Suspicious transaction reporting regime in Hong Kong General issues
s.25A(1) & (7), DTROP & OSCO, s.12(1) & s.14(5), UNATMO
7.1 It is a statutory obligation under sections 25A(1) of the DTROP and the OSCO, as well as section 12(1) of the UNATMO, that where a person knows or suspects that any property: (a) in whole or in part directly or indirectly represents any person’s proceeds of, (b) was used in connection with, or (c) is intended to be used in connection with drug trafficking or an indictable offence; or that any property is terrorist property, the person shall as soon as it is reasonable for him to do so, file an STR with the JFIU. The STR should be made together with any matter on which the knowledge or suspicion is based. Under the DTROP, the OSCO and the UNATMO, failure to report knowledge or suspicion carries a maximum penalty of imprisonment for three months and a fine of $50,000.
Knowledge vs. suspicion
7.2 Generally speaking, knowledge is likely to include:
(a) actual knowledge;
(b) knowledge of circumstances which would indicate facts to a reasonable person; and
(c) knowledge of circumstances which would put a reasonable person on inquiry.
7.3 Suspicion is more subjective. Suspicion is personal and falls short of proof based on firm evidence. As far as an AI is concerned, when a transaction or a series of transactions of a customer is not consistent with the AI’s knowledge of the customer, or is unusual (e.g. in a pattern that has no apparent economic or lawful purpose), the AI should take appropriate steps to further examine the transactions and identify if there is any suspicion (see paragraphs 5.10 to 5.14).
7.4 For a person to have knowledge or suspicion, he does not need to know the nature of the criminal activity underlying the ML, or that the funds themselves definitely arose from the criminal offence. Similarly, the same principle applies to TF.
7.5 Once knowledge or suspicion has been formed,
(a) an AI should file an STR even where no transaction has been conducted by or through the AI48; and
(b) the STR should be made as soon as reasonably practical after the suspicion was first identified.
Tipping off
s.25A(5), DTROP &
OSCO, s.12(5), UNATMO
7.6 It is an offence (“tipping off”) to reveal to any person any information which might prejudice an investigation; if a customer is told that a report has been made, this would prejudice the investigation and an offence would be committed. The tipping off provision includes circumstances where a suspicion has been raised internally within an AI, but has not yet been reported to the JFIU.
AML/CFT Systems in relation to suspicious transaction reporting
7.7 An AI should implement appropriate AML/CFT Systems in order to fulfil its statutory reporting obligations, and properly manage and mitigate the risks associated with any customer or transaction involved in an STR. The AML/CFT Systems should include:
(a) appointment of an MLRO (see Chapter 3);
(b) implementing clear policies and procedures over internal reporting, reporting to the JFIU, post-reporting risk mitigation and prevention of tipping off; and
(c) keeping proper records of internal reports and STRs.
7.8 An AI should have measures in place to check, on an ongoing basis, that its AML/CFT Systems in relation to suspicious transaction reporting comply with relevant legal and regulatory requirements and operate effectively. The type and extent of the measures to be taken should be appropriate having regard to the risk of ML/TF as well as the nature and size of its business.
MLRO
7.9 An AI should appoint an MLRO as a central reference point for reporting suspicious transactions and also as the main point of contact with the JFIU and law enforcement agencies. The MLRO should play an active role in the identification and reporting of suspicious transactions. Principal functions of the MLRO should include having oversight of:
(a) review of internal disclosures and exception reports and, in light of all available relevant information, determination of
48 The reporting obligations require a person to report suspicions of ML/TF, irrespective of the amount involved. The reporting obligations of section 25A(1) DTROP and OSCO, and section 12(1) UNATMO apply to “any property”.
These provisions establish a reporting obligation whenever a suspicion arises, without reference to transactions per se. Thus, the obligation to report applies whether or not a transaction was actually conducted and also covers attempted transactions.
whether or not it is necessary to make a report to the JFIU;
(b) maintenance of all records related to such internal reviews;
and
(c) provision of guidance on how to avoid tipping off.
Identifying suspicious transactions and internal reporting
7.10 An AI should provide sufficient guidance to its staff to enable them to form suspicion or to recognise the signs when ML/TF is taking place. The guidance should take into account the nature of the transactions and customer instructions that staff is likely to encounter, the type of product or service and the means of delivery.
