Published · Updated
Before a Hong Kong company starts working with a new customer, pre-transaction checks can help the team assess whether the counterparty, payment and delivery arrangements make sense—and identify what remains unresolved. Ordinary business checks and statutory customer due diligence (CDD) are not the same thing. The applicable rules depend on the checker’s role, the activity and the relevant jurisdictions. Consider a hypothetical case: a Taiwan-based SaaS company sells an annual subscription to a Hong Kong customer, while a related company in Singapore pays the invoice. The third-party payment needs clarification, but it does not by itself prove that the transaction is improper.
Separate General Business Checks from Statutory CDD
Start with three questions: who is the counterparty, why is the transaction taking place, and who is responsible for the checks? A business may conduct ordinary commercial checks to manage its own risk—for example, to see whether the company details, contact person, payer and delivery match the transaction. Statutory CDD requires a separate assessment of whether a particular rule applies to the checker, business activity and jurisdiction. A customer’s Hong Kong registration does not mean every company must conduct the same CDD on every customer.
Build a checklist around the transaction value, delivery method, payment arrangement and information available. Label each item as internal risk management, a bank or contractual request, or a confirmed legal obligation. If applicability is unclear, mark it for verification rather than describing an internal checklist as law. A useful handover records the subject checked, the source and date, any discrepancy, and who will decide the next step.
The Companies Registry’s TCSP Customer Due Diligence FAQ says that AML/CFT requirements applicable to a TCSP licensee apply when, in Hong Kong and by way of business, the licensee prepares or carries out a client transaction concerning a trust or company service defined in law. Those services include forming companies, acting or arranging for someone to act as a company director or secretary, and providing a registered or business address. This does not mean every Hong Kong company must apply the same CDD to all customers. The FAQ’s last revision date is 3 March 2025. If a business’s role or activity may fall within a regulated category, have someone familiar with the rules confirm the scope and responsibility.
Verify the Registered Entity and Actual Contact First
Check the counterparty’s legal name, place of incorporation, registration number and registered address. Compare those details with the quotation, contract, order and invoice. A similar name does not establish that two records refer to the same entity. If an address or number differs, check whether it reflects an alias, branch, related company or updated record before treating it as a warning sign. In the hypothetical SaaS transaction, first confirm that the contracting customer is the Hong Kong company named in the proposal, then establish which entity is buying the subscription and who will receive the service.
Matching registration details supports the conclusion that the entity information is consistent; it does not prove that the person emailing or signing has authority to represent the company. Record the contact’s name, role, company email domain, contact details and part in the transaction. If one person signs the contract and another proposes the payment arrangement, ask them to explain the division of responsibilities. Depending on the transaction and its risk, you might request an authorization document or written confirmation from a company representative whose role you can verify. The same document requirement need not apply to every deal.
Where possible, confirm the contact through a known channel, such as a previously verified company phone number or email address, rather than relying only on details in a new message. Mark each item as confirmed, awaiting information or discrepancy, and record the date, source, issue, person asked and next owner. If you can verify the company but not the contact’s authority, say so clearly before the next person signs, activates an account or delivers the service. For broader background on company records, see What Is a Hong Kong Company Secretary? Statutory Duties and How to Choose. This related article does not establish that the checks described here are a service offered by its publisher.
Use the Transaction Context to Explain Payment and Delivery Arrangements
Compare the contract, order, invoice, payment record and actual delivery as one picture: who buys, who pays, who receives the funds, in what currency, who receives the service, when it starts, how refunds work, and whether the stated purpose stays consistent throughout. In the hypothetical case, the SaaS company should check that the annual subscription contract and invoice match the amount, currency and timing of the payment from the Singapore affiliate, and confirm that the service account is for the Hong Kong customer named in the contract.
If a third party pays, ask how the payer is related to the customer, why it is paying on the customer’s behalf and who ultimately bears the cost. Then compare the explanation with the contract terms, information about the related company or a written payment instruction. If the records do not yet line up, record the difference as unresolved. When requesting more information, specify the gap—such as payment authorization, evidence of the relationship or a reconciliation of the invoice and payment—and assign an owner and follow-up date. A third-party payment is not, by itself, proof of wrongdoing.
The Hong Kong Monetary Authority’s Smart Tips for Private Banking, published on 7 March 2023, discusses collecting information, clarifying transaction background and corroborating details in a private-banking context. It is a reference for understanding one bank’s approach, not evidence that every bank, company or commercial transaction must follow the same steps. Banks may ask different questions under their own policies and based on the customer and risk involved; do not promise a review timeline, mandatory document list or outcome on a bank’s behalf. For more background on account preparation, see Opening a Hong Kong Company Bank Account and confirm requirements with the relevant bank.
