What are the documents required for KYC in Hong Kong?

In Hong Kong, KYC typically requires personal identification documents such as a passport or Hong Kong Identity Card (HKID), along with proof of address like a utility bill or bank statement issued within the last three months. Businesses may ask for more depending on the customer's risk profile. For corporate clients, this extends to incorporation documents and registers of directors, shareholders, and significant controllers.

What is KYC compliance?

KYC compliance is the process of meeting the legal duty to identify and verify your customers before and during a business relationship. In Hong Kong, that duty flows from the AMLO and is enforced by regulators such as the HKMA, the SFC, and the Insurance Authority. It covers customer identification, identity verification, risk assessment, and ongoing monitoring rather than a single onboarding check.

How do you verify KYC for a customer in Hong Kong?

You verify KYC by confirming the customer's identity against reliable, independent documents, then assessing their risk and monitoring their activity over time. For an individual, that means checking name, date of birth, nationality, and an identification number using a document like the HKID or passport. Many firms now do this electronically through eKYC, validating documents and biometric data in real time.

What is KYC verification online?

KYC verification online, often called eKYC, is the electronic process of confirming a customer's identity without an in-person meeting. Typically it involves capturing an identity document, taking a biometric selfie or liveness check, and validating the data against trusted sources through secure APIs or a mobile app. Faster than manual review, it also produces a digital record that supports a firm's audit and reporting obligations.

What is a compliance audit report?

A compliance audit report documents the findings of a review of a firm's AML and KYC controls against its legal obligations. For a Hong Kong business, it would assess whether CDD records are complete, whether risk scoring drives the right level of diligence, whether enhanced checks and senior approvals were applied where required, and whether ongoing monitoring is working. The report sets out gaps and the actions needed to close them.

← Industry Insights

KYC

Hong Kong KYC Requirements: A 2026 Compliance Guide for Businesses

Updated Jun 2026 · 9 min read

Hong Kong KYC Requirements: Laws and Regulations in Hong Kong

Hong Kong KYC requirements are the customer due diligence and record-keeping rules that licensed firms must apply under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO). Any business that onboards customers in Hong Kong has to verify who those customers are, work out who ultimately controls them, and keep watching their activity long after the account opens. Skip any of that and the penalties reach into the millions.

This guide is for the businesses running those checks. It is not for individuals trying to clear a personal KYC step. The rules sit at the heart of keeping Hong Kong's financial markets stable, and they exist for one reason: to confirm who a client really is and shut out money laundering, terrorist financing, and other illicit flows before they take hold.

Who Must Meet Hong Kong KYC Requirements

Banks are only the start. Financial institutions caught by these rules also take in body corporates, insurance companies, trust companies, and a long list of other regulated entities. Designated non-financial businesses and professions, usually shortened to DNFBPs, sit right alongside them. All of them have to follow the anti-money laundering guidelines to stay aligned with what Hong Kong's financial system demands.

Reach is wide here. Authorized insurers, insurance agents, and broker companies are in. So are licensed money service operators and stored value facility (SVF) licensees. Payment service providers, neobanks, and other non-bank financial institutions such as lenders and peer-to-peer platforms fall inside the same net. And the list does not stop there. Investment managers, hedge fund managers, providers of cryptocurrency-related services, and cash-in-transit businesses each carry KYC obligations of their own.

Two rounds of amendments widened this population. Back in 2018 and again in 2022, changes to the AMLO formally pulled in trust or company service providers, dealers in precious metals and stones, and virtual asset service providers. Does your firm touch client money or hold client identity data in Hong Kong? Then the working assumption should be that these rules apply to you.

Important Regulatory Bodies in Hong Kong

Enforcement does not rest with a single agency. Several authorities monitor compliance with the legal requirements, and between them they make sure financial units, companies, and individuals respect the laws that govern financial conduct in the territory.

Hong Kong Monetary Authority (HKMA)

Banks and similar institutions answer to the HKMA. The HKMA regulates and monitors them, checking that the AML and CFT measures it expects are genuinely in place. Work here splits across departments covering risk management, the supervision of financial institutions, and enforcement. For years the authority has carried out its central banking functions with one aim in view: holding banking standards in Hong Kong at the highest level.

