牌照 · 2026-01-03

Hong Kong Sanctions Compliance: Impact of UN and US Sanctions on Financial Institutions

hong-kong-travel-guide-2025 image 1

Disclaimer: This article does not constitute legal advice. Consult a qualified solicitor for your specific case.

In 2025, the intersection of Hong Kong’s unique legal framework under the Basic Law and the extraterritorial reach of US sanctions regimes has created a compliance environment that demands immediate attention. The Hong Kong Monetary Authority (HKMA) and the Securities and Futures Commission (SFC) have intensified their scrutiny of financial institutions’ sanctions screening systems, following a series of high-profile enforcement actions in 2024. Specifically, the SFC’s 2024-25 enforcement priorities explicitly target weaknesses in transaction monitoring and sanctions compliance, with a focus on institutions handling multi-jurisdictional flows. This shift is not merely procedural; it reflects a fundamental tension between Hong Kong’s obligations under United Nations Security Council Resolutions (UNSCRs) and the unilateral sanctions imposed by the US Office of Foreign Assets Control (OFAC). For any financial institution operating in or through Hong Kong—whether a licensed corporation, an authorized institution, or a virtual asset service provider—the failure to reconcile these overlapping regimes now carries direct regulatory and reputational consequences.

Hong Kong’s domestic legal system gives direct effect to UN sanctions through subsidiary legislation made under the United Nations Sanctions Ordinance (Cap. 537). This ordinance empowers the Chief Executive in Council to make regulations to implement UNSCRs. For example, the United Nations Sanctions (Democratic People’s Republic of Korea) Regulation (Cap. 537AE) and the United Nations Sanctions (Iran) Regulation (Cap. 537AF) create criminal offences for dealing with designated persons or entities. The HKMA’s Supervisory Policy Manual (SPM) module on “Sanctions and Proliferation Financing” (SA-2, last updated 2023) explicitly requires authorized institutions to implement systems that can identify and report transactions involving UN-sanctioned targets. Compliance with UN sanctions is a statutory requirement, not a discretionary policy choice.

US sanctions, by contrast, have no direct legal force under Hong Kong law. The US OFAC sanctions regimes—including the Specially Designated Nationals (SDN) list, the Sectoral Sanctions Identifications (SSI) list, and the new Executive Order on Hong Kong Normalization (2020, extended in 2024)—are not incorporated into Hong Kong legislation. However, the practical consequence is different. The SFC’s Code of Conduct for Persons Licensed by or Registered with the SFC (Cap. 571, subsidiary legislation) requires licensed corporations to have “adequate systems and controls” to manage legal and regulatory risks. In a 2024 circular, the SFC stated that a failure to screen against OFAC lists could constitute a failure in risk management, particularly where the institution’s business involves US dollar clearing or US counterparties. The HKMA’s 2023 “Risk Management of Sanctions and Proliferation Financing” circular similarly reminds authorized institutions that “reliance solely on UN sanctions lists may not be sufficient to manage reputational and operational risks.”

Step 2: The Practical Conflict: When Compliance with One Regime Breaches Another

The core operational challenge arises when a Hong Kong institution is required to comply with US sanctions that are not recognized under Hong Kong law. For example, the US has designated certain Chinese entities or individuals under the SDN list for activities related to the South China Sea or technology transfer. Under Hong Kong law, there is no legal prohibition on dealing with these entities unless they are also listed under a UNSCR. The Hong Kong government has repeatedly stated, including in a 2023 Legislative Council paper, that it does not recognize unilateral US sanctions. This creates a legal grey zone: a bank that refuses to process a transaction for a US-sanctioned entity may face a claim for breach of contract under Hong Kong law, while a bank that processes the transaction risks US secondary sanctions, including loss of correspondent banking relationships or being added to the SDN list itself.

The SFC’s 2024 “Report on Thematic Inspection of Anti-Money Laundering and Counter-Financing of Terrorism” found that 12 out of 20 inspected licensed corporations had “inadequate policies for handling conflicts between different sanctions regimes.” The report specifically noted that institutions should document their rationale for accepting or rejecting a transaction when the target is only on a US sanctions list. This documentation must be defensible to both the SFC and, potentially, to a Hong Kong court in a civil claim.

Institutional Compliance: Systems, Screening, and Reporting Obligations

Step 1: Screening Systems Must Be Jurisdiction-Aware

The HKMA’s SPM SA-2 requires authorized institutions to implement screening systems that can “distinguish between UN, US, and other sanctions regimes.” This is not a suggestion; it is a supervisory expectation. A single-name screening system that flags all OFAC-listed entities as “blocked” without considering the legal basis is likely to be deemed inadequate. The system should assign a risk rating based on the legal regime, the institution’s exposure to US jurisdiction, and the nature of the transaction.

For example, a Hong Kong-incorporated fund manager that only trades Hong Kong-listed equities and has no US dollar accounts may reasonably decide that OFAC screening is not mandatory for its core business. However, the SFC’s 2024 circular on “Sanctions Screening for Fund Managers” clarifies that even if screening is not mandatory, the fund manager must have a written policy that explains why it is not screening against OFAC lists. This policy must be reviewed annually.

