DNFBP Obligations Under AMLO Cap. 615 Outside TCSP: Accountants, Lawyers, Estate Agents and Precious Metals Dealers in Hong Kong

A DNFBP — a designated non-financial business or profession — is one of five categories of person to which the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) applies the customer due diligence and record-keeping requirements of Schedule 2. Four of those categories hold no TCSP licence: accounting professionals, legal professionals, estate agents and Category B precious metals and stones registrants. This article deals with those four.

The central practical point can be stated in one sentence. A contravention of Schedule 2 does not constitute an offence under Cap. 615 for any of these four categories, and attracts no pecuniary penalty under Part 4 of Cap. 615.Sections 5(5) to (8), which carry a fine of up to HK$1,000,000 and imprisonment, are addressed to a “financial institution”; the pecuniary penalty under section 21 — the greater of HK$10,000,000 or three times the profit gained or the costs avoided — is likewise confined to a financial institution. For accountants, lawyers and estate agents liability runs instead through each regulator’s own Ordinance: up to HK$500,000 imposed by the AFRC or by a Solicitors Disciplinary Tribunal, and up to HK$300,000 imposed by the Estate Agents Authority. For a Category B precious metals and stones registrant the legislature took a different route: the pecuniary penalty of up to HK$500,000 sits inside Cap. 615 itself, in section 53ZVF(3)(c).

Important. The absence of a criminal offence in Cap. 615 does not mean the absence of criminal exposure. The duty to report suspicious transactions is not found in Cap. 615 at all. It sits in section 25A of the Drug Trafficking (Recovery of Proceeds) Ordinance (Cap. 405), section 25A of the Organized and Serious Crimes Ordinance (Cap. 455) and section 12 of the United Nations (Anti-Terrorism Measures) Ordinance (Cap. 575). Failure to report is a criminal offence carrying a level 5 fine of HK$50,000 and three months’ imprisonment, and dealing with property that represents the proceeds of crime carries a fine of up to HK$5,000,000 and imprisonment for up to 14 years. Those provisions bind every person, whether or not that person is a DNFBP.

Nine facts frame everything that follows.

The operative version of Cap. 615 is dated 15 May 2026.

DNFBP obligations have applied since 1 March 2018, and since 1 April 2023 for Category B precious metals and stones registrants.

The occasional-transaction threshold that triggers customer due diligence outside a business relationship is HK$120,000.

The HK$8,000 transfer threshold applies only to financial institutions and licensed virtual asset service providers, and never to a DNFBP.

Since 1 October 2022 the regulator of the accounting profession has been the AFRC rather than the HKICPA, even though the HKICPA still issues the guideline.

Barristers fall outside the definition of “legal professional”.

Transaction records must be kept for at least five years from completion, and customer records throughout the business relationship and for at least five years after it ends.

The AFRC took the first AML disciplinary actions in its history on 5 March 2026, totalling HK$290,000.

Across the whole of 2025, Hong Kong accounting professionals filed 16 suspicious transaction reports, precious metals and stones dealers 27, estate agencies 161 and legal professionals 962, out of 190,636 reports from all sectors combined.

Who Is a DNFBP Under Cap. 615 — and Who Is Not

A DNFBP under Schedule 1 Part 2 of Cap. 615 is one of five listed categories of person: an accounting professional, an estate agent, a legal professional, a TCSP licensee or a Category B PMS registrant. The list is exhaustive. A person who does not fall within one of the five categories carries no Schedule 2 obligation, however closely the activity resembles the FATF description.

The definitions do not track the ordinary meaning of the professions, and that is where most misclassification happens.

An accounting professional is a certified public accountant within the meaning of section 2(1) of the Professional Accountants Ordinance (Cap. 50), or a certified public accountant (practising) within the meaning of section 2(1) of the Accounting and Financial Reporting Council Ordinance (Cap. 588), together with a corporate practice and a CPA firm within the meaning of that same section 2(1) of Cap. 588. This wording was substituted by L.N. 66 of 2022. A bookkeeper without the CPA qualification, an in-house finance director and an outsourced accounting business that is not registered as a CPA firm all fall outside it.

A legal professional is a solicitor or a foreign lawyer, each as defined by section 2(1) of the Legal Practitioners Ordinance (Cap. 159). Barristers are excluded. That is a deliberate choice rather than a gap: paragraph 6.2.1 of the Hong Kong Money Laundering and Terrorist Financing Risk Assessment Report of July 2022 explains that practising barristers are prohibited by their Code of Conduct from receiving, disbursing or otherwise handling clients’ money, securities or other assets except by way of receiving payment of their fees, and are therefore not engaged in the activities covered by the FATF Recommendations.

An estate agent is a licensed estate agent or a licensed salesperson within the meaning of section 2(1) of the Estate Agents Ordinance (Cap. 511). The definition turns on the licence rather than on the activity: an unlicensed intermediary sits outside Schedule 2, although that person commits a separate offence under section 55(1)(a) or (b) of Cap. 511, read with sections 15 and 16 — up to HK$500,000 and 2 years’ imprisonment on indictment.

A Category B PMS registrant is a Category B registrant within the meaning of Part 5C of Cap. 615, or a person deemed to be one under section 53ZW(8). A Category A registrant is not a DNFBP and carries no Schedule 2 obligation at all. The Category A and Category B distinction is among the most underappreciated in the whole regime.

A TCSP licensee is also a DNFBP, and much of the substantive regime below applies identically. The TCSP licensee’s supervisory and enforcement framework is separate, however: it sits in Part 5A of Cap. 615 and includes a criminal offence for carrying on business without a licence. That regime is treated in a separate article; here it appears only for contrast.

The Legal Framework: Which Instruments Apply, and in Which Version

The DNFBP regime is built from four kinds of instrument: the principal Ordinance, the regulators’ own Ordinances, the guidelines issued under section 7 of Cap. 615, and a separate body of criminal legislation on suspicious transaction reporting. No single instrument contains the whole of it.

The principal instrument is the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615). It was originally enacted as the Anti-Money Laundering and Counter-Terrorist Financing (Financial Institutions) Ordinance; the words “(Financial Institutions)” were removed from the short title by section 4 of 4 of 2018. The Ordinance commenced on 8 July 2011. The operative consolidated version is dated 15 May 2026, and as at 14 September 2026 no later version appears in the Hong Kong e-Legislation point-in-time list.

The chain of amendments that matters for DNFBPs is short, and worth keeping to hand.

One point follows directly from the table: the 2025 and 2026 amendments have no bearing on the obligations of the four categories discussed here. In substance the DNFBP regime has not changed since 2023.

Nor does the 2026 legislative agenda change it. In Consultation Conclusions published by the Financial Services and the Treasury Bureau in December 2025, the Government stated its intention to introduce a bill into the Legislative Council in 2026 creating licensing regimes — under Cap. 615 itself — for dealing in virtual assets and for virtual asset advisory and management services. Those proposals leave the obligations of the four categories discussed here untouched: the new licensees are simply added to the population on which the Schedule 2 requirements bite.

The regulators’ own Ordinances are where liability actually arises:

•          Accounting and Financial Reporting Council Ordinance (Cap. 588) — sections 3B, 37AA, 37CA and 37H;

•          Legal Practitioners Ordinance (Cap. 159) — sections 9A and 10;

•          Estate Agents Ordinance (Cap. 511) — sections 27, 28, 29 and 30;

•          for precious metals dealers, liability remained inside Cap. 615, in Division 6 of Part 5C.

The guidelines issued under section 7 of Cap. 615. There are four, and all four are in force in the versions that took effect on 1 June 2023:

The dealers’ guideline was published by Government Notice G.N. 3114 of 25 May 2023 and replaced the version introduced by G.N. 2428 of 28 April 2023.

The legal status of a guideline is set by section 7 of Cap. 615 and is frequently misread. Section 7(4): a failure to comply with a provision of a guideline does not by itself render a person liable to proceedings, but the guideline is admissible in evidence in any proceedings under the Ordinance before any court, and where a provision appears to the court to be relevant to a question arising in the proceedings, it must be taken into account in determining that question. Section 7(5): in considering whether a person has contravened a provision of Schedule 2, the regulator must have regard to any relevant provision of the guideline. Section 7(6): a guideline is not subsidiary legislation. In practice this means a guideline is not advisory. It is the standard against which conduct will be measured.

Section 7(5A) adds a further refinement: the guideline-making power does not affect the sole discretion of the Law Society to determine the content of Practice Direction P. For the legal profession, the content of the standard remains with the profession itself.

When the Obligations Switch On: Section 5A of Cap. 615

Section 5A is the switch for the whole regime. It provides that Schedule 2 applies to a DNFBP not continuously, but only when the person carries on one of a closed list of activities. An accountant, lawyer, agent or dealer whose work falls outside that list is outside Schedule 2, even though the person remains a DNFBP.

For accountants and lawyers, section 5A(3) applies a requirement only when, by way of business, in Hong Kong, the professional prepares for or carries out for a client a transaction concerning one or more of seven subject matters:

1.        the buying or selling of real estate;

2.        the managing of client money, securities or other assets;

3.        the management of bank, savings or securities accounts;

4.        the organization of contributions for the creation, operation or management of corporations;

5.        the creation, operation or management of legal persons or legal arrangements;

6.        the buying or selling of business entities;

7.        a service specified in the definition of trust or company service in section 1 of Part 1 of Schedule 1.

