Hong Kong Money Laundering "No Consent Regime", aka Administrative Freeze of (Suspected) Defrauded Sums, Upheld by the Court of Appeal

Introduction: The Problem

Your client (whether overseas or local, and whether institutional or individual - I have assisted each of these categories) is a victim of (cyber)fraud. Money has been transferred from the client's bank account to, or via, a Hong Kong bank account of, or designated by, the fraudster. You or your client has been informed that the money is now sitting (en route) in such Hong Kong bank account. You need to freeze the money fast - many a time, even before you have a chance to take full proper instructions or to obtain a civil injunction - since monies in (Hong Kong) bank accounts can and do travel fast, and the last thing your client wants is for the defrauded sum to disappear into an out-of-Hong Kong account, or otherwise to become no longer traceable.

The Pre-existing Solution

One fast (enough) way of going about this is, effectively, to enlist the assistance of Hong Kong law enforcement agencies. They would often also be the source of information on which (Hong Kong) bank account(s) the defrauded sum can be found inside. The way this would usually work is essentially as follows:

1. The Police has received information (whether on their own investigation or pursuant to reports / intelligence from overseas etc.) that the defrauded sum is (suspected to be) sitting in certain Hong Kong bank account(s).
2. It notifies the relevant bank(s) of this, alerting it / them to potential money laundering offences and requesting for a suspicious transaction report ("STR") to be filed by each.
3. After the filing of the required STR, the Police issues a so-called "letter of no consent" ("LNC") to each of the banks, refusing consent to any such bank to deal with the (suspected) defrauded sum or any part thereof (such as paying any part of the sum out to the bank's customer or designated payee).
4. Each of the relevant banks complies with such non-consent (or otherwise face the real possibility of criminal conviction and punishment) by freezing the relevant sum in the account.
5. The Police advises you / your client of the above and suggests that your client proceed to obtain a civil injunction going forward.

This result would usually be (a) quick enough for the client and (b) achieved even before the client is in a position to obtain any civil injunction.

However, in Tam Sze Leung v Commissioner of Police [2022] 1 HKLRD 480, [2021] HKCFI 3118, Coleman J, the Judge in charge of the Constitutional and Administrative Law List, concluded that the above regime ("Regime") as operated was ultra vires and not "prescribed by law", and disproportionately interfered with rights, and in particular to the right to the use of property.

If this judgment were upheld and implemented, then, pending the Government working out an alternative, lawful / compliant regime, Hong Kong would effectively have lost a practically significant "interim-interim freezing relief" in civil (cyber)fraud cases.

This Appeal: Takeaway Point

In the circumstances, the Government appealed. By its Judgment dated 14 April 2023 [2023] HKCA 537, the Hong Kong Court of Appeal ("HKCA") allowed the appeal, effectively confirming the constitutionality and legality of the Regime. This is welcome news and, frankly, a big sigh of relief for civil (cyber)fraud practitioners in Hong Kong and their victim-clients: the Regime can continue to operate as is, (suspected) defrauded sums can continue to be administratively frozen by Hong Kong banks as a de facto "interim-interim measure" - vital to their recovery - and victim-clients can have their time to obtain the necessary civil injunctions and launch their civil recovery proceedings.

The Detail: The Regime

Section 25A(1) of the Organized and Serious Crimes Ordinance (Cap. 455) ("OSCO") mandates that "[w]here a person [such as a bank] knows or suspects that any property—

???????(a) in whole or in part directly or indirectly represents any person’s proceeds of;

???????(b) was used in connection with; or

???????(c) is intended to be used in connection with,

???????an indictable offence, he shall as soon as it is reasonable for him to do so disclose that knowledge or suspicion, together with any matter on which that knowledge or suspicion is based, to an authorized officer."