Securities and Futures Commission (SFC)

Licensed corporations and SFC-licensed virtual asset service providers fall under the SFC. Enforcement here is not theoretical. In one 2026 action the SFC fined a licensed corporation HK$9 million over AML and counter-terrorist-financing control failures and governance gaps. Supervisory expectations are rising, not easing.

Hong Kong Police Force (HKPF)

Money laundering and terrorism financing offenses are investigated and prosecuted by the HKPF. It does this through the Joint Financial Intelligence Unit (JFIU), which it co-runs with Customs, and it works alongside other local and international agencies to break up the criminal networks behind financial crime.

Insurance Authority (IA)

Insurers report to the IA, the supervisory authority for the insurance business in Hong Kong. Tracking how they meet AML standards and overseeing their conduct is its job, so that firms harboring money laundering or terrorist financing intentions cannot exploit them.

Customs and Excise Department

Money service operators and dealers in precious metals and stones are supervised, for AML purposes, by the Customs and Excise Department. That remit follows the movement of value through channels that sit outside the traditional banking system.

Financial Services and the Treasury Bureau (FSTB)

AML and CFT policy belongs to the FSTB. Maintaining and strengthening the legislative framework falls to it, so that Hong Kong's financial system keeps step with leading international standards. The bureau also coordinates the various regulators against financial crime, keeping their efforts aligned rather than fragmented.

What Are the KYC Requirements in Hong Kong?

At its core, KYC in Hong Kong rests on customer due diligence, ongoing monitoring, and record retention. Risky clients and their identities have to be recognized, and the regime sets out several customer identification procedures to get there. Four steps carry most of the weight:

Identify the customer. Collect personal information such as name, date of birth, and identification documents (passport, Hong Kong ID, and similar).
Verify the customer's identity. Confirm what was given against reliable, independent formal documents.
Assess the risk level. Run a risk analysis that sorts the customer into low, medium, or high risk, weighing factors such as geographical location and how often they transact.
Monitor on an ongoing basis. Keep reviewing the client's transactions over time to catch anything that looks suspicious.

Records have to be kept for at least five years after the business relationship ends, in line with Hong Kong's KYC rules. To satisfy the requirements, businesses must collect and verify personal identification data, including:

Full name
Date of birth
Nationality
A unique identification number and the document type it comes from

CDD Thresholds Businesses Need to Watch

An account opening is not the only thing that triggers customer due diligence. Under the AMLO, firms must identify and verify every customer and beneficial owner before they establish a business relationship. That same duty applies before carrying out occasional transactions at or above HK$120,000. For wire transfers, the threshold drops sharply to HK$8,000.

A single large payment is easy to spot. Harder to catch is a series of smaller, linked transactions that quietly add up to one of those lines. Firms are expected to stay alert to that pattern rather than reading each payment in isolation. This is where automated transaction monitoring earns its place. Manual review rarely catches splitting at scale.

Beneficial Ownership and Corporate KYC

Onboarding a company is not the same as onboarding a person, and the rules reflect that. For corporate customers and other legal entities, verification has to reach the ultimate beneficial owner. Hong Kong defines a UBO as any natural person who holds, directly or indirectly, more than 25% of the shares or voting rights, or who otherwise exercises control over the entity.

Stopping at the first corporate layer does not satisfy the requirement. A firm has to look through holding companies and intermediaries all the way to the real people who own or control the customer. When no individual can be identified at the 25% threshold, a UBO declaration is usually requested instead.

Hong Kong backs this up with a transparency tool of its own. Every limited company must keep a Significant Controllers Register recording the individuals or entities with significant control, which generally means those above the 25% line. For businesses onboarding corporate clients, that register, the certificate of incorporation, and the registers of directors and shareholders form the documentary backbone of a corporate KYC file. You can read more on tracing ownership in our guide to the ultimate beneficial owner.