The list mirrors FATF Recommendation 22. Outside it there is no Schedule 2 obligation. Tax advice, taken on its own, does not appear; nor does the audit of financial statements. This is often unexpected: an auditor carrying out the statutory audit of a Hong Kong company is not brought within Schedule 2 on that basis alone, unless the audit is accompanied by one of the seven activities.

For estate agents, section 5A(4) applies a requirement only when the agent is involved, in Hong Kong, in a transaction concerning the buying or selling of real estate for a client (client as defined by section 2(1) of Cap. 511). Leasing and letting are not mentioned in section 5A(4). An agent working exclusively in residential lettings carries no Schedule 2 obligation under the AMLO — while remaining fully subject to Cap. 511 and to the reporting duties under Cap. 405 and Cap. 455.

For Category B precious metals and stones registrants, section 5A(5A) applies a requirement only when, by way of business, in Hong Kong and with a customer, the registrant carries out a specified cash transaction that is not an excluded transaction. A specified cash transaction is one in respect of which payments in cash totalling at least HK$120,000 (Schedule 3H) are made or received in Hong Kong, whether in a single operation or in several linked or apparently linked operations. Section 5A(5B) defines an excluded transaction as one where the cash payments are made exclusively by one Category B registrant to another and those two registrants are the only parties.

The consequence is worth stating plainly: a non-cash transaction of any size does not switch on Schedule 2 for a dealer. A wholesale sale of diamonds for HK$50,000,000 settled by bank transfer creates no AMLO customer due diligence obligation. It does create a registration obligation — but that is a different provision, section 53ZUE, discussed below.

Section 5A(6) disposes of a common question, but only for subsections (3), (4) and (5): for their purposes it is immaterial whether the subject matter of the transaction is in Hong Kong or elsewhere. A Hong Kong solicitor handling the purchase of a property in London falls squarely within section 5A(3)(a). Section 5A(6) does not extend to the dealer trigger in subsection (5A), where the cash transaction must be carried out in Hong Kong.

Section 5A of Cap. 615 — when Schedule 2 obligations switch on, by DNFBP category.

The Supervisors: Why “Regulatory Body” and “Relevant Authority” Are Not the Same

Cap. 615 uses two different terms for a supervisor, and the difference determines what powers are available.

A relevant authority is a supervisor holding the full range of statutory powers. It inspects under Part 3, appoints investigators, takes disciplinary action and imposes pecuniary penalties under Part 4 or under the relevant Part of the Ordinance, and its decisions are reviewable by the Anti-Money Laundering and Counter-Terrorist Financing Review Tribunal. The list in Schedule 1 Part 2 is closed: the Monetary Authority (for authorized institutions, SVF licensees and stablecoin licensees), the Securities and Futures Commission (for licensed corporations and for licensed VAS providers and their associated entities), the Insurance Authority, the Commissioner of Customs and Excise (for money service operators, the Postmaster General and precious metals and stones registrants) and the Registrar of Companies (for TCSP licensees).

A regulatory body is a narrower concept. It is defined for three categories only:

Within Cap. 615 a regulatory body’s powers are confined to the following: immunity from civil liability (section 4(1A)); publishing guidelines (section 7); giving written notice of a high-risk situation (section 15 of Schedule 2); requiring records to be kept beyond the statutory period (section 20(4) of Schedule 2); receiving notification that procedures cannot be applied in an overseas branch (section 22(2B) of Schedule 2); recognizing another reliable and independent source for identity verification (sections 2(1)(ab)(iv) and 2(1)(d)(ia)(D) of Schedule 2); and recognizing a digital identification system (the definition of recognized digital identification system in section 1(1) of Schedule 2). None of them amounts to a power of entry, investigation or sanction.

The proposition is easy to verify. Part 3 of Cap. 615, which contains the powers to enter premises, inspect records and appoint investigators, operates on the concept of a prescribed person, and the definition in section 8 lists an authorized institution, a licensed corporation, an authorized insurer, insurance agents and brokers, a licensed money service operator, the Postmaster General, an SVF licensee, a TCSP licensee, a PMS registrant, a stablecoin licensee and a licensed VAS provider. Accountants, lawyers and estate agents do not appear. The phrase “regulatory body” appears nowhere in Part 3.

The practical conclusion, rarely stated directly, is this: inspections of accountants, lawyers and estate agents are conducted under their own Ordinances, not under Cap. 615. The AFRC acts under sections 20ZZC and 20ZZJ of Cap. 588 through a CPA inspector and a CPA investigator. The Estate Agents Authority acts under section 28 of Cap. 511 and may appoint as investigator either its own employee or a certified public accountant (practising). The Law Society acts through its Council and the Solicitors Disciplinary Tribunal under section 9A of Cap. 159.

The same split appears inside Schedule 2 itself. Under section 2(1)(a) a financial institution, a TCSP licensee and a Category B registrant may rely for identity verification on documents or data provided by, among others, the “relevant authority”; under section 2(1)(ab) an accountant, estate agent or lawyer must look instead to the “relevant regulatory body”. The drafting is parallel but the bodies are different, and internal compliance documents routinely confuse the two.

Finally, there is the question of appeal. The Anti-Money Laundering and Counter-Terrorist Financing Review Tribunal established by section 55 of Cap. 615 reviews “specified decisions”, and the list in section 54 covers decisions of the Monetary Authority, the SFC, the Insurance Authority, the Commissioner (for money service operators and under Part 5C) and the Registrar. Decisions of the AFRC, the Law Society and the Estate Agents Authority are not on that list. Each has its own route:

If you are planning a structure in which a Hong Kong company is administered by a licensed corporate secretary, it is worth establishing in advance which body supervises at each point in the chain. The related corporate obligations are covered in our article on the significant controllers register, and UPPERSETUP’s Hong Kong company services include preparing for inspections of this kind.

Customer Due Diligence: Four Measures and Four Trigger Events

Customer due diligence under section 2(1) of Schedule 2 consists of four measures, and all four bind a DNFBP.

The first is identifying the customer and verifying the customer’s identity on the basis of documents, data or information from a permitted source. For an accountant, estate agent or lawyer the permitted sources are listed in section 2(1)(ab): a governmental body; the relevant regulatory body; an authority outside Hong Kong performing functions similar to those of that regulatory body; a recognized digital identification system; or any other reliable and independent source recognized by the relevant regulatory body. For a Category B registrant the parallel provision is section 2(1)(a), where the reference is to the relevant authority — that is, the Commissioner of Customs and Excise.

The second is, where there is a beneficial owner, identifying that person and taking reasonable measures to verify their identity so that the DNFBP is satisfied it knows who the beneficial owner is; where the customer is a legal person or a trust, this includes measures enabling the DNFBP to understand the ownership and control structure. The beneficial ownership threshold in section 1(1) of Schedule 2 is more than 25% of issued share capital or voting rights, or the exercise of ultimate control over management. For a trust the beneficial owners are a beneficiary or class of beneficiaries with a vested interest, the settlor, the trustee (added by 15 of 2022), a protector or enforcer, and an individual with ultimate control over the trust.

The third is, where a business relationship is to be established, obtaining information on the purpose and intended nature of that relationship, unless the purpose and nature are obvious.

The fourth is, where a person purports to act on behalf of the customer, identifying that person, taking reasonable measures to verify their identity and verifying their authority to act. The last element is the one most often missed in practice: in the AFRC’s first AML disciplinary case of 5 March 2026, the failure to verify a representative’s authority was one of the three heads of misconduct.

The occasions on which customer due diligence must be carried out are set out in section 3(1) of Schedule 2:

Section 3(1)(c) was repealed by 15 of 2022 and must not be cited. It still appears in policies and training material prepared before 2022; a reference to it in a compliance manual is a clear sign that the document is out of date.

The HK$8,000 thresholds in Schedule 2 are addressed only to financial institutions and licensed virtual asset service providers. Section 3(1A) covers wire transfers and virtual asset transfers carried out by a financial institution; section 3(1B) covers occasional transactions of a licensed virtual asset service provider that are not wire transfers or virtual asset transfers. Neither provision applies to a DNFBP in any circumstances.

Verification may be deferred under section 3(2) only where this is necessary not to interrupt the normal conduct of business with the customer and where any money laundering or terrorist financing risk caused by the deferral is effectively managed; verification must then be completed as soon as reasonably practicable (section 3(3)).

The consequence of being unable to complete customer due diligence is strict and leaves no discretion. Under section 3(4) the DNFBP must not establish the business relationship or carry out the occasional transaction, and where a relationship already exists must terminate it as soon as reasonably practicable.

A separate rule governs pre-existing customers. A pre-existing customer for a DNFBP other than a Category B registrant is one with whom the business relationship was established before 1 March 2018; for a Category B registrant, before 1 April 2023. Under section 6(1) of Schedule 2 such customers are not reviewed on the commencement date but — in addition to the suspicion and doubt triggers in sections 3(1)(d) and (e) — on the occurrence of an event: a transaction unusual or suspicious by amount or nature, a transaction inconsistent with the DNFBP’s knowledge of the customer, the customer’s business or risk profile or the source of the customer’s funds, or a material change in the way the customer’s account is operated. Where due diligence cannot be carried out, the relationship must be terminated (section 6(2)).

Simplified Due Diligence, Enhanced Due Diligence and Politically Exposed Persons

Simplified due diligence is the reduced set of measures permitted by section 4 of Schedule 2; enhanced due diligence is the additional set required by sections 9, 10 and 15 of Schedule 2. Both routes are tightly prescribed.