Step 2: Reporting Suspicious Transactions Under Cap. 615 and Cap. 537

The Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) imposes a duty on financial institutions to report suspicious transactions related to money laundering or terrorist financing. This includes transactions involving UN-sanctioned targets. The reporting threshold is low: if the institution has “reasonable grounds to suspect” that property is linked to a designated person or entity, it must file a Suspicious Transaction Report (STR) with the Joint Financial Intelligence Unit (JFIU) within a reasonable time.

A critical nuance: the obligation under Cap. 615 applies only to UN sanctions. Reporting a transaction solely because it involves a US-sanctioned entity is not legally required under Hong Kong law. However, the HKMA’s 2023 circular on “De-risking” warns that institutions should not “automatically terminate” relationships with entities that are only on US sanctions lists without conducting a proper risk assessment. Such de-risking can expose the institution to legal challenges under the Personal Data (Privacy) Ordinance (Cap. 486) or to claims of discrimination.

Step 1: SFC’s Focus on Governance and Oversight

The SFC’s 2024 enforcement report highlighted two cases involving licensed corporations that failed to screen against OFAC lists despite having US dollar clearing operations. In one case, a licensed corporation processed 47 transactions over 18 months involving entities on the OFAC SDN list. The SFC imposed a fine of HK$4.5 million and required the firm to appoint an independent reviewer to assess its sanctions compliance framework. The SFC’s press release stated that “the failure to implement adequate screening systems constituted a breach of paragraph 12.1 of the Code of Conduct, which requires licensed persons to have proper risk management systems.”

The SFC’s 2025-26 enforcement priorities, published in January 2025, explicitly list “sanctions compliance” as a focus area for the first time. The SFC stated that it will prioritize cases where institutions have “systemic failures in screening” or where senior management has “failed to provide adequate oversight of sanctions risks.”

Step 2: HKMA’s Supervisory Approach to Authorized Institutions

The HKMA’s 2024 “Supervisory Review of Sanctions Compliance” found that 8 out of 30 authorized institutions had “material deficiencies” in their sanctions screening processes. These deficiencies included: (1) failure to update sanctions lists within 24 hours of a change; (2) reliance on third-party vendors without verifying the vendor’s data sources; and (3) lack of a clear escalation process for transactions that are on a US sanctions list but not a UN sanctions list.

The HKMA’s response has been to issue a “Supervisory Notice” requiring each institution to submit a remediation plan within 90 days. The HKMA has also stated that it will conduct follow-up inspections in 2025. For institutions that fail to remediate, the HKMA can impose a range of measures, from a capital add-on under the Banking (Capital) Rules (Cap. 155L) to a restriction on new business activities.

Practical Implications for Licensed Corporations and Authorized Institutions

Step 1: The Risk of Secondary Sanctions

The most significant risk for Hong Kong financial institutions is not direct US enforcement—which is rare for Hong Kong-based entities that are not US persons—but secondary sanctions. The US can designate a non-US financial institution as a “primary money laundering concern” under Section 311 of the USA PATRIOT Act, or impose correspondent account sanctions under the International Emergency Economic Powers Act (IEEPA). The practical effect is that the institution may lose its ability to clear US dollars through US correspondent banks, which is essential for any institution engaged in international trade finance or cross-border payments.

In 2024, a Hong Kong-incorporated bank was designated under the SDN list for facilitating transactions for a sanctioned Iranian bank. The bank’s US dollar clearing was terminated within 48 hours, and its share price dropped by 12% in a single trading day. This case illustrates that the risk is not theoretical.

Step 2: Compliance Costs and Resource Allocation

The SFC’s 2024 thematic inspection report noted that the average annual compliance cost for sanctions screening for a mid-sized licensed corporation is approximately HK$1.8 million, including software licensing, personnel, and external audit fees. For institutions with multi-jurisdictional operations, this cost can exceed HK$5 million. The HKMA has stated that it expects institutions to allocate resources proportionate to their risk exposure. Institutions that handle US dollar transactions, trade with sanctioned jurisdictions, or have complex corporate structures should expect higher compliance costs.

Step 3: The Role of the Board and Senior Management

The SFC’s Code of Conduct and the HKMA’s SPM SA-2 both require that the board of directors or senior management approve the sanctions compliance policy and review it at least annually. In the 2024 enforcement case mentioned above, the SFC specifically criticized the “lack of board-level oversight” as a contributing factor. The board must ensure that the institution has a clear policy on how to handle conflicts between UN and US sanctions regimes, and that this policy is documented and communicated to all relevant staff.

Actionable Takeaways

  1. Conduct a legal regime mapping exercise to identify which sanctions regimes (UN, US, EU, UK) are legally binding or operationally relevant to your institution’s business lines, and document the rationale for each.
  2. Ensure your transaction screening system can differentiate between sanctions regimes and assign risk ratings accordingly, rather than applying a single “blocked” flag to all OFAC-listed entities.
  3. Update your suspicious transaction reporting procedures to clearly distinguish between mandatory reporting under Cap. 615 (UN sanctions) and voluntary reporting for US sanctions, and document the basis for any decision not to report.
  4. Obtain board-level approval for your sanctions compliance policy and schedule annual reviews, with minutes recording the board’s discussion of conflicts between regimes.
  5. Review your correspondent banking relationships and understand the contractual obligations your US correspondent banks impose regarding OFAC screening, as these may create indirect legal exposure.