Hong Kong Court of Appeal reverses decision holding AML no consent regime unconstitutional

Introduction

On April 14, 2023, the Hong Kong Court of Appeal reversed a Court of First Instance decision that may have significantly impacted the AML regime in Hong Kong. The case, Tam Sze Leung and Others v Commissioner of Police [2023] HKCA 537, concerns the police’s long-standing practice of issuing letter of no consent (LNCs), which was challenged on the grounds that the no consent regime was not authorised under AML laws and that it amounted to an informal freezing order without avenues for judicial review.

As it is an offence for a person to deal in property that they know, or have reasonable grounds to believe, represent criminal proceeds without consent from the police, the issuance of an LNC from the police to a financial institution has, in practice, resulted in the assets being frozen.

The Court of Appeal upheld the constitutionality of the no consent regime, allowing the police to continue issuing LNCs. In rejecting the challenges, the Court ruled that it is a financial institution, not the police, that makes the decision to freeze customer accounts upon the issuance of an LNC. In so doing, the Court emphasised that the appropriate point of recourse for customers who are aggrieved that their assets are frozen is the financial institutions. This decision highlights the needs for financial institutions to balance competing obligations associated with complying with customer contracts and customer instructions, and the risk of criminal liability for dealing in the proceeds of a criminal offence.

Background

Relevant AML provisions

Under section 25(1) of the Organized and Serious Crimes Ordinance (Cap. 455) (OSCO)[1], it is an offence for a person such as a financial institution to deal with property that they know, or have reasonable grounds to believe, represents proceeds of an indictable offence.

Under section 25A(1), a person who knows or suspects that property represents proceeds of, or was used or is intended to be used in connection with, an indictable offence, is required to make a disclosure to an authorised officer, in practice, by way of an STR filed with the Joint Financial Intelligence Unit (JFIU).

Section 25A(2) provides a defence to criminal liability under section 25(1) if the person, prior to dealing with the property, had made the disclosure described in section 25A(1) and obtained consent from the authorised officer to deal with the property. [2] Where consent is refused, which generally in practice takes the form of an LNC issued by the JFIU, financial institutions usually respond by freezing the assets in question. But, there is a potential “gap” between the threshold required to file an STR (knowledge or suspicion) and the standard required for refusing to operate an account (knowledge or reasonable grounds to believe).

Court of First Instance decision

Tam Sze Leung and Others v Commissioner of Police [2021] HKCFI 3118 involved an application for leave for judicial review of the police’s decision to issue LNCs.

In 2020, the police contacted a number of banks with which the applicants held accounts and notified the banks that the applicants were suspected of being involved in market manipulation-related money laundering activities. The police further requested that the banks file STRs relating to the applicants’ accounts. After the banks complied and submitted STRs, the police issued LNCs in respect of each of the accounts.

At first instance, the applicants challenged the no consent regime and the LNCs issued in respect of their accounts on a number of grounds. Ultimately, the judge found: (1) nothing in section 25A(2)(a), which impliedly gives the commissioner power to withhold consent, necessarily implies that the commissioner has power to operate an “informal asset freezing regime”; (2) there was insufficient clarity in OSCO and the Hong Kong Police Force Procedures Manual (police manual) as to the scope of the power and the way it was to be exercised, and insufficient safeguards against abuse; and (3) there was a lack of proportionality assessment in the operation of the regime and a reasonable balance had not been struck between prevention of crime and protection of individual rights. In summary, it was held that the regime as operated: (1) was ultra vires sections 25 and 25A of OSCO, (2) was not “prescribed by law” and (3) disproportionately interfered with property rights. Interference with property rights is protected, and subject to a proportionality test, under Article 105 of the Basic Law.

The Court of Appeal decision

On appeal, the Court of Appeal held that the application for judicial review by the accountholders failed. Each of the grounds upheld by the Court of First Instance was rejected by the Court of Appeal.