Simplified due diligence under section 4 of Schedule 2 permits a DNFBP to carry out only the measures in sections 2(1)(a), (ab), (c) and (d) — that is, to omit the identification of the beneficial owner. The condition is that the DNFBP has reasonable grounds to believe that the customer falls within section 4(3):

•          a Hong Kong financial institution;

•          an institution incorporated or established in an “equivalent jurisdiction” that carries on a similar business, has measures in place to ensure compliance with similar requirements and is supervised for compliance with them;

•          a corporation listed on any stock exchange;

•          an investment vehicle where investor-level due diligence is performed by a qualifying person;

•          the Government of Hong Kong or a Hong Kong public body;

•          the government of an equivalent jurisdiction, or a body there performing functions similar to those of a public body.

An equivalent jurisdiction is defined in section 1(1) of Schedule 2 as a jurisdiction that is a member of the Financial Action Task Force, other than Hong Kong, or a jurisdiction that imposes requirements similar to those imposed under Schedule 2. The second limb is available, but the burden of justifying it rests on the DNFBP.

Section 4(2) adds an important qualification: where a customer who does not itself fall within section 4(3) has in its beneficial ownership chain an entity that does, there is no requirement to identify beneficial owners beyond that entity. This is the only lawful stopping point when tracing an ownership chain.

Enhanced due diligence is mandatory in three situations.

The first is where the customer has not been physically present for identification purposes (section 9 of Schedule 2). At least one of three measures must then be carried out: further verifying identity on the basis of documents or data not previously used for verification; taking supplementary measures to verify information already obtained; or ensuring that the first payment is made through an account in the customer’s name with an authorized institution in Hong Kong or an equivalent institution in an equivalent jurisdiction. Section 9(2), added by 15 of 2022, disapplies the requirement where identity was verified using data from a recognized digital identification system.

The second is where the customer or a beneficial owner is a politically exposed person (section 10 of Schedule 2). Before establishing the relationship, senior management approval is required together with reasonable measures to establish the source of wealth and the source of funds. Where the status emerges in respect of an existing customer, the relationship may not continue without those same two steps.

A politically exposed person under section 1(1) of Schedule 2 is an individual who is or has been entrusted with a prominent public function in a place outside Hong Kong, including a head of state, head of government, senior politician, senior government, judicial or military official, senior executive of a state-owned corporation and an important political party official, but excluding middle-ranking or junior officials; together with a spouse, partner, child or parent of such a person, the spouse or partner of such a person’s child, and a close associate.

Note the boundary: the statutory definition is confined to prominent public functions outside Hong Kong. Domestic politically exposed persons are not within it. The sector guidelines, however, introduced a separate domestic category after 15 of 2022 on a risk-based footing, and in the Prism Hong Kong Limited case of 5 March 2026 the AFRC’s charge against the firm was precisely a failure to carry out a risk assessment in respect of identified domestic politically exposed persons. It is a clear illustration of how section 7(4) of Cap. 615 converts a guideline into the operative standard.

A former politically exposed person is a concept added by 15 of 2022: an individual who, being a politically exposed person, has been but is not currently entrusted with a prominent public function outside Hong Kong, together with connected persons. Under section 10(3) the enhanced measures do not apply where the DNFBP is satisfied that the person is a former politically exposed person and does not present a high risk based on an appropriate risk assessment.

The third situation is other high-risk circumstances (section 15 of Schedule 2). These arise in two ways: by written notice given to the DNFBP by the relevant regulatory body (for the three professions) or the relevant authority; or self-identified, “in any other situation that by its nature may present a high risk”. The second route has no list and demands the firm’s own risk assessment. The measures differ by limb. For a new business relationship, senior management approval plus either establishing the source of wealth and funds or taking additional risk-mitigating measures (paragraph (a)). For an existing relationship, the same plus reasonable measures to verify the beneficial owner’s identity (paragraph (b)). For an occasional transaction, additional risk-mitigating measures only, with no senior management approval (paragraph (c)).

A recognized digital identification system is defined separately for two groups in section 1(1) of Schedule 2: for financial institutions, TCSP licensees and Category B registrants it is a system recognized by the relevant authority; for accountants, estate agents and lawyers, one recognized by the relevant regulatory body. The Estate Agents Authority has expressly recognized “iAM Smart” as such a system, in its Questions and Answers to Practice Circular No. 23-01(CR), for the purposes of paragraph 4.16(d) of its guidelines.

Monitoring, Internal Procedures, Record-Keeping and Section 23

Beyond customer due diligence, Schedule 2 imposes three further obligations on a DNFBP: continuous monitoring under section 5, internal procedures under section 19, and record-keeping under sections 20 to 22, all backed by the general duty in section 23. Customer due diligence is only the entry point; the remaining parts of Schedule 2 generate most of the findings in practice.

Continuous monitoring of business relationships is required by section 5(1) of Schedule 2 and has three elements: reviewing from time to time the documents, data and information relating to the customer to ensure they remain up to date and relevant; conducting appropriate scrutiny of transactions carried out for the customer to ensure consistency with the DNFBP’s knowledge of the customer, the customer’s business and risk profile, and the source of the customer’s funds; and identifying transactions that are both complex, unusually large in amount or of an unusual pattern and without apparent economic or lawful purpose, examining their background and purposes and setting out the findings in writing.

The written-findings requirement is often overlooked. An analysis performed orally does not satisfy section 5(1)(c), and cannot be demonstrated at inspection.

Section 5(3) adds additional measures in three situations — the customer was not physically present, the customer or beneficial owner is a politically exposed person, or the customer is involved in a section 15 situation. Sections 5(4) and 5(5) contain the now-familiar carve-outs for digital identification and for former politically exposed persons.

Internal procedures are required by section 19 of Schedule 2. Two limbs matter for a DNFBP. Section 19(1): establish and maintain effective procedures for determining whether a customer or a beneficial owner is a politically exposed person. Section 19(3): in respect of each kind of customer, business relationship, product and transaction, establish and maintain effective procedures, not inconsistent with the Ordinance, for the purpose of carrying out the duties under sections 3, 4, 5, 9, 10 and 15 of Schedule 2.

“Each kind” means that a single two-page document describing the review of a generic customer does not meet the requirement. The absence of foundational policies and procedures was precisely the basis of the AFRC’s sanctions against Wong Ka Chun and Danny Ho & Company on 5 March 2026.

Reliance on an intermediary. Section 18 of Schedule 2 permits any customer due diligence measure to be carried out through an intermediary drawn from the list in section 18(3), which includes an accounting professional, an estate agent, a legal professional and a TCSP licensee — each of whom must satisfy the DNFBP that they have adequate procedures in place to prevent money laundering and terrorist financing — together with Hong Kong financial institutions and the corresponding professions in equivalent jurisdictions. The conditions in section 18(1) are that the intermediary consents in writing to act as such, and that the DNFBP is satisfied the intermediary will on request provide without delay a copy of any document, or a record of any data or information, obtained in carrying out the measure. Section 18(4) adds a duty to obtain the data or information from the intermediary immediately after the measure is carried out, and to ensure that the intermediary will supply copies on request within the retention periods in sections 20(2) and 20(3). Section 18(2) disposes of the main misconception: a DNFBP that uses an intermediary remains liable under the Ordinance for a failure to carry out that measure. Section 18(6) applies the same rule where the measure is carried out by an agent.

Record-keeping sits in Part 3 of Schedule 2:

The manner of keeping is set by section 21: a document must be kept either in the original or as a copy on microfilm or in a computer database; data and information must be kept on microfilm or in a computer database. The wording is technologically dated but still in force. The Estate Agents Authority confirmed in its guidance of 22 May 2026 that business correspondence for record-keeping purposes includes email and WhatsApp messages, and that a record held only in a licensee’s mind is not a record — it must be capable of being reproduced in a legible form.

For law firms, Practice Direction P sets its own longer periods above the statutory five-year floor: conveyancing 15 years, tenancy 7 years, other non-criminal matters 7 years, and criminal cases 5 years from the expiry of the appeal period.

Section 23 of Schedule 2 is the shortest and the most dangerous provision in the regime. It requires a DNFBP to take all reasonable measures to ensure that proper safeguards exist to prevent a contravention of any requirement under Part 2 or Part 3 of Schedule 2, and to mitigate money laundering and terrorist financing risks.

What makes section 23 distinctive is that it prescribes no particular act. It converts any systemic gap — no designated compliance officer, no training, no sanctions screening process — into a free-standing contravention, even where no individual customer was reviewed incorrectly. For regulators it is the catch-all ground of charge.

One practical conclusion runs through sections 19, 20 and 23: compliance here is measured not by intention but by the existence of dated documents that can be produced to an inspector for any period in the last five years. Where that function is not worth keeping in-house, it is delegated to a licensed provider — which is what UPPERSETUP’s Hong Kong corporate services exist to do.

Finally, section 22(2A) of Schedule 2 extends the obligations to a DNFBP’s operations abroad: a DNFBP incorporated in Hong Kong or that is a re-domiciled entity must ensure that its overseas branches and subsidiary undertakings carrying on the same business have procedures in place to comply with requirements similar to Parts 2 and 3 of Schedule 2, to the extent permitted by local law. Where local law does not permit this, the relevant authority or, if applicable, the relevant regulatory body must be informed and additional risk-mitigating measures taken (section 22(2B)).

