Introduction

The shocking news of  “Panama Papers” (the “Papers”) refers to the leaked documents from a Panamanian law firm containing, among the others, information of the firm’s clients and the offshore companies they control.  The Papers occupied headlines of world news because they uncover information as regards ownership and directorship of thousands of offshore companies which is not otherwise open to public search – one of the major reasons for such companies to be incorporated and utilised from the beginning. Since 9 May 2016, a searchable online database containing information extracted from the Papers (the “Database”) has been published for public search, which means that the leaked information has now become a publicly available database. Though these might not be used as reliable sources for verification of the client’s information, these publicly accessible data do have far-reaching implications on financial institutions’ obligations as regards client due diligence (“CDD”).

Hong Kong’s regulatory framework
in relation to banks’ CDD

CDD is a part of the anti-money laundering and counter-terrorist financing regulatory regime, which follows the recommendations put forward by the Financial Action Task Force (“FATF”). Schedule 2 of the Anti-Money Laundering and Counter-Terrorist Financing (Financial Institutions) Ordinance (Cap.615) (the “Ordinance”) sets out statutory requirements relating to CDD for financial institutions (including banks, securities firms and insurance firms) to follow. Failure to comply with these requirements is a criminal offence on the part of financial institutions.

Pursuant to section 7 of the Ordinance, the Hong Kong Monetary Authority has published the Guideline on Anti-Money Laundering and Counter-Terrorist Financing (the “Guideline”) for banks, restricted banks and deposit-taking companies. In particular, Chapter 4 of the Guideline covers and elaborates the requirements set out in Schedule 2 of the Ordinance.

The extent of CDD to be conducted over a particular client depends on the level of risks as evaluated by the bank. In respect of a potential corporate client, banks are generally required to verify the identity of its ultimate owner or controller, who holds not less than 25% interest in that corporate client. Furthermore, banks are required to conduct continuous monitoring of pre-existing clients. A client who has passed CDD remains subject to this continuous monitoring; when there is a significant transaction or change of circumstance, banks have to take steps to ensure that information of the pre-existing clients is updated and relevant.

Implications of the Papers on banks’ CDD

It has been reported that the Papers have triggered investigations of financial wrongdoings in certain jurisdictions by regulatory authorities on subjects of the information uncovered. This may be a revelation that the operation of the present CDD systems is not perfect in tackling misconducts like assets hiding, tax evasion and money laundering. Although there is so far no announcement of any investigation in Hong Kong against financial wrongdoings triggered by the Papers, banks in Hong Kong should be aware of such risk of circumvention of their CDD systems.

In addition to awareness of risk of circumvention, the public accessibility of the information in the Papers may, together with circumstances in respect of a particular client, trigger an obligation to update and review the client’s information, or even re-conducting CDD against that client. In particular, both paragraph 3(1) of Schedule 2 of the Ordinance and paragraph 4.1.9 of the Guideline stipulate that having doubts on “the veracity or adequacy of any information previously obtained for the purpose of identifying the customer or for the purpose of verifying the customer’s identity” is a situation where CDD requirements should apply. Although the Papers, being documents leaked unofficially (and perhaps illegally), do not suffice for verification, any inconsistency between the content of the Papers and banks’ information obtained from their clients may be sufficient to raise doubts for the purpose of CDD.

Therefore, although the Papers indicate weaknesses in the operation of the CDD systems, they may potentially have a role in CDD for banks to evaluate risks regarding a particular (potential) client. Paragraph 3.6 of the Guideline makes clear that “[t]he identification of higher risk customers… are not static assessments”. Since the Papers, through the Database, have become publicly accessible resources, their contents should not be totally ignored by banks when conducting CDD. Though not quite reliable for verification, the information in the Papers and Database may need to be taken into account in the CDD process. It appears that financial instititions would be well advised to compare their customers’ CDD profiles against the information on the Papers’ database and conduct further CDD if there is any discrepancy or conflict between the two sources.