7.11 An AI may adopt, where applicable, the “SAFE” approach promoted by the JFIU, which includes: (a) screening the account for suspicious indicators; (b) asking the customers appropriate questions; (c) finding out the customer’s records; and (d) evaluating all the above information. Details of the “SAFE”
approach are available at JFIU’s website (www.jfiu.gov.hk).
7.12 An AI should establish and maintain clear policies and procedures to ensure that:
(a) all staff are made aware of the identity of the MLRO and of the procedures to follow when making an internal report; and (b) all internal reports should reach the MLRO without undue
delay.
7.13 While an AI may wish to set up internal systems that allow staff to consult with supervisors or managers before sending a report to the MLRO, under no circumstances should reports raised by staff be filtered out by supervisors or managers who have no responsibility for the money laundering reporting/compliance function. The legal obligation is to report as soon as it is reasonable to do so, so reporting lines should be as short as possible with the minimum number of people between the staff with the suspicion and the MLRO. This ensures speed, confidentiality and accessibility to the MLRO.
s.25A(4), DTROP &
OSCO, s.12(4), UNATMO
7.14 Once a staff of an AI has reported suspicion to the MLRO in accordance with the policies and procedures established by the AI for the making of such reports, the statutory obligation of the staff has been fully satisfied.
7.15 The internal report should include sufficient details of the customer concerned and the information giving rise to the suspicion.
7.16 The MLRO should acknowledge receipt of an internal report and provide a reminder of the obligation regarding tipping off to the reporting staff upon internal reporting.
7.17 When evaluating an internal report, an MLRO should take reasonable steps to consider all relevant information, including CDD and ongoing monitoring information available within or to the AI concerning the customer to which the report relates. This may include:
(a) making a review of other transaction patterns and volumes through connected accounts, preferably adopting a relationship-based approach rather than on a transaction-by-transaction basis;
(b) making reference to any previous patterns of instructions, the length of the business relationship, and CDD and ongoing monitoring information and documentation; and
(c) appropriate questioning of the customer per the systematic approach to identify suspicious transactions recommended by the JFIU49.
7.18 The need to search for information concerning connected accounts or relationships should strike an appropriate balance between the statutory requirement to make a timely STR to the JFIU and any delays that might arise in searching for more relevant information concerning connected accounts or relationships. The review process should be documented, together with any conclusions drawn.
Reporting to the JFIU
7.19 If after completing the review of the internal report, an MLRO decides that there are grounds for knowledge or suspicion, he should disclose the information to the JFIU as soon as it is reasonable to do so after his evaluation is complete together with the information on which that knowledge or suspicion is based.
Dependent on when knowledge or suspicion arises, an STR may be made either before a suspicious transaction or activity occurs (whether the intended transaction ultimately takes place or not), or after a transaction or activity has been completed.
7.20 Providing an MLRO acts in good faith in deciding not to file an STR with the JFIU, it is unlikely that there will be any criminal liability for failing to report if the MLRO concludes that there is no suspicion after taking into account all available information. It is however vital for the MLRO to keep proper records of the deliberations and actions taken to demonstrate he has acted in
49 For details, please see JFIU’s website (www.jfiu.gov.hk).
reasonable manner.
7.21 In the event that an urgent reporting is required (e.g. where a customer has instructed the AI to move funds or other property, close the account, make cash available for collection, or carry out significant changes to the business relationship etc.), particularly when the account is part of an ongoing investigation by law enforcement agency, an AI should indicate this in the STR.
Where exceptional circumstances exist in relation to an urgent reporting, an initial notification by telephone to the JFIU should be considered.
7.22 An AI is recommended to indicate any intention to terminate a business relationship in its initial STR to the JFIU, thereby allowing the JFIU to comment, at an early stage, on such a course of action.
7.23 An AI should ensure STRs filed to the JFIU are of high quality taking into account feedback and guidance provided by the JFIU in its quarterly report50 and the HKMA from time to time.
Post STR reporting
s.25A(2)(a), DTROP
& OSCO, s.12(2B)(a), UNATMO
7.24 The JFIU will acknowledge receipt of an STR made by an AI under section 25A of both the DTROP and the OSCO, and section 12 of the UNATMO. If there is no need for imminent action, e.g.
the issue of a restraint order on an account, consent will usually be given for the AI to operate the account under the provisions of section 25A(2)(a) of both the DTROP and the OSCO, and section 12(2B)(a) of the UNATMO. If a no-consent letter is issued, the AI should act according to the contents of the letter and seek legal advice where necessary.
s.25A(2), DTROP &
OSCO, s.12(2), UNATMO
7.25 Filing an STR to the JFIU provides an AI with a statutory defence to the offence of ML/TF in respect of the acts disclosed in the report, provided:
(a) the report is made before the AI undertakes the disclosed acts and the acts (transaction(s)) are undertaken with the consent of the JFIU; or
(b) the report is made after the AI has performed the disclosed acts (transaction(s)) and the report is made on the AI’s own initiative and as soon as it is reasonable for the AI to do so.