Suspicious Transaction Reporting: The Layer That Is Not in Cap. 615

The duty to report a suspicious transaction in Hong Kong arises under section 25A of Cap. 405, section 25A of Cap. 455 and section 12 of Cap. 575 — not under Cap. 615. The most common misconception about the DNFBP regime is that the duty comes from the AMLO. It does not. There is no provision in Cap. 615 requiring anyone to file a suspicious transaction report. The duty sits in three other Ordinances and is addressed not to DNFBPs but to every person.

The timing in Cap. 405 and Cap. 455 is “as soon as it is reasonable for him to do so”; in Cap. 575 it is as soon as practicable after the information comes to the person’s attention.

The substantive offence is considerably more serious. Under section 25(1) of Cap. 405 and section 25(1) of Cap. 455 a person commits an offence if, knowing or having reasonable grounds to believe that property in whole or in part, directly or indirectly, represents any person’s proceeds of drug trafficking or of an indictable offence, that person deals with the property. The “reasonable grounds to believe” standard sets a materially lower bar than actual knowledge, and it is objective. The penalty under section 25(3) is identical in both Ordinances:

•          on conviction on indictment, a fine of HK$5,000,000 and imprisonment for 14 years;

•          on summary conviction, a fine of HK$500,000 and imprisonment for 3 years.

It is this offence, and not Schedule 2 of the AMLO, that represents the principal personal exposure of an accountant, lawyer or agent.

Filing a report also protects the person who files it. Under section 25A(2) of Cap. 405 and Cap. 455, a person who has made a disclosure does not commit an offence under section 25(1) in respect of the relevant act if the disclosure was made before the act and the act was done with the consent of an authorized officer, or if the disclosure was made after the act, on the person’s own initiative and as soon as it was reasonable to make it. Section 25(2) gives a further defence to a person who intended to disclose and had reasonable excuse for not doing so.

Section 25A(3) removes the civil risk: a disclosure is not to be treated as a breach of any restriction on the disclosure of information imposed by contract, enactment, rule of conduct or other provision, and does not render the person liable in damages for any loss arising out of the disclosure or out of anything done or omitted in relation to the property in consequence of it.

Tipping off is a separate offence. Under section 25A(5) of Cap. 405 and Cap. 455 a person commits an offence if, knowing or suspecting that a disclosure has been made, that person discloses to any other person any matter likely to prejudice an investigation that might be conducted following that disclosure. The penalty under section 25A(8) is a fine of HK$500,000 and 3 years’ imprisonment on indictment, and a level 6 fine (HK$100,000) and 1 year on summary conviction. Section 12(5) of Cap. 575 contains an equivalent prohibition, with the penalty in section 14(6).

Section 25A(6) provides two defences: that the person did not know or suspect the disclosure was likely to be prejudicial in that way, or that the person had lawful authority or reasonable excuse for making it.

Legal professional privilege. Section 81 of Cap. 615 preserves any claims, rights or entitlements that would arise on the ground of legal professional privilege apart from the Ordinance. There is one carve-out: this does not affect any requirement made under the Ordinance to disclose the name and address of a client of a legal practitioner, whether or not that practitioner is qualified in Hong Kong as counsel or as a solicitor. Privilege therefore protects the content of legal advice, but not the fact or the particulars of the client relationship.

The figures for the sector are as follows. In 2025 the Joint Financial Intelligence Unit received 190,636 reports. Legal professionals filed 962, estate agencies 161, dealers in precious metals and stones 27, and accounting professionals 16. The four non-TCSP DNFBP categories together produced 1,166 reports, or 0.61% of the total. Banks filed 164,844, or 86.47%. For 2026, the JFIU had received 138,491 reports as at 31 August.

For the accounting profession, the HKICPA issued revised “Frequently asked questions on Suspicious transaction reporting” in May 2026, prepared with the AFRC and with input from the JFIU. The document states expressly that it does not constitute legal advice and does not form part of the Guidelines on Anti-Money Laundering and Counter-Terrorist Financing for Professional Accountants, but recommends that members review their policies in light of its contents.

Dealers in Precious Metals and Stones: Part 5C and the Two Registration Categories

Part 5C of Cap. 615 creates two registration categories for dealers in precious metals and stones: Category A, which may carry out a specified transaction only, and Category B, which may also carry out a specified cash transaction and is therefore a DNFBP. The dealers’ regime is built on a different principle from that of the three professions: it rests on compulsory registration, it is run by the Customs and Excise Department, and the sanctions remain inside Cap. 615.

Dealing in precious metals and stones is defined by section 53ZU(1) as carrying on, by way of business, any of four groups of activity: trading in, importing or exporting precious metals, precious stones or precious products; manufacturing, refining or carrying out any value-adding work on them; issuing, redeeming or trading in precious-asset-backed instruments; and acting as an intermediary in respect of any of those. Section 53ZU(2) carves out a logistics service business where the import or export occurs in the ordinary course of that business.

The subject matter is defined by closed lists. A precious metal is gold, silver, platinum, iridium, osmium, palladium, rhodium or ruthenium, in a manufactured or unmanufactured state. A precious stone is a diamond, sapphire, ruby, emerald, jade or pearl, whether natural or otherwise. A precious product is any jewellery or watch made up of, containing or having attached to it any precious metal or precious stone.

Section 53ZUA(1) provides that Part 5C does not apply to the Government, an authorized institution or a pawnbroker licensed under the Pawnbrokers Ordinance (Cap. 166). It likewise does not apply to a licensed corporation whose precious metals business is ancillary to a regulated activity for which it is licensed under the Securities and Futures Ordinance (Cap. 571), or to an authorized insurer, licensed insurance broker company, insurance agent, SVF licensee, or system operator or settlement institution of a designated retail payment system, where the precious metals business is ancillary to its principal business.

The two registration categories differ on a single point: cash.

Both thresholds are HK$120,000: Schedule 3H sets the figure for a specified cash transaction and Schedule 3I for a specified transaction. Each is measured in total across a single operation or several linked or apparently linked operations.

Section 53ZUE contains four prohibitions and an offence. No person other than a registrant may carry out a specified transaction in Hong Kong (subsection (1)). No person other than a Category B registrant may carry out a specified cash transaction (subsection (2)). A person who is not a registrant must not claim to be, or hold himself or herself out as, a registrant, or as authorized to carry out a specified transaction (subsection (3)). A person who is not a Category B registrant — including a Category A registrant — must not claim to be, or hold himself or herself out as, a Category B registrant, or as authorized to carry out a specified cash transaction (subsection (4)). Contravention of any of the four prohibitions is an offence carrying a level 6 fine (HK$100,000) and imprisonment for up to 6 months; the magistrate may additionally disqualify the convicted person from registration for a specified period.

The fit and proper test for Category B in section 53ZUN(2) requires the Commissioner to have regard, among other things, to convictions under the listed provisions of Cap. 615, under section 14 of Cap. 575, under sections 25(1) and 25A(5) or (7) of Cap. 405 and Cap. 455 or of offences specified in the Schedules to those Ordinances. The Commissioner must also have regard to overseas convictions for equivalent acts, for money laundering or terrorist financing, or for offences requiring a finding that the person acted fraudulently, corruptly or dishonestly; to failure to comply with a requirement imposed under the Ordinance; to undischarged bankruptcy in the case of an individual; and to liquidation or receivership in the case of a corporation.

The fees are set by Schedule 3K:

Schedule 3K to Cap. 615 — registration fees for dealers in precious metals and stones.

A renewal application must be made at least 60 days before the registration is due to expire (section 53ZUQ(2)). Where the registration expires before the application is determined, the registration remains in force until it is renewed or until a decision not to renew takes effect. A renewed registration runs for three years, or for any other period the Commissioner determines (section 53ZUQ(7)).

Transitional arrangements sit in section 53ZW. A person who immediately before 1 April 2023 was carrying on a precious metals and stones business and held a valid business registration certificate for that purpose is deemed to be a Category B registrant with effect from 1 April 2023. The transitional period is nine months beginning on 1 April 2023, ending on 31 December 2023.

A separate duty applies to foreign dealers. A non-Hong Kong precious metals and stones dealer is a person who does not ordinarily reside in Hong Kong, or is incorporated or established outside Hong Kong and is neither a registered non-Hong Kong company nor a re-domiciled company; has no place of business in Hong Kong; and carries on a precious metals and stones business in Hong Kong on no more than 60 days in a calendar year. Such a person does not register, but under section 53ZVK must give the Commissioner a cash transaction report for every specified cash transaction, as soon as practicable and in any event before the earlier of the expiry of one day after the transaction and the earliest time a specified individual leaves Hong Kong. The contents are set by Schedule 3J. Failure to comply without reasonable excuse carries a level 5 fine (HK$50,000) and 3 months’ imprisonment.

The Government Estimates for Head 031 show the scale of registration. Category A registrations approved: 3,460 in 2023, 4,291 in 2024, 1,674 in 2025 and 1,680 estimated for 2026. Category B registrations approved or renewed: 350 in 2023, 385 in 2024, 22 in 2025 and 330 estimated for 2026. The increase in the Category B estimate for 2026 is consistent with the first cohort of three-year registrations granted in 2023 falling due for renewal, although the Estimates state no reason.

