In Brief
Cyber fraud remains a significant risk to businesses and individuals. In the 11 months to November 2021, over 500 phishing scams, worth more than HKD 1.4 billion in losses, were reported to the Hong Kong Police. The Police have been developing and will soon launch a free software to assist businesses in identifying phishing scams.[1]
On 30 December 2021, the Hong Kong Court of First Instance handed down an important judgment in Tam Sze Leung & Ors v Commissioner of Police [2021] HKCFI 3118, holding that the ‘No Consent Regime’ (“Regime”) adopted by the Police under the Organised and Serious Crimes Ordinance (Cap. 455) (OSCO) is unlawful.
Under the Regime, the Police issued so-called ‘Letters of No Consent’ (LNCs) to banks to trigger an informal freeze on accounts suspected of holding proceeds of crime, often in the initial stages of the Police’s investigations into cyber fraud and other crime. The judge referred to the “important and undisputed need … to combat money laundering and to facilitate the pursuit and confiscation of proceeds of crime” and also noted that, from the Police perspective, the Regime was “a sharp but essential modern weapon” giving them “the ability to counter-attack”.
This judgment curtails that practice and addresses issues of real public importance, with significant implications for financial institutions and victims of financial crime seeking to recover losses in Hong Kong.
Key Takeaways
The Court accepted that the Police are free to express or report suspicions arising from their ongoing investigations to financial institutions, but clearly rejected the use of LNCs to informally freeze funds.
While the Court gave its reasons, it has not yet given orders for relief. We expect this judgment will be appealed. In the meantime, it is unlikely that this lacuna can be addressed through legislative amendment, and there will be uncertainty around whether or how this practice can continue. A greater burden will likely be placed on financial institutions. They can deal with suspicious funds, but only with consent. However, the authorities are unlikely to provide their express consent in circumstances involving cyber fraud or other financial crime.
We will continue to monitor developments. For now, in practical terms, we recommend:
- Financial institutions to:
- Ensure effective AML policies and procedures are developed, implemented and monitored.
- File Suspicious Transaction Reports (STRs) where appropriate.
- Carefully assess Terms and Conditions with customers to ensure the ability to freeze funds – that is, not to deal with funds suspected to be proceeds of crime.
- Businesses/Individuals to:
- Keep cybersecurity top of agenda.
- Consider cyber insurance.
- Identify any cyber incidents, and act, quickly – out-of-court options have been impacted, so victims of financial crime may need to resort to urgent injunctive relief through civil litigation to stop funds from being dissipated and maximise recovery prospects.
- Reassess active recovery strategies if you have been the victim of financial crime.
The Regime
Section 25 of OSCO establishes the offence of dealing with property known or reasonably believed to represent the proceeds of crime.
Section 25A of OSCO provides that a person dealing with any property should notify the authorities where the person knows or suspects the property to represent proceeds of crime. Section 25A(2)(a) further provides a defence for the person concerned to deal with the property where the person does so with the consent of an authorised officer.
The legislative scheme deprives perpetrators of the proceeds of their criminal conduct, and ensures that knowledge or suspicion of such proceeds are reported.
Financial institutions typically notify the Police of their knowledge or suspicion under Section 25A by filing STRs to the Joint Financial Intelligence Unit (JFIU), after which the JFIU may issue a letter of consent authorising the financial institution to continue dealing with the relevant account. However, the Police have been using this Regime to issue LNCs to expressly withhold consent instead. The practical reality is that, upon receipt of LNCs, financial institutions invariably err on the side of caution and impose a freeze on the relevant accounts.
Tam Sze Leung & Ors v Commissioner of Police
The applicants in this case were four account holders who were suspected of involvement in a ‘pump and dump’ scheme. In November 2020, the banks were notified of the investigation by the authorities and were urged to file STRs, which they did. The banks had no prior suspicions as to the nature of the accounts. The Police then issued LNCs over the applicants’ bank accounts in December 2020, resulting in a total of around HKD 30 – 40 million to be frozen in the accounts.
The freeze was maintained over the accounts for approximately 10 months, and was only lifted upon the Police’s successful application for restraint orders against the applicants and the accounts.
The applicants sought leave to apply for judicial review against the Regime on six grounds:
- The use of the LNCs are tainted by procedural impropriety and unfairness.
- The LNCs are ultra vires OSCO which does not confer power on the Commissioner to operate a de facto property freezing regime by the use of LNCs.
- The LNCs interfere with the applicants’ constitutional rights, and the interference is not prescribed by law.
- The LNCs breach the applicants’ right to a fair hearing.
- The Regime and the LNCs disproportionately interfere with the applicants’ property rights, and rights to privacy and family.
- The alleged ‘blanket freeze’ caused by the LNCs in this case is unlawful.
The applicants failed on grounds 1, 4 and 6 but succeeded on grounds 2, 3 and 5. In particular, the Court observed that because OSCO provides express asset freezing powers by way of restraint orders and charging orders (with substantive and procedural safeguards), it is ‘implausible that the legislature could have simultaneously “consciously enacted” a secret, informal and unregulated asset freezing power of the kind which the Commissioner now asserts he enjoys under section 25A(2)(a)’; and that the Regime as operated is not prescribed by law.
[1] Hong Kong police to launch free software ‘V@nguard’ for businesses to fight phishing scams | South China Morning Post (scmp.com)