Record Beneficial Ownership and Risk Signals
If the transaction warrants checking who ultimately owns or controls the customer, trace upward from direct shareholders. Record each company’s legal name and jurisdiction, shareholding or voting rights, and the source used to verify the information. Ownership percentage is one clue. Rights to appoint or remove most directors, or other significant influence over the company, may also matter when assessing control. If the evidence only reaches the first corporate shareholder, do not automatically treat that company as the ultimate beneficial owner; note which parts of the ownership or control structure remain unknown.
For Hong Kong local companies, except listed companies, the Significant Controllers Register (SCR) rules include specific conditions such as holding more than 25% of shares or voting rights, as well as other forms of control. The more-than-25% threshold is one SCR condition, not a universal threshold for every AML or business check. A company must keep its SCR at its registered office or another place in Hong Kong, and make it accessible to law-enforcement officers on demand. The register need not be delivered to the Companies Registry, so do not treat it as information available through an ordinary public company search. See the Companies Registry’s SCR FAQ; the applicable rules and company facts determine the actual assessment.
Keep the ownership chart, sources, check dates, control basis and unresolved differences together. Conflicting shareholder details, an unverified company in the ownership chain, an unclear explanation of control or a mismatch between the transaction and the company background can each be recorded as an issue to clarify. Attach the specific observation rather than leaving only a high risk label. State what evidence is needed, who will review it, what interim arrangement applies and what would allow the transaction to proceed or require escalation. This helps the next person distinguish known facts from assumptions and pending work.
Assess Sanctions, AML and Professional Duties by Role
List the jurisdictions, industries, transaction parties and people conducting the checks. Then assess separately whether statutory AML duties apply, whether the bank or contract has set requirements, and whether the company has adopted additional risk controls of its own. These categories are not interchangeable. Do not claim that every Hong Kong company must screen every customer against sanctions lists. If a party is a regulated professional or licensed institution, confirm the rules that apply to that party. If the company is supplying information at a bank’s or customer’s request, record that as a bank or contractual requirement.
If a screening result looks like a possible match, or the available information is incomplete, record the source and date, the basis for the suspected match, differences in the name or company details, and what remains unconfirmed. Similar names do not prove that two records refer to the same person. Being unable to rule out a concern is also not the same as confirming a match. Refer the information to an authorized compliance or legal decision-maker, who can decide whether more identifying information is needed, the transaction should be paused, or another step is appropriate. Until the applicable rule is confirmed, do not describe a chosen action as a legal requirement.
The TCSP FAQ explains that, where the rules permit and their conditions are met, a licensee may rely on a specified intermediary to perform part of the CDD. The licensee remains ultimately responsible for meeting the CDD requirements. This is a responsibility under the rules applicable to that licensee; it should not be generalized to every industry or outsourced check. If the team is unsure whether its role is regulated, record the role and applicability as open questions, then identify who should review them.
Protect Personal Data and Keep Necessary Decision Records
Each data request should answer a defined question—for example, confirming the entity, checking the representative’s authority, explaining payment or understanding control. Start with information sufficient to answer that question; request narrowly scoped additional evidence only if a material gap remains. Another institution’s request for a document does not mean every transaction requires the same personal information. Decide who needs to see the information, how it will be transmitted and stored, and who should not have access.
Limit use of the information to what is needed for the transaction. Avoid storing identity documents, ownership details or contact records in a shared location accessible to everyone. Before sending information by email or file-sharing tool, check the recipient and access settings. Before sharing it with a bank, adviser or other partner, confirm the purpose, scope and responsible person. These are general information-risk practices; they do not replace checking the rules for a particular case or mean that every transaction requires identical technical controls.
A handover record should include the check date, sources, confirmed facts, unresolved differences, responses received, reasons for the decision, owner and next step. Sensitive source files and the decision summary can be managed separately. Confirm whether the next person needs the original document or only the conclusion and its file location. Set retention according to applicable duties, the business purpose and the company’s documented record arrangements; do not invent a single retention period for all companies. Once the purpose ends, handle the information under the confirmed arrangement and record any required deletion or review.
In the SaaS example, the team could record that the company and contact are confirmed, the payment relationship needs supporting information, or a question about applicable rules requires escalation. A colleague taking over can then see what is unresolved, who owns it and what evidence is missing without repeating the entire review. Keeping general business checks, bank requests and statutory CDD distinct gives the transaction decision a traceable basis.
If you need case-specific analysis, raise a question through the website’s contact channels. This article is not legal or tax advice and does not promise an outcome.