Liability: Why Cap. 615 Creates No Offence for a DNFBP, and What Is Actually at Risk

Whether a DNFBP can be prosecuted or fined under Cap. 615 is the central analytical question of the regime, and the statutory text answers it directly. A DNFBP that contravenes Schedule 2 commits no offence under Cap. 615 and faces no pecuniary penalty under Part 4 of Cap. 615; the exposure is disciplinary, under each regulator’s own Ordinance.

Section 5(5) of Cap. 615 provides: “If a financial institution knowingly contravenes a specified provision, the financial institution commits an offence…”. The offence can be committed only by a financial institution. Sections 5(6), 5(7) and 5(8) are framed the same way and are addressed to a financial institution or its employees. The penalties are up to HK$1,000,000 and 2 years’ imprisonment for a knowing contravention, and up to HK$1,000,000 and 7 years where there is intent to defraud a relevant authority.

Section 5A, which extends Schedule 2 to DNFBPs, creates no offence at all. The words “commits an offence” appear nowhere in section 5A.

Section 21 of Cap. 615, which confers the power to order a pecuniary penalty of the greater of HK$10,000,000 or three times the profit gained or costs avoided, states in section 21(1): “… if a financial institution contravenes a specified provision [as defined by section 5(11)], the relevant authority may exercise…”. A DNFBP is not named.

It follows that for an accountant, a lawyer, an estate agent and a Category B registrant, a contravention of Schedule 2 is neither an offence under Cap. 615 nor a basis for a pecuniary penalty under Part 4 of Cap. 615. The frequently quoted “HK$1,000,000 and 2 years” has no application to these persons in any circumstances. Liability is disciplinary and is administered by each regulator under its own Ordinance — except for the Category B registrant, for whom the legislature built the disciplinary machinery directly into Part 5C.

Accountants: A Chain of Three Provisions in Cap. 588

A failure to comply with an AML/CTF requirement is a professional irregularity under section 3B(1)(d) of Cap. 588. A professional irregularity is CPA misconduct under section 37AA(1)(a). For CPA misconduct the AFRC may impose sanctions under section 37CA(2):

•          a public or private reprimand;

•          a pecuniary penalty of up to HK$500,000 payable to the AFRC (subject to section 37H);

•          an order to pay the costs and expenses of the investigation;

•          revocation of registration, or suspension for a period or until an event;

•          cancellation of the practising certificate;

•          an order that no practising certificate be issued, permanently or for a period.

Section 3B(2)(d) separately catches a director of a corporate practice who causes or allows a breach of an AML/CTF requirement by the practice, or fails to take reasonable steps to prevent one. That is the route by which the managing director in the Danny Ho & Company matter received a personal penalty.

The exercise of the penalty power is governed by the AFRC’s “Guidelines for Exercising the Power to Impose a Pecuniary Penalty for Professional Persons”, made under sections 13 and 37H of Cap. 588 and in force since 7 October 2022.

Lawyers: A Mandatory Referral to the Tribunal Convenor

Section 9A(1AA) of Cap. 159 is drafted more tightly than an ordinary disciplinary provision. Where the Council of the Law Society considers that conduct involves an alleged breach within subparagraph (1AAB)(a) — a failure by a solicitor or foreign lawyer to comply with an AML/CTF requirement — and that the conduct should be inquired into or investigated, the Council must submit the matter to the Tribunal Convenor. The Council has no discretion at that point.

Section 9A(1AAC) obliges the Council to take Practice Direction P into account when deciding whether conduct falls within subparagraph (1AA)(a) or (b).

The powers of a Solicitors Disciplinary Tribunal under section 10(2) of Cap. 159 are:

•          an order striking the solicitor’s name off the roll;

•          suspension from practice for such period as the tribunal thinks fit;

•          permission to continue in practice subject to conditions for up to 3 years;

•          payment to the complainant of an amount not exceeding the fees and disbursements paid;

•          a penalty of up to HK$500,000 paid into the general revenue (subparagraph (c) for a solicitor, subparagraph (l) for a foreign lawyer);

•          censure;

•          costs on a full indemnity basis;

•          cancellation or suspension of a foreign lawyer’s registration.

Section 9AB of Cap. 159 provides a separate summary route, but it operates on the discretionary referral under section 9A(1A), not on the mandatory AML referral under section 9A(1AA): where the person admits liability for a breach of a provision, practice direction or principle of professional conduct prescribed in rules made by the Council, and agrees to that disposal, the Tribunal Convenor disposes of the matter alone by ordering payment of the fixed penalty and the Council’s fixed investigation costs prescribed in those rules.

Estate Agents: Three Provisions of Cap. 511

Section 27(2)(h): the Estate Agents Authority may suspend or revoke a licence where the licensee has contravened or failed to comply with an AML/CTF requirement. Section 28: where the Authority has reason to believe that an AML/CTF requirement may not have been complied with, it may appoint an investigator, either an employee of the Authority or a certified public accountant (practising). Section 29(1)(e): a complaint of failure to comply with an AML/CTF requirement is dealt with by the Authority or referred to a disciplinary committee.

The powers under section 30(1) are:

•          to admonish or reprimand the licensee;

•          to attach specified conditions to the licence;

•          to vary any condition already attached;

•          to suspend the licence for a specified period not exceeding 2 years;

•          to revoke the licence;

•          to impose a fine not exceeding HK$300,000;

•          to make an order as to costs.

Section 30(3) provides a defence not available to the other categories: the power may not be exercised where the licensee shows that they took all reasonable steps and exercised all due diligence to avoid the non-compliance.

Category B Dealers: Machinery Inside Cap. 615

Section 53ZVF(2)(a)(i) names as a ground a contravention of a requirement set out in Schedule 2 that applies to a DNFBP who is a Category B registrant. The powers in section 53ZVF(3) are a public reprimand, an order to take remedial action by a specified compliance deadline, and an order to pay a pecuniary penalty not exceeding HK$500,000. Where the remedial order is not complied with, a further daily penalty of up to HK$10,000 per day may be ordered (section 53ZVF(4)). Section 53ZVJ extends the same powers to a director of a corporate registrant who caused or allowed the contravention or failed to take reasonable steps to prevent it.

For a Category A registrant, section 53ZVE permits only a public reprimand and a remedial order — there is no pecuniary penalty. The grounds are a contravention of a regulation made under section 53ZVS, a contravention of a registration condition, and a contravention of sections 53ZV, 53ZVA or 53ZVB (display of the certificate of registration, notification of changes of particulars, notification of intended cessation) — not a contravention of Schedule 2.

Ceilings at a Glance

Enforcement in Numbers: What the Regulators Actually Do

Enforcement against non-TCSP DNFBPs is concentrated in two regulators: the Estate Agents Authority, which carried out 1,284 AML/CTF compliance inspections in 2024/25, and the AFRC, which took its first AML disciplinary actions on 5 March 2026. The statute sets ceilings; what the regulators actually impose falls well short of them, and the four sectors diverge sharply.

Accountants. The AFRC became the regulator of the profession on 1 October 2022. The AFRC took the first AML disciplinary actions in its history on 5 March 2026, against three practice units and a director of one of them in a single set of actions:

The heads of misconduct against Prism Hong Kong Limited were a failure to perform mandatory risk assessments, including in respect of identified domestic politically exposed persons; a failure to verify a person’s authority to act on behalf of a client before engagement acceptance; and a failure to carry out sanctions screening against United Nations Security Council lists. The AML/CTF Compliance Monitoring Inspection ran from 2 November 2023 to 8 July 2024 and covered the period from 1 July 2022 to 31 August 2023. The penalty was reduced by 25% for cooperation, early admission of liability and voluntary remediation. Against Danny Ho & Company and Wong Ka Chun the charge was the complete absence of foundational AML/CTF policies, procedures and controls.

The scale of supervision: the AFRC conducted 51 AML inspections in 2024 and 50 in 2025, more than 140 in total since 2023. The proportion of inspected firms with at least one customer due diligence finding was 40% in 2024 and 41% in 2025. For 2024, sanctions screening findings affected 36% of inspected firms, staff training findings 25% and findings on policies, procedures and controls 8%.

In the inaugural Annual Enforcement Report published on 14 July 2026, the AFRC described the failures in these cases as reflecting “systemic firm-level weaknesses, including failures to tailor AML/CTF controls to risk profiles and to ensure that staff were adequately trained and equipped to discharge AML/CTF responsibilities”.

The most telling figure in the AFRC’s Annual Inspection Report for 2024/25 is this. In 2024 the Joint Financial Intelligence Unit received 11 suspicious transaction reports from the accounting profession, the fewest of any sector. In 2025, according to the JFIU, the figure was 16.

Lawyers. The Law Society does not run AML on-site inspections. Its supervisory instrument is a compulsory annual self-assessment. Circular 26-1 (SD) of 2 January 2026 launched the first AML/CTF Compliance Self-Assessment Form: completion and online submission are mandatory for all law firms in Hong Kong, the assessment period ran from 1 January to 31 December 2025, the submission window from 5 January to 2 March 2026, and non-compliance “may be treated as professional misconduct”. The Law Society reports a 100% submission rate.

At the same time, no published decision of a Solicitors Disciplinary Tribunal founded on a breach of AML/CTF requirements or of Practice Direction P could be identified in the Law Society’s public register of decisions as at 14 September 2026. The mandatory referral under section 9A(1AA) of Cap. 159 has existed since 2018 and the penalty ceiling is HK$500,000. Eight years of mandatory referrals have produced no published outcome.

