In Brief

Cyber fraud remains a significant risk to businesses and individuals.  In the 11 months to November 2021, over 500 phishing scams, worth more than HKD 1.4 billion in losses, were reported to the Hong Kong Police. The Police have been developing and will soon launch a free software to assist businesses in identifying phishing scams.[1]

On 30 December 2021, the Hong Kong Court of First Instance handed down an important judgment in Tam Sze Leung & Ors v Commissioner of Police [2021] HKCFI 3118, holding that the ‘No Consent Regime’ (“Regime”) adopted by the Police under the Organised and Serious Crimes Ordinance (Cap. 455) (OSCO) is unlawful.

Under the Regime, the Police issued so-called ‘Letters of No Consent’ (LNCs) to banks to trigger an informal freeze on accounts suspected of holding proceeds of crime, often in the initial stages of the Police’s investigations into cyber fraud and other crime. The judge referred to the “important and undisputed need … to combat money laundering and to facilitate the pursuit and confiscation of proceeds of crime” and also noted that, from the Police perspective, the Regime was “a sharp but essential modern weapon” giving them “the ability to counter-attack”.

This judgment curtails that practice and addresses issues of real public importance, with significant implications for financial institutions and victims of financial crime seeking to recover losses in Hong Kong.

Key Takeaways

The Court accepted that the Police are free to express or report suspicions arising from their ongoing investigations to financial institutions, but clearly rejected the use of LNCs to informally freeze funds. 

While the Court gave its reasons, it has not yet given orders for relief.  We expect this judgment will be appealed.  In the meantime, it is unlikely that this lacuna can be addressed through legislative amendment, and there will be uncertainty around whether or how this practice can continue. A greater burden will likely be placed on financial institutions. They can deal with suspicious funds, but only with consent.  However, the authorities are unlikely to provide their express consent in circumstances involving cyber fraud or other financial crime.

We will continue to monitor developments.  For now, in practical terms, we recommend:

  • Financial institutions to:
    • Ensure effective AML policies and procedures are developed, implemented and monitored.
    • File Suspicious Transaction Reports (STRs) where appropriate. 
    • Carefully assess Terms and Conditions with customers to ensure the ability to freeze funds – that is, not to deal with funds suspected to be proceeds of crime.
  • Businesses/Individuals to:
    • Keep cybersecurity top of agenda.
    • Consider cyber insurance.
    • Identify any cyber incidents, and act, quickly – out-of-court options have been impacted, so victims of financial crime may need to resort to urgent injunctive relief through civil litigation to stop funds from being dissipated and maximise recovery prospects.
    • Reassess active recovery strategies if you have been the victim of financial crime.

The Regime

Section 25 of OSCO establishes the offence of dealing with property known or reasonably believed to represent the proceeds of crime.

Section 25A of OSCO provides that a person dealing with any property should notify the authorities where the person knows or suspects the property to represent proceeds of crime. Section 25A(2)(a) further provides a defence for the person concerned to deal with the property where the person does so with the consent of an authorised officer.

The legislative scheme deprives perpetrators of the proceeds of their criminal conduct, and ensures that knowledge or suspicion of such proceeds are reported. 

Financial institutions typically notify the Police of their knowledge or suspicion under Section 25A by filing STRs to the Joint Financial Intelligence Unit (JFIU), after which the JFIU may issue a letter of consent authorising the financial institution to continue dealing with the relevant account.  However, the Police have been using this Regime to issue LNCs to expressly withhold consent instead.  The practical reality is that, upon receipt of LNCs, financial institutions invariably err on the side of caution and impose a freeze on the relevant accounts.

Tam Sze Leung & Ors v Commissioner of Police

The applicants in this case were four account holders who were suspected of involvement in a ‘pump and dump’ scheme.  In November 2020, the banks were notified of the investigation by the authorities and were urged to file STRs, which they did.  The banks had no prior suspicions as to the nature of the accounts. The Police then issued LNCs over the applicants’ bank accounts in December 2020, resulting in a total of around HKD 30 – 40 million to be frozen in the accounts.