50 The purpose of the quarterly report, which is relevant to all financial sectors, is to raise AML/CFT awareness. It consists of two parts, (i) analysis of STRs and (ii) matters of interest and feedback. The report is available at a secure area of the JFIU’s website at www.jfiu.gov.hk. AIs can apply for a login name and password by completing the registration form available on the JFIU’s website or by contacting the JFIU directly.
7.26 However, the statutory defence stated in paragraph 7.25 does not absolve an AI from the legal, reputational or regulatory risks associated with the account’s continued operation. An AI should also be aware that a “consent” response from the JFIU to a pre-transaction report should not be construed as a “clean bill of health” for the continued operation of the account or an indication that the account does not pose a risk to the AI.
7.27 An AI should conduct an appropriate review of a business relationship upon the filing of an STR to the JFIU, irrespective of any subsequent feedback provided by the JFIU, and apply appropriate risk mitigating measures. Filing a report with the JFIU and continuing to operate the relationship without any further consideration of the risks and the imposition of appropriate controls to mitigate the risks identified is not acceptable. If necessary, the issue should be escalated to the AI’s senior management to determine how to handle the relationship concerned to mitigate any potential legal or reputational risks posed by the relationship in line with the AI’s business objectives, and its capacity to mitigate the risks identified.
7.28 An AI should be aware that the reporting of a suspicion in respect of a transaction or event does not remove the need to report further suspicious transactions or events in respect of the same customer. Further suspicious transactions or events, whether of the same nature or different to the previous suspicion, should continue to be reported to the MLRO who should make further reports to the JFIU if appropriate.
Record-keeping
7.29 An AI should establish and maintain a record of all ML/TF reports made to the MLRO. The record should include details of the date the report was made, the staff members subsequently handling the report, the results of the assessment, whether the internal report resulted in an STR to the JFIU, and information to allow the papers relevant to the report to be located.
7.30 An AI should establish and maintain a record of all STRs made to the JFIU. The record should include details of the date of the STR, the person who made the STR, and information to allow the papers relevant to the STR to be located. This register may be combined with the register of internal reports, if considered appropriate.
Requests from law enforcement agencies
7.31 An AI may receive various requests from law enforcement agencies, e.g. search warrants, production orders, restraint orders or confiscation orders, pursuant to relevant legislations in Hong Kong. These requests are crucial to aid law enforcement agencies
to carry out investigations as well as restrain and confiscate illicit proceeds. Therefore, an AI should establish clear policies and procedures to handle these requests in an effective and timely manner, including allocation of sufficient resources and appointing a staff as the main point of contact with law enforcement agencies.
7.32 An AI should respond to any search warrant and production order within the required time limit by providing all information or materials that fall within the scope of the request. Where an AI encounters difficulty in complying with the timeframes stipulated, the AI should at the earliest opportunity contact the officer-in-charge of the investigation for further guidance.
s.10 & 11, DTROP, s.15 & 16, OSCO, s.6, UNATMO
7.33 During a law enforcement investigation, an AI may be served with a restraint order which prohibits the dealing with particular funds or property pending the outcome of an investigation. The AI should ensure that it is able to freeze the relevant property that is the subject of the order. It should be noted that the restraint order may not apply to all funds or property involved within a particular business relationship and the AI should consider what, if any, funds or property may be utilised subject to the laws of Hong Kong.
s.3, DTROP, s.8, OSCO, s.13, UNATMO
7.34 Upon the conviction of a defendant, a court may order the confiscation of his criminal proceeds and an AI may be served with a confiscation order in the event that it holds funds or other property belonging to that defendant that are deemed by the court to represent his benefit from the crime. A court may also order the forfeiture of property where it is satisfied that the property is terrorist property.
7.35 When an AI receives a request from a law enforcement agency, e.g. search warrant or production order, in relation to a particular customer or business relationship, the AI should assess the risks involved and the need to conduct an appropriate review on the customer or the business relationship to determine whether there is any suspicion and should also be aware that the customer subject to the request can be a victim of crime.