Estate agents. The Estate Agents Authority, by contrast, inspects in volume: 1,186 AML/CTF compliance inspections in 2023/24 and 1,284 in 2024/25, out of 4,577 compliance inspections of all kinds in 2024/25. In 2024/25 disciplinary action was taken against 314 licensees: 193 reprimands or admonishments, 157 cases in which conditions were attached to a licence, 145 fines totalling HK$6,008,120, 14 suspensions and 56 revocations. The Authority does not publish a breakdown by type of breach, so the AML share of those figures cannot be established from public sources.

Precious metals dealers. The Customs and Excise Department pursues criminal enforcement against unregistered persons rather than supervisory action against registrants. The largest recorded outcome came on 19 September 2025, when a local company was fined a total of HK$562,000 for carrying out specified transactions without registration — described by the Customs and Excise Department as the highest on record among similar cases. The figure exceeds the HK$100,000 statutory maximum in section 53ZUE because it aggregates multiple counts. No published public reprimand or pecuniary penalty against a registered dealer under Part 5C could be identified in the Customs and Excise Department’s published enforcement material as at 14 September 2026.

The international assessment. In the FATF and APG mutual evaluation report of 4 September 2019, Hong Kong was rated Partially Compliant on Recommendation 22 (customer due diligence for DNFBPs), Largely Compliant on Recommendation 23, and Partially Compliant on Recommendation 28 (regulation and supervision of DNFBPs). In the first regular follow-up report and technical compliance re-rating of February 2023, Recommendation 28 was upgraded to Largely Compliant, while Recommendation 15 was downgraded from Largely Compliant to Partially Compliant. Recommendation 22 has never been re-rated and has stood at Partially Compliant for seven years. Effectiveness on Immediate Outcome 4 (preventive measures) is rated moderate. On the FATF Global Assessment Calendar as updated in June 2026, Hong Kong’s next mutual evaluation under the 2022 Methodology is provisionally scheduled for an on-site visit in November 2029 and a plenary discussion in June 2030.

The national risk assessment. The Hong Kong Money Laundering and Terrorist Financing Risk Assessment Report published in July 2022 remains the latest edition. Its conclusions for the sectors in question:

The dealers’ assessment predates Part 5C and is expressly tied to the fact that, when the report was written, statutory preventive measures had not yet been imposed on the sector.

A Step-by-Step Route to Compliance

Bringing a DNFBP practice into compliance with Schedule 2 takes thirteen steps, from establishing DNFBP status to verifying a dealer’s registration category. The sequence below assumes an existing practice or firm whose compliance must be brought to a standard that will withstand an inspection.

Step 1. Establish status. Determine whether the person falls within the closed DNFBP list in Schedule 1 Part 2 of Cap. 615. For an accountant, check registration in the AFRC registers as a CPA (practising), a CPA firm or a corporate practice. For a lawyer, check the practising certificate or registration as a foreign lawyer with the Law Society. For an agent, check the current licence under Cap. 511. For a dealer, check the registration category in the Commissioner’s register. A negative answer closes the Schedule 2 question but not the Cap. 405, Cap. 455 and Cap. 575 questions.

Step 2. Establish the trigger. List the services actually provided and map them against the applicable limb of section 5A: the seven transaction types in section 5A(3) for an accountant or lawyer; the buying and selling of real estate in section 5A(4) for an agent; the specified cash transaction of HK$120,000 or more in section 5A(5A) for a dealer. The output of this step is a written table listing each service, whether it falls inside or outside section 5A, and the provision relied on.

Step 3. Carry out a practice-level risk assessment. Document the risks arising from the client base, geography, products and services, delivery channels and transaction types. The document must be dated, approved and periodically reviewed. Its absence can itself found a charge under section 23 of Schedule 2 and the applicable guideline, and was the first head of charge in the AFRC’s case against Prism Hong Kong Limited.

Step 4. Appoint the responsible individuals. Designate a member of staff of sufficient seniority to be responsible for compliance, and another to be responsible for suspicious transaction reporting. The Ordinance imposes no express requirement, but the AFRC’s Annual Inspection Report for 2025/26 records a finding that firms had failed to appoint a sufficiently senior member of staff to these roles.

Step 5. Write procedures for each kind of customer and transaction. Section 19(3) of Schedule 2 requires effective procedures in respect of each kind of customer, business relationship, product and transaction for the purposes of sections 3, 4, 5, 9, 10 and 15. Section 19(1) requires a separate procedure for determining politically exposed person status.

Step 6. Build the identification process. Record in writing which sources are permitted under section 2(1)(ab) or 2(1)(a) of Schedule 2, the form in which customer information is recorded, the method for establishing beneficial ownership at the more-than-25% threshold, and the method for verifying a representative’s authority. For estate agents, the Estate Agents Authority provides Annex A and Annex B forms to Practice Circular No. 23-01(CR).

Step 7. Implement sanctions screening. Screen customers and beneficial owners against the current United Nations Security Council lists and the regimes applied in Hong Kong under the United Nations Sanctions Ordinance (Cap. 537) and Cap. 575. Screening must be timely and documented: the AFRC records findings in this area for 36% of inspected firms.

Step 8. Configure retention. Apply the five-year floors in section 20 of Schedule 2, the manner of keeping prescribed by section 21 and, for law firms, the longer periods in Practice Direction P. Email and messaging platforms carrying business correspondence with a client fall within the scope of retention.

Step 9. Train staff and document the training. Training findings affected 25% of firms inspected by the AFRC. Paragraph 33 of Practice Direction P requires ongoing training on the recognition, reporting and handling of suspicious transactions and on changes in the legislation.

Step 10. Build the reporting route. Put in place an internal escalation process, an internal report form, the channel to the Joint Financial Intelligence Unit and a prohibition on disclosing that a report has been made. The Joint Financial Intelligence Unit states that, upon the launch of STREAMS 2, regulated entities may no longer submit reports by email, fax or post: submission is electronic through STREAMS 2 only — by XML upload, by uploading a completed report in the prescribed PDF format, or through the web form, with a Hong Kong Post e-cert required for the first two routes.

Step 11. Check the overseas network. Where the practice is incorporated in Hong Kong or is a re-domiciled entity and has overseas branches or subsidiary undertakings carrying on the same business, put similar procedures in place under section 22(2A) of Schedule 2 and prepare the notification for cases where local law does not permit them.

Step 12. Run an internal review before the inspection. Reconcile the documentation against the relevant paragraphs of the current sector guideline. Sections 7(4) and 7(5) of Cap. 615 govern the weight of the guideline: the regulator must have regard to it, and a court must take it into account.

Step 13. For dealers, verify the category. Where the business receives or makes cash payments of HK$120,000 or more, Category B registration is required. Category A registration does not cover those transactions and carrying them out constitutes an offence under section 53ZUE. A Category B renewal application must be filed at least 60 days before expiry.

Where a Hong Kong structure is still at the planning stage, Steps 1 and 2 belong before incorporation rather than after: the list of services in the constitutional documents and in the licence determines the entire subsequent scope of obligations. UPPERSETUP bases its Hong Kong company registration service, and the ongoing support that follows it, on exactly that analysis.

Common Mistakes and What They Cost

The eight mistakes below are the ones that most often turn a DNFBP’s Schedule 2 exposure into an actual sanction, and each is priced by reference to a published statutory ceiling or a published outcome.

Mistake 1. Citing section 3(1)(c) of Schedule 2 in a compliance policy. That provision was repealed by 15 of 2022 and has not existed since 2023. The cost: a document containing a repealed provision invites the inference that the policy has not been refreshed for at least three years. In the AFRC actions of 5 March 2026, the absence or inadequacy of foundational policies produced penalties of HK$70,000 and HK$63,000. For a law firm the same defect is a potential basis for a mandatory referral to the Tribunal Convenor under section 9A(1AA) of Cap. 159, and a Solicitors Disciplinary Tribunal appointed on that referral may impose a penalty of up to HK$500,000.

Mistake 2. Applying the HK$8,000 threshold to DNFBP transactions. That threshold binds only financial institutions (section 3(1A) of Schedule 2 — wire transfers and virtual asset transfers) and licensed virtual asset service providers (section 3(1B) — occasional transactions that are not such transfers). The cost is twofold: unnecessary workload, and — more dangerously — a false sense that anything below the line needs no attention, when sections 3(1)(d) and 3(1)(e) carry no threshold at all and bite on any suspicion.

Mistake 3. Accepting cash on a Category A registration. Section 53ZUE(2) prohibits anyone other than a Category B registrant from carrying out a specified cash transaction. The cost: a level 6 fine of HK$100,000 and up to 6 months’ imprisonment on each count, plus possible disqualification from registration by order of the magistrate. For a sense of scale, on 19 September 2025 a company was fined HK$562,000 in aggregate across multiple counts of operating without registration.

Mistake 4. Failing to verify the authority of a client’s representative. Section 2(1)(d)(ia) and (ii) of Schedule 2 requires not only identification of the person purporting to act for the customer but also verification of that person’s authority. The cost: this was one of three heads of charge for which Prism Hong Kong Limited received a public reprimand and a penalty of HK$150,000, the largest of the AFRC’s first AML disciplinary actions.

Mistake 5. Not setting out findings on unusual transactions in writing. Section 5(1)(c) of Schedule 2 requires the background and purposes of complex, unusually large or unusually patterned transactions without apparent economic or lawful purpose to be examined and the findings set out in writing. The cost: compliance with the duty cannot be demonstrated at inspection. The Estate Agents Authority stated expressly in its guidance of 22 May 2026 that keeping a risk assessment in a licensee’s mind does not satisfy the requirement — the record must be capable of being reproduced in a legible form.