In concluding that the no consent regime was not ultra vires the legislation, the Court of Appeal held that it was within the powers of the police to alert the banks for the prevention of crime and to withhold consent to deal with the funds, which was necessarily implied from the power to grant consent.

The Court of Appeal also addressed, at length, the position of a bank that “knows or has reasonable grounds to believe” that funds in an account represents proceeds of crime. The Court acknowledged that the bank owed its customers a contractual duty to comply with their instructions for the handling of an account, while having a conflicting obligation under section 25(1) of OSCO to not deal with those funds. Otherwise, the bank would risk attracting criminal liability, where the bank has the requisite knowledge or belief. The Court of Appeal noted that it was the banks themselves that made the decision to freeze the account to avoid any potential criminal liability, and that the LNCs from the police were not any direction requiring them to do so. The police are merely empowered under section 25A(2) to give consent for a bank’s dealing with the funds, which operates as a defence to section 25(1) if prior disclosure was made by the bank.

The application was by way of judicial review by the bank’s customers against the police and involved a public law legal analysis. The banks were not parties to the proceedings. The Court did not examine in detail the banks’ positions. But it noted, in general terms, how banks could alleviate their own position, and identified the importance, as between banks and customers, of the terms of customer agreements. The Court noted that a bank’s contractual duty to comply with customer instructions may be suspended by operation of law or may be contracted away by express or implied terms in the customer agreement. This analysis will always be fact-sensitive and turn on the terms of the banking contracts, which the Court noted will be for the bank and its customer to address in any civil litigation. That is, when a customer finds their account frozen as a result of their bank receiving an LNC from the police, they should turn to the bank, rather than the police, to seek redress.

The Court appeared to accept that the fact of a bank being alerted by the police of money laundering activities or receiving an LNC may not be conclusive in establishing that the bank has knowledge or reasonable ground to believe that the account balances represent criminal proceeds, particularly if the police provide little information relating to the money laundering activities in its alert or LNC.

As to the lawfulness of the LNC regime, the Court of Appeal found that the police’s operation of the no consent regime was governed by the principles and procedures in the police manual. The police manual is published and allows the public to anticipate the scope of the police’s discretion whether to give consent and the way it may be exercised. Further, this power is not without constraints. Its exercise is amenable to judicial review, and the courts have power under section 29 of OSCO to award compensation where the applicant suffers a loss due to a serious default in the investigation or prosecution.

On proportionality, the Court of Appeal held, contrary to the court below, that there was binding precedent on the Court, namely the Interush decision[3], that the no consent regime as presently operated does not disproportionately interfere with the property rights.

Analysis

This decision highlights the importance of financial institutions properly addressing their position in terms and conditions of customer agreements to deal with scenarios in which, while the financial institutions may have a suspicion that an account has proceeds of crime, sufficient to justify filing an STR, it is not clear that they have reasonable grounds to believe that this is the case. In the absence of appropriately clear and broad terms and conditions, financial institutions may face civil litigation from customers for freezing accounts even if the freezing of the accounts is based on an initial alert from the police of money laundering activities. The Court of Appeal has effectively confirmed that receiving an alert from the police of money laundering activities, filing an STR or receiving an LNC in respect of customer accounts is not necessarily sufficient to establish reasonable grounds to believe that the property in those accounts represents criminal proceeds, and to justify freezing of the accounts.

Unlike in Hong Kong, the English courts have considered these issues in a number of decisions where customers have brought civil claims against banks. The English courts have generally upheld the lawfulness of a bank’s decisions not to process customer instructions in light of potential criminal liability under Part 7 of the UK Proceeds of Crime Act 2002 (POCA). Under POCA, the United Kingdom has a regime similar to the Hong Kong no consent regime. Even in the absence of express terms and conditions, English courts have found implied terms in the banking contract permitting banks to refuse to process payments in the absence of consent from the authorities.[4] It was also held that the courts cannot interfere with the consent regime under the POCA, such as by ordering the unfreezing of the account in the absence of consent from the authorities, unless in exceptional circumstances, such as bad faith by the bank.[5] These cases put banks in a relatively strong position vis-à-vis their customers where an STR has been filed by financial institutions, particularly if there is no consent from the authorities to deal with the property in question.