The freeze was maintained over the accounts for approximately 10 months, and was only lifted upon the Police’s successful application for restraint orders against the applicants and the accounts.

The applicants sought leave to apply for judicial review against the Regime on six grounds:

  1. The use of the LNCs are tainted by procedural impropriety and unfairness.
  2. The LNCs are ultra vires OSCO which does not confer power on the Commissioner to operate a de facto property freezing regime by the use of LNCs.
  3. The LNCs interfere with the applicants’ constitutional rights, and the interference is not prescribed by law.
  4. The LNCs breach the applicants’ right to a fair hearing.
  5. The Regime and the LNCs disproportionately interfere with the applicants’ property rights, and rights to privacy and family.
  6. The alleged ‘blanket freeze’ caused by the LNCs in this case is unlawful.

The applicants failed on grounds 1, 4 and 6 but succeeded on grounds 2, 3 and 5. In particular, the Court observed that because OSCO provides express asset freezing powers by way of restraint orders and charging orders (with substantive and procedural safeguards), it is ‘implausible that the legislature could have simultaneously “consciously enacted” a secret, informal and unregulated asset freezing power of the kind which the Commissioner now asserts he enjoys under section 25A(2)(a)’; and that the Regime as operated is not prescribed by law.

[1]        Hong Kong police to launch free software ‘V@nguard’ for businesses to fight phishing scams | South China Morning Post (


Gary Seib is a commercial disputes professional with over 30 years’ experience. Gary Seib is focused on bringing together global, regional and local teams to deliver commercial success for the Firm’s clients. He passionately believes in simplifying complex legal and business matters. Gary is known for his client-centric approach that drives value and innovation. Gary was described by clients in the Acritas Stars Report as being "knowledgeable, very approachable, friendly." Gary is ranked as a "Star Lawyer," an "Eminent Practitioner" and leading practitioner in his field by top legal directories, including Chambers Asia, Chambers Global, Asia Pacific Legal 500, IFLR 1000, and “PLC Which Lawyer?” He is one of the first lawyers to be granted “Solicitor Advocate” status before the Hong Kong courts and has extensive experience in alternate dispute resolution techniques, particularly in arbitration and mediation. Gary practised as a barrister in Australia for over eight years (1996-2004), and returned to Baker McKenzie as a partner in 2004 to lead its Dispute Resolution Group in Hong Kong and China.


Gillian Lam is a senior associate in Baker McKenzie's Hong Kong office and a member of the Firm's Dispute Resolution Practice Group. Her practice focuses on commercial litigation and arbitration in Hong Kong, including general commercial/corporate disputes, commercial fraud and bribery investigations, contentious employment issues. She has extensive knowledge in cyber fraud matters, having authored publications and presented in client trainings on related topics. Gillian is a member of the Law Society of Hong Kong and is accredited as Solicitor Advocate. She is also a fellow of the Chartered Institute of Arbitrators and a member of ArbitralWomen.

Clement Chui

Clement Chui is a Senior Associate in the Dispute Resolution Group in Hong Kong. His practice covers general commercial disputes, contentious regulatory matters, and compliance matters. Clement regularly advises clients on matters concerning contentious probate / trusts and estate administration, shareholders’ / contractual disputes, and recovery and tracing of proceeds of cyber frauds. Clement also handles complex contentious regulatory matters (involving the SFC, the HKMA, the SEHK, and the ICAC); conducts compliance-related internal investigations / risk assessments; and advises on anti-bribery (concerning the POBO, the FCPA, and the UK Bribery Act) and AML issues. Clement is personal, and strongly driven in providing pristine advices and client service excellence. Clement is a member of the Sports Committee of the American Chamber of Commerce in Hong Kong.


Victor Yip is Associate in the Dispute Resolution group of Baker McKenzie's office in Hong Kong.