Mistake 6. Treating the Schedule 2 duty as the reporting duty. Cap. 615 contains no suspicious transaction reporting provision; the duty comes from section 25A of Cap. 405, section 25A of Cap. 455 and section 12 of Cap. 575. The cost: failure to report is a criminal offence carrying a fine of HK$50,000 and 3 months’ imprisonment, while dealing with property where there are reasonable grounds to believe it represents the proceeds of crime carries a fine of up to HK$5,000,000 and imprisonment for up to 14 years. No internal Schedule 2 policy protects against that exposure.

Mistake 7. Telling the client that a report has been made. Formulations such as “we had to report your transaction” or “we cannot continue because of a check” constitute the offence in section 25A(5) of Cap. 405 and Cap. 455. The cost: up to HK$500,000 and 3 years’ imprisonment on indictment.

Mistake 8. Assuming Hong Kong is lenient because there are few published cases. Before March 2026 the AFRC had taken no AML disciplinary action, and no published Solicitors Disciplinary Tribunal decision founded on AML/CTF requirements or on Practice Direction P could be identified as at 14 September 2026. The cost of that assumption lies in the timing: the inspection that produced the Prism case closed on 8 July 2024 and the sanction followed on 5 March 2026, roughly twenty months later. Conduct in 2022 and 2023 was inspected in 2023 and 2024 and adjudicated in 2026. The next FATF mutual evaluation is provisionally scheduled for November 2029, and the Law Society, in its AML Updates materials, links it expressly to the strengthening of its supervisory activity: “Looking ahead to the next Financial Action Task Force Mutual Evaluation scheduled for 2029…”. Because supervision is retrospective, documents that do not exist today cannot be produced for a past period later.

Who the DNFBP Regime Suits, and Who It Does Not

DNFBP status is not chosen — it arises from a professional qualification or from the nature of the transactions. What can be chosen is the shape of the business, and that determines how expensive compliance turns out to be.

The regime suits a business where all three of the following conditions are met.

First, the customer base is homogeneous enough that the procedures required by section 19(3) of Schedule 2 can be written once for a handful of standard categories rather than individually for each customer. A practice serving fifty similar corporate customers from two or three jurisdictions carries a far lighter load than a practice of the same turnover with fifty dissimilar customers from twenty jurisdictions.

Second, the cost base has room for a standing compliance function. The minimum is a responsible member of staff, a sanctions screening subscription, annual training and a document store capable of holding material for five years or more. For a sole practitioner these are fixed costs independent of revenue, and it is among sole practitioners that the AFRC most often finds the complete absence of policies.

Third, the business is prepared to turn clients away. Section 3(4) of Schedule 2 leaves no discretion: where due diligence cannot be completed, the relationship must not be established, and an existing one must be terminated. A practice that cannot afford to lose a client is in structural conflict with the Ordinance.

The regime does not suit a business showing any of the following features.

The business depends on receiving cash in substantial amounts and is unwilling to register in Category B. For a precious metals dealer this is a direct criminal exposure under section 53ZUE, not a compliance question.

The customer base is opaque as to beneficial ownership and involves multi-layered ownership chains that cannot be traced through to a natural person. Simplified due diligence under section 4 of Schedule 2 offers only one lawful stopping point — a section 4(3) entity in the ownership chain. In every other case the chain must be traced through.

A material share of revenue comes from clients connected to politically exposed persons. Section 10 of Schedule 2 requires senior management approval and the establishment of source of wealth and source of funds, a process that commonly takes weeks and often ends with the firm declining the customer.

There is one further category: businesses that wrongly believe themselves outside the regime. An outsourced bookkeeping business without the CPA qualification, an agent working only in lettings, a dealer trading exclusively on non-cash terms — all sit outside Schedule 2, and all sit squarely inside Cap. 405, Cap. 455 and Cap. 575. Building an internal process for recognizing and escalating suspicious transactions is no less mandatory for them; only the legal basis differs.

One point on the choice of jurisdiction. In Hong Kong the DNFBP regime is cleanly separated from the financial institution regime, and disciplinary ceilings for the professions are measured in hundreds of thousands of Hong Kong dollars rather than millions. For many structures that makes the burden predictable. For a comparison with UAE alternatives, our analysis of the Hong Kong and UAE dual structure is the natural companion piece. The choice between handling compliance in-house and delegating it to a licensed provider is the subject of UPPERSETUP’s Hong Kong business support.

Frequently Asked Questions

Who counts as a DNFBP in Hong Kong? Under Schedule 1 Part 2 of Cap. 615 a DNFBP is one of five categories: an accounting professional, an estate agent, a legal professional, a TCSP licensee or a Category B PMS registrant. The list is exhaustive. Barristers, bookkeepers without the CPA qualification, unlicensed property intermediaries and Category A precious metals registrants are outside it.

What is the penalty for an accountant or lawyer who breaches the AMLO in Hong Kong? Cap. 615 provides neither a criminal offence nor a pecuniary penalty of its own for them. The AFRC may impose a pecuniary penalty of up to HK$500,000 on an accounting professional under section 37CA(2)(b) of Cap. 588. A Solicitors Disciplinary Tribunal may impose a penalty of up to HK$500,000 on a solicitor or foreign lawyer under section 10(2) of Cap. 159. The Estate Agents Authority may fine a licensee up to HK$300,000 under section 30(1) of Cap. 511.

At what amount does customer due diligence become mandatory under the AMLO? For an occasional transaction outside a business relationship the threshold is HK$120,000 or the equivalent in another currency, including several linked or apparently linked operations (section 3(1)(b) of Schedule 2). There is no threshold where a business relationship is being established, where money laundering is suspected, or where there is doubt about information previously obtained. The HK$8,000 threshold does not apply to a DNFBP.

Do Hong Kong estate agents have to carry out customer due diligence on lettings? No. Section 5A(4) of Cap. 615 switches on the Schedule 2 requirements only where the agent is involved in a transaction concerning the buying or selling of real estate for a client. Leasing and letting are not mentioned in section 5A(4). Obligations under Cap. 511 and the reporting duties under Cap. 405 and Cap. 455 continue to apply.

Who regulates Hong Kong accountants for AML — the HKICPA or the AFRC? Since 1 October 2022 the regulatory body is, as a general rule, the AFRC. For the purposes of section 4 of Cap. 615 it is the AFRC or the HKICPA, and for the purposes of section 7(1), (2) and (3) — the issuing of the guideline — it is the HKICPA as overseen by the AFRC under section 9(b) of Cap. 588. The operative guideline was issued by the HKICPA in its May 2023 revision, while sanctions are imposed by the AFRC.

Does a precious metals dealer in Hong Kong need to register if it does not handle cash? Yes, if any single transaction or linked series reaches HK$120,000. Only a registrant may carry out a specified transaction — a non-cash transaction at or above that figure — and Category A registration is sufficient for that purpose (section 53ZUE(1)). Category B is needed only for specified cash transactions at the same threshold. A Category A registrant is not a DNFBP and carries no Schedule 2 obligation.

How long must AML records be kept in Hong Kong? Transaction records must be kept for at least five years from the date the transaction is completed (section 20(2) of Schedule 2). Customer documents, account files and business correspondence must be kept throughout the business relationship and for at least five years from the date it ends (section 20(3)). Records of an occasional transaction must be kept for at least five years from its completion (section 20(3A)). For law firms, Practice Direction P sets longer periods: 15 years for conveyancing and 7 years for most other matters.

What happens if a suspicious transaction report is not filed in Hong Kong? Failure to report is a free-standing offence under section 25A(7) of Cap. 405 and Cap. 455, carrying a level 5 fine of HK$50,000 and up to three months’ imprisonment. Separately, dealing with property where there are reasonable grounds to believe it represents the proceeds of crime carries, under section 25(3), a fine of up to HK$5,000,000 and imprisonment for up to 14 years.

Do the AMLO requirements reach the overseas offices of a Hong Kong firm? Yes. Section 22(2A) of Schedule 2 requires a DNFBP incorporated in Hong Kong or that is a re-domiciled entity to ensure that its overseas branches and subsidiary undertakings carrying on the same business have procedures to comply with similar requirements, to the extent permitted by local law. Where local law does not permit this, the relevant authority or, for the three professions, the relevant regulatory body must be informed and additional risk-mitigating measures taken.

Is a regulator’s guideline binding? Formally no, practically yes. Under section 7(4) of Cap. 615 a failure to comply does not by itself create liability, but the guideline is admissible in evidence and its relevant provisions must be taken into account. Under section 7(5) the regulator must have regard to it when considering whether Schedule 2 has been contravened. Under section 7(6) it is not subsidiary legislation.

Key Takeaways

The obligations of a non-TCSP DNFBP rest on three provisions, and all three repay reading in the original. Section 5A of Cap. 615 switches the regime on only for the listed transaction types. Schedule 2 supplies the content of the obligations. Section 7 converts the sector guideline into the operative standard of assessment.

Cap. 615 contains neither a criminal offence nor a pecuniary penalty for accountants, lawyers, estate agents and Category B registrants: sections 5(5)–(8) and 21 are addressed to a financial institution. Liability runs through Cap. 588, Cap. 159, Cap. 511 and Part 5C of Cap. 615, with ceilings of HK$500,000, HK$500,000, HK$300,000 and HK$500,000 respectively.

