms that invest in operationally embedded compliance systems, not just documentation, are the ones that pass inspections and retain their licences.

---

Q&A: Common AML/CFT Questions from Hong Kong TCSPs

Q: What is the penalty for failing to file a Suspicious Transaction Report in Hong Kong?

A: Failure to file an STR when legally required is a criminal offence under OSCO. Individuals found guilty can face imprisonment of up to 14 years and an unlimited fine. Corporate entities face equivalent criminal liability. The JFIU can also refer matters to the Companies Registry, which may then initiate licence suspension or revocation proceedings.

Q: Does CDD apply to existing clients when the AMLO requirements change?

A: Yes. When regulatory requirements are updated, TCSPs are required to apply revised CDD standards to their existing client base on a risk-prioritised basis. High-risk clients must be reviewed first. The Companies Registry expects firms to have a documented remediation plan for bringing existing client files into compliance with updated requirements.

Q: How often must a TCSP update its AML/CFT risk assessment?

A: The firm-wide risk assessment must be reviewed at least annually, or immediately when there is a material change in the business — such as entering a new product line, onboarding clients from a newly designated high-risk jurisdiction, or a significant change in ownership or management structure. The Companies Registry expects the risk assessment to be a living document, not a static annual formality.

---

The Role of Technology in TCSP AML/CFT Compliance

Manual compliance processes create operational risk. As client portfolios grow, the volume and complexity of CDD, monitoring, and record-keeping tasks quickly exceed what spreadsheets and email trails can reliably manage. Purpose-built compliance technology addresses this directly.

Bridge Corporate Services offers a purpose-built SaaS platform designed specifically for TCSPs operating in Hong Kong and across key international jurisdictions including Singapore, the Cayman Islands, the British Virgin Islands, and Switzerland. The platform provides structured client onboarding workflows, automated CDD and EDD tracking, document management with retention controls, and real-time compliance dashboards that give MLROs and senior management instant visibility over the firm's risk profile.

Using a dedicated TCSP compliance platform does more than improve efficiency. It creates an auditable, timestamped record of every compliance action taken — exactly what the Companies Registry looks for during an inspection. Firms that rely on unstructured manual processes frequently struggle to demonstrate, retrospectively, that their CDD was completed correctly and on time.

---

The difference between a TCSP that passes a Companies Registry inspection and one that fails often comes down not to intent, but to documentation and process. A technology-driven compliance system transforms good intentions into verifiable, auditable actions — and that is what regulators actually assess.

---

What Are the AML/CFT Training Requirements for TCSP Staff?

All staff of a licensed TCSP who have client-facing responsibilities or who handle transactions must receive regular AML/CFT training. Training must cover:

• How to identify suspicious activity and red flags
• The firm's internal escalation and STR filing procedures
• The legal obligations of staff under AMLO and OSCO
• Updates to regulatory requirements and FATF guidance

Training records must be maintained and produced to the Companies Registry on request. The MLRO is typically responsible for designing and delivering the training programme, though external providers are frequently engaged for specialist content.

---

Practical Steps to Strengthen Your TCSP AML/CFT Programme

1. Conduct a gap analysis against the Companies Registry's published AML/CFT guidelines and FATF Recommendations 22 and 23
2. Review and update your written AML/CFT policies to reflect the current regulatory environment and any changes in your business model
3. Audit your existing client files for CDD completeness, particularly beneficial ownership records
4. Test your STR escalation process — ensure staff know the internal reporting chain and that the MLRO has a documented decision log
5. Implement or upgrade your compliance technology to replace manual processes with auditable, systematic workflows
6. Deliver AML/CFT training to all relevant staff and document completion
7. Engage expert consulting support if your firm lacks internal expertise — particularly if you are approaching a Companies Registry inspection or undergoing a material change in business

Bridge Corporate Services provides end-to-end TCSP company setup and licensing consulting, combined with ongoing compliance support and access to its proprietary SaaS compliance platform. Firms preparing for their initial TCSP licence application or managing an existing licence benefit from expert guidance on meeting every AML/CFT obligation without building a large in-house compliance team from scratch.

---

Staying Ahead of Regulatory Change

Hong Kong's AML/CFT regulatory environment continues to evolve. FATF conducts mutual evaluations of member jurisdictions on a rolling basis, and findings from these evaluations typically translate into tightened domestic requirements. Hong Kong's most recent FATF Mutual Evaluation Report identified the TCSP sector as a priority area for enhanced supervision — a signal that regulatory scrutiny will intensify, not diminish, in the years ahead.

TCSPs operating across multiple jurisdictions — including Singapore, London, the Cayman Islands, the BVI, and Switzerland — face the additional complexity of navigating parallel AML/CFT regimes. While the underlying FATF standards provide a common baseline, implementation requirements, reporting thresholds, and supervisory expectations differ materially between jurisdictions. Multi-jurisdictional operators benefit significantly from consolidated compliance infrastructure and expert advisory support that spans these regulatory environments.

For a comprehensive foundation on understanding your obligations from the point of licence application, the complete walkthrough of Hong Kong TCSP compliance requirements provides essential context for both new applicants and established licensees reviewing their compliance posture.

---

Key Takeaways

• AML/CFT compliance under AMLO is a mandatory, ongoing obligation for every licensed Hong Kong TCSP — not a one-time licensing requirement
• CDD, EDD, STR filing, record keeping, ongoing monitoring, and staff training each represent distinct and separately enforceable obligations
• The Companies Registry actively inspects TCSPs for AML/CFT compliance, with material deficiencies resulting in licence suspension or criminal referral
• Technology platforms purpose-built for TCSP compliance significantly reduce operational risk and strengthen audit readiness
• Expert consulting support from Bridge Corporate Services provides both the strategic framework and the operational tools to meet AML/CFT obligations efficiently and sustainably