It is preferable, though, in practice, to address the position in express banking terms and conditions, not least because those terms and conditions typically contain entire agreement clauses which may rule out the existence of any implied term. Typically, banks and other financial institutions have clear and wide express terms. Some provide that a financial institution may, in its “sole and absolute discretion” decide, without consultation or notification to its customers, to halt the operation of an account, and even terminate the account. A clause like this was upheld by the Hong Kong courts in Citibank N.A. v Natamon Protpakorn.[6] In Natamon Protpakorn, the courts held that these terms required a bank to act in good faith, but imposed no higher obligation.

Ideally these sorts of provisions should address five points:

• the right, in the sole discretion of the institution, to suspend or restrict the operation of the account in such manner as it considers appropriate;
• the right, in its sole discretion, to terminate the account, on reasonable notice;
• the right to take these steps unilaterally and without prior notice to the account holders;
• the right not to give any reasons for the steps taken; and
• the rights of the financial institution to take any such steps is entirely without prejudice to the financial institution’s rights (which will be found in other terms and other agreements) to exercise all its own rights against the account, such as rights of set-off, the right to impose fees and charges and the exercise of security rights.

It should be noted, though, that the exercise of other rights by the bank against the account may need its own analysis in the context of the obligation not to deal with assets in respect of which there are reasonable grounds to believe to be the proceeds of crime, without appropriate consent.

Financial institutions should also consider the following questions in establishing a reaction mechanism upon detection of potentially suspicious transactions. What is the sort of information that would give rise to “suspicion” sufficient to require the filing of an STR? What is the sort of information that would give rise to “reasonable grounds” to require the freezing of customer assets? How should a financial institution react upon receipt of any form of alert from the police, especially if that is the only relevant information it has? Does this oblige the financial institution to carry out internal investigation, and/or contact the police for more information? What if these steps do not yield additional information? A detailed and practical reaction mechanism will help put financial institutions in the best position when it faces any questions from authorities or challenges from customers with respect to how it handled the customer accounts.

Two final observations about the position of the Hong Kong Monetary Authority (HKMA)

First, the HKMA had proposed deleting the guideline that authorised institutions should act according to any LNC issued, in the amendments to its Guideline on anti-money laundering and Counter-Financing of Terrorism (For Authorised Institutions). The HKMA seems likely to suspend these proposed amendments. The original version of the Guideline provided, in relation to LNCs, that a bank in receipt of an LNC must “act according to the contents of the letter”. An LNC contains only a negative confirmation, i.e., that no consent is given for the purposes of section 25A(2) of OSCO and the parallel provisions in the other legislation. This guidance does not really advance matters. Upon receipt of an LNC, a bank must proceed on the basis that, as the LNC confirms, it has no consent for the purposes of section 25A(2) of OSCO and must proceed in accordance with its own assessment of what is appropriate applying section 25(1) to the specific circumstances.

Secondly, we see no risk that the HKMA would be concerned about banks protecting themselves, in the context of the AML framework in Hong Kong, by having very wide powers to act in their sole and absolute discretion in determining whether or not to restrict, suspend or even terminate an account in the context of suspicions about an account. All that is said by the HKMA in their circular dated September 8, 2016 is that banks should not close an account using AML/CFT as the ground when it is actually for other considerations.

Conclusion

As a concluding remark, all organizations (not just banks) which hold client or customer funds or other assets from time to time are recommended to:

i. review the adequacy of their terms and conditions dealing with restriction, suspension and termination of accounts; and

ii. refresh their procedures for dealing with STRs, requests for consent under section 25A(2) of OSCO and the receipt of LNCs.