The key thresholds differ from one another and are constantly conflated. The occasional-transaction threshold is HK$120,000. A dealer’s specified cash transaction and specified transaction thresholds are also HK$120,000, but they are set by different Schedules: Schedule 3H and Schedule 3I respectively. The beneficial ownership threshold is more than 25%. The HK$8,000 threshold does not touch a DNFBP. The repealed section 3(1)(c) of Schedule 2 must not be cited.

The dates from which a customer counts as pre-existing differ: 1 March 2018 for the three professions and 1 April 2023 for Category B registrants.

The regulator of accountants and the issuer of their guideline are different bodies: the AFRC imposes sanctions, the HKICPA issues the guideline under AFRC oversight. Decisions of the AFRC, the Law Society and the Estate Agents Authority are not reviewable by the AML/CTF Review Tribunal — each has its own appeal route.

Enforcement practice remains sparse but the direction is unambiguous: the AFRC’s first AML sanctions were imposed on 5 March 2026 following an inspection closed in July 2024; the Law Society introduced a compulsory annual self-assessment for every law firm from January 2026; the Estate Agents Authority carried out 1,284 AML compliance inspections in 2024/25. Hong Kong’s FATF rating on Recommendation 22 has stood at Partially Compliant since 2019, and the next mutual evaluation is provisionally scheduled for November 2029.

Summary

DNFBP obligations under AMLO Cap. 615 outside the TCSP regime apply to four categories: accounting professionals, legal professionals, estate agents and Category B precious metals and stones registrants. They have applied since 1 March 2018, and since 1 April 2023 for precious metals and stones dealers. The obligations switch on only for the transactions listed in section 5A of Cap. 615 and consist of customer due diligence, continuous monitoring, internal procedures, record-keeping for at least five years, and taking all reasonable measures under section 23 of Schedule 2. The occasional-transaction threshold is HK$120,000. Cap. 615 provides no criminal liability and no pecuniary penalty for these four categories: sanctions are imposed by the AFRC under Cap. 588 (up to HK$500,000), by the Solicitors Disciplinary Tribunal under Cap. 159 (up to HK$500,000), by the Estate Agents Authority under Cap. 511 (up to HK$300,000) and by the Commissioner of Customs and Excise under section 53ZVF of Cap. 615 (up to HK$500,000). The duty to report suspicious transactions comes not from Cap. 615 but from section 25A of Cap. 405, section 25A of Cap. 455 and section 12 of Cap. 575; failure to report carries a fine of HK$50,000 and three months’ imprisonment. The operative version of Cap. 615 is dated 15 May 2026.

Sources

1.        Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), version of 15 May 2026 — Hong Kong e-Legislation

2.        Cap. 615, section 5A — Schedule 2 has effect in relation to DNFBPs — Hong Kong e-Legislation

3.        Cap. 615, section 7 — Guidelines for operation of Schedule 2 — Hong Kong e-Legislation

4.        Cap. 615, Schedule 2 — Requirements Relating to Customer Due Diligence and Record-keeping — Hong Kong e-Legislation

5.        Cap. 615, Schedule 1 — Interpretation — Hong Kong e-Legislation

6.        Cap. 615, section 53ZU — Meaning of dealing in precious metals and stones — Hong Kong e-Legislation

7.        Cap. 615, section 53ZUE — Offence of carrying out certain transaction without registration — Hong Kong e-Legislation

8.        Cap. 615, section 53ZVF — Disciplinary action against Category B registrant — Hong Kong e-Legislation

9.        Cap. 615, section 53ZVK — Non-Hong Kong precious metals and stones dealer must file cash transaction report— Hong Kong e-Legislation

10.    Cap. 615, section 53ZW — Transitional arrangements for existing dealer — Hong Kong e-Legislation

11.    Cap. 615, section 81 — Legal professional privilege — Hong Kong e-Legislation

12.    Accounting and Financial Reporting Council Ordinance (Cap. 588) — Hong Kong e-Legislation

13.    Cap. 588, section 3B — Professional irregularity by professional persons — Hong Kong e-Legislation

14.    Cap. 588, section 37CA — Sanctions for CPA misconduct — Hong Kong e-Legislation

15.    Legal Practitioners Ordinance (Cap. 159) — Hong Kong e-Legislation

16.    Cap. 159, section 9A — Complaint about conduct of solicitor, foreign lawyer, etc. — Hong Kong e-Legislation

17.    Cap. 159, section 10 — Powers of a Solicitors Disciplinary Tribunal — Hong Kong e-Legislation

18.    Estate Agents Ordinance (Cap. 511) — Hong Kong e-Legislation

19.    Cap. 511, section 30 — Disciplinary powers — Hong Kong e-Legislation

20.    Drug Trafficking (Recovery of Proceeds) Ordinance (Cap. 405) — Hong Kong e-Legislation

21.    Organized and Serious Crimes Ordinance (Cap. 455) — Hong Kong e-Legislation

22.    Cap. 455, section 25A — Disclosure of knowledge or suspicion that property represents proceeds of indictable offence — Hong Kong e-Legislation

23.    United Nations (Anti-Terrorism Measures) Ordinance (Cap. 575) — Hong Kong e-Legislation

24.    Criminal Procedure Ordinance (Cap. 221), Schedule 8 — Level of Fines for Offences — Hong Kong e-Legislation

25.    Guidelines on Anti-Money Laundering and Counter-Terrorist Financing for Professional Accountants, May 2023— HKICPA

26.    Frequently asked questions on Suspicious transaction reporting, May 2026 — HKICPA

27.    Practice Direction P — Guidelines on Anti-Money Laundering and Terrorist Financing — The Law Society of Hong Kong

28.    Circular 26-1 (SD) — Launch of the AML/CTF Compliance Self-Assessment Form, 2 January 2026 — The Law Society of Hong Kong

29.    Practice Circular No. 23-01(CR) — Guidelines on Compliance of AML/CTF Requirements for the Estate Agency Sector — Estate Agents Authority

30.    Practice Circular No. 23-01(CR) — Questions and Answers, 22 May 2026 — Estate Agents Authority

31.    Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Category B Registrants Dealing in Precious Metals and Stones), June 2023 — Customs and Excise Department

32.    Supervision of Dealers in Precious Metals and Stones — Customs and Excise Department

33.    Dealers in Precious Metals and Stones Registration Regime — FAQ — Customs and Excise Department

34.    AFRC takes first ever disciplinary actions against multiple practice units for non-compliance with anti-money laundering requirements, 5 March 2026 — AFRC

35.    Statement of Disciplinary Action — Danny Ho & Company and Ho Oi Suen, Danny, 5 March 2026 — AFRC

36.    Statement of Disciplinary Action — Prism Hong Kong Limited, 5 March 2026 — AFRC

37.    Guidelines for Exercising the Power to Impose a Pecuniary Penalty for Professional Persons — AFRC

38.    Annual Inspection Report 2024-25, July 2025 — AFRC

39.    Annual Inspection Report 2025-26, 14 July 2026 — AFRC

40.    Annual Enforcement Report 2025-26, 14 July 2026 — AFRC

41.    AML Updates — the Law Society’s AML/CTF material — The Law Society of Hong Kong

42.    United Nations Sanctions Ordinance (Cap. 537) — Hong Kong e-Legislation

43.    No. of STRs Received — suspicious transaction report statistics — Joint Financial Intelligence Unit

44.    Suspicious Transaction Report — submission through STREAMS 2 — Joint Financial Intelligence Unit

45.    Hong Kong Money Laundering and Terrorist Financing Risk Assessment Report, July 2022 — Financial Services and the Treasury Bureau

46.    Implementation of Preventive Measures — Financial Services and the Treasury Bureau

47.    Consultation Conclusions: Legislative Proposal to Regulate Dealing in Virtual Assets, December 2025 — Financial Services and the Treasury Bureau

48.    Anti-money laundering and counter-terrorist financing measures — Hong Kong, China: Mutual Evaluation Report, September 2019 — FATF

49.    Hong Kong, China: 1st Regular Follow-up Report & Technical Compliance Re-Rating, February 2023 — FATF

50.    Global Assessment Calendar — FATF

51.    Estate Agents Authority Annual Report 2024/25 — Estate Agents Authority

52.    Non-registered precious metals and stones dealer receives largest fine on record for carrying out specified transactions, 19 September 2025 — Government of Hong Kong

53.    Head 031 — Customs and Excise Department, The 2026-27 Budget Estimates — Government of Hong Kong

Note on method. Every statutory proposition has been checked against the consolidated text of the relevant Ordinance in the Hong Kong e-Legislation register as at 14 September 2026: Cap. 615 in its version of 15 May 2026; Cap. 588, Cap. 159 and Cap. 511 in their versions of 24 August 2025; Cap. 455 of 19 September 2025; Cap. 405 of 19 September 2019; Cap. 575 of 20 June 2019; and Cap. 221 of 14 May 2026. Repealed provisions, including section 3(1)(c) of Schedule 2 to Cap. 615, are referred to only to record their repeal. Statistical figures are taken from official publications of the Hong Kong regulators and the Government, with the date of each stated.

This material is for information purposes only and does not constitute legal, tax, financial, investment or consulting advice. Before taking any decision, individual professional advice should be obtained that takes into account the specific situation, the jurisdiction, the status of the company and the current requirements of the regulators.

September 2026.