The Risk-Based Approach: EDD and PEPs

Not every customer has to clear the same bar. Under the AMLO a risk-based approach is mandatory, so the depth of due diligence scales with the money-laundering and terrorist-financing risk a given customer presents. Low-risk relationships can take a lighter touch. Higher-risk ones demand more.

Enhanced due diligence applies to high-risk customers and politically exposed persons. In practice that means senior management has to approve the onboarding, deeper inquiries follow into the source of funds and source of wealth, and reviews come around more often once the relationship is live. Spotting a politically exposed person early matters. The additional checks are hard to retrofit once an account is already running.

Identity Verification

To verify identity, documents like the Hong Kong Identity Card (HKID), driver's license, or passport can be used. More and more, identity verification happens electronically. eKYC lets a firm confirm identity through digital captures of documents and biometric data, validated in real time against trusted sources. That route is faster and far more convenient than meeting a customer face to face.

Address Verification

Proof of address can be established with documents such as:

Utility bills (issued within the last three months)
Bank statements (issued no later than three months prior)
Government-issued documents showing the client's name and address

Compliance Audits for Hong Kong KYC

Running KYC checks is one thing. Proving to a regulator that the program works is another. A compliance audit reviews a firm's AML and KYC controls against the AMLO and the relevant guidelines, then surfaces the gaps before a supervisor finds them first.

Useful audits look past the policy document and into the day-to-day. Are CDD records complete and retrievable across the full five-year window? Does the firm's risk scoring actually drive the level of diligence applied? Were enhanced checks carried out where they should have been, with senior approval logged? Is ongoing monitoring catching the patterns it is meant to catch? Firms that treat audits as a routine internal discipline, rather than a fire drill before an inspection, tend to fare better when the regulator does arrive. Clean, well-organized records turn a stressful review into a manageable one.

If you want to get this right from the start, book a demo to see how an automated KYC program keeps your audit trail complete by default.

Penalties for Non-compliance with Hong Kong KYC Requirements

The consequences of breaking Hong Kong's KYC and AML rules are severe. A firm that fails to meet its obligations under the AMLO can face a fine of up to HK$1,000,000 (roughly $128,000) and imprisonment of up to seven years, depending on how serious the breach is. Money laundering offenses carry heavier sanctions still, with fines reaching HK$5,000,000 (roughly $640,000) and prison terms of up to 14 years. A business may also lose its license on top of that, which can do lasting damage to its operations.

Money is rarely the worst of it. Non-compliance also bruises a firm's reputation and standing in the market. With financial-crime prevention now a global priority, putting reliable KYC procedures in place is the practical way to contain risk and stay clear of regulatory scrutiny.

How KYC Hub Helps You Meet Hong Kong KYC Requirements

KYC Hub gives businesses a single way to run Hong Kong's KYC obligations end to end. Its global KYC solution is built for banks and fintechs that need onboarding to be both fast and compliant.

Identity verification sits at the center of the platform. Video KYC and liveness checks confirm a real person is behind the application, while ID verification reads and validates the documents Hong Kong recognizes, including the HKID and passport. Digital signature support closes out the onboarding flow without paper. Around that sit sanctions screening and risk analysis, so one workflow handles verification and screening together rather than across disconnected tools.

For Hong Kong specifically, that combination maps cleanly onto what the AMLO asks for. Identity gets verified against reliable sources. Risk gets scored to drive the right level of due diligence. The audit trail builds itself as you go, which keeps record-keeping and review obligations covered without extra manual effort. You end up with lower cost, fewer chances to slip, and a program that holds up when a supervisor looks closely.

Ready to see it work against your own onboarding flow? Get a free demo and we will walk through how KYC Hub fits your Hong Kong compliance program.

Conclusion

KYC, AML, and CFT controls are a permanent fixture of doing financial business in Hong Kong. Any organization operating there has to keep pace with them, both to avoid legal consequences and to protect its reputation. The territory's financial sector keeps adopting new technology, and the firms that watch for changes in the AML and KYC rules, then build the right tools around them, are the ones that stay ahead of the requirement rather than scrambling to catch up.