The sequence of events as to how the Regime operates in practice have been recounted by the Court (at paras 8 - 10, 25):

1. "... Such disclosure is in practice referred to as a [STR].?Within the Government, the Joint Financial Intelligence Unit ('JFIU'),... jointly staffed by the police and the Customs & Excise Department with a Superintendent of the police as its Head, is the designated unit to receive and analyse STRs and disseminate them to local or overseas law enforcement agencies or financial intelligence units worldwide". If the bank itself knows or suspects a sum in an account held by it represents proceds of (cyber)fraud, it should and would usually proactively file the required STR; if it did not initially so know or suspect, then, as mentioned above, the Police itself would alert the bank of this and request the bank to file the STR.
2. "Under section 25A(2)(a) an authorised officer may give consent for an act to be done [which would otherwise have constituted dealing with property known or believed to represent proceeds of indictable offence criminalised under section 25(1), e.g. for a bank to release money otherwise suspected to represent proceeds of an indictable offence in an account to its customer].... [B]y internal arrangement only the Head of JFIU may exercise that power to give or withhold consent.?The power is exercised after an STR is received." Where such consent is given, the said act can of course be done.
3. "Where [however] consent is not given,... in practice the Head of JFIU issues a... [LNC], to the relevant financial institution that filed the STR." The LNC usually states, among other things: "In my capacity as an Authorized Officer..., I wish to inform you that you do NOT have my consent to further deal with funds in the account... since the funds in the account is believed to be crime proceeds".
4. "Upon receiving an STR from a financial institution, the JFIU may send it to an appropriate investigating unit in the police if it requires follow-up action.?The Superintendent commanding that unit ('SPI') has to decide within 2 working days (extendable in exceptional circumstances) whether consent for dealing with the property should be refused and, if so, to make a written request, with justifications, to the JFIU for an LNC to be issued.?If the SPI does not act within 2 working days, the JFIU will issue a letter giving consent for the financial institution to deal with the property."
5. "After the LNC is issued, the investigating unit should make their best endeavours to obtain a restraint or confiscation order as soon as practicable or advise the victim to apply for a civil injunction."
6. "Each LNC must be reviewed every month by the SPI and, after 3 months, by the Formation Commander.... An LNC should normally last no more than 6 months.?Before the expiry of the 6-month period, the Formation Commander should critically review the case to decide whether there are exceptional circumstances to justify the LNC going beyond that period."

The Detail: Why the Regime is Intra Vires

Numerous public law grounds had been raised by the parties and canvassed in the HKCA's Judgment; this Article focuses on the ultra vires ground, not only because it was a principal ground but also since it involved an in-depth legal analysis of the Regime.

The Court (at paras 54 - 58, 62 - 67) held pertinently that:

• "Money in a bank account is a debt owed by the bank to the customer, and as such a chose in action and thus 'property' within the meaning of the OSCO. A bank will have 'dealt' with such property if it repays that debt, such as by releasing funds to the customer or transferring them to his order.?It is the bank who owes a debt to its customer and the bank who has immediate control of its funds.?Whether or not it pays out funds to a customer or to his order when instructed by the customer to do so is a matter decided by the bank in the performance of its contract with the customer."
• "Where the bank possibly 'knows or has reasonable grounds to believe' that the account balance represents proceeds of crime, the risk for it is that it may be held criminally liable under section 25(1) if it releases the money to the customer.?In addition, where a bank 'knows or suspects' that the account balance represents proceeds of crime or was used or is intended to be used in connection with crime, it is required by section 25A(1), on pain of punishment, to make disclosure to an authorised officer."
• "This puts the bank in an unenviable position. On the one hand, it has contractual duties to and a commercial relationship with its customer, who is entitled to give instructions for operating his account.?On the other hand, it may incur criminal liability if it releases any funds with the requisite mental element."
• "The bank’s position may be alleviated in two ways.?First, the bank’s contractual duties may be suspended by operation of law where their performance has been rendered temporarily illegal by statute: K Ltd v National Westminster Bank plc [2007] 1 WLR 311, §11; alternatively, its duties may be tempered by an implied term that it can refuse to operate the account in any way where to do so may expose it or its staff to criminal liability, or by similar express terms.?Where these conditions apply, the bank may refuse to follow the customer’s instructions without incurring civil liability.?Whether, on the facts of a particular case, the bank is so entitled is a matter of contract law that can be resolved in civil litigation between the bank and the customer: see Garnet, §§42 & 58; Amalgamated Metal Trading Ltd v City of London Police Financial Investigation Unit [2003] 1 WLR 2711, §27.?For actual examples of these contests, see Squirrell Ltd v National Westminster Bank plc [2006] 1 WLR 637; K Ltd v National Westminster Bank plc, supra; Shah v HSBC Private Bank (UK) Ltd [2010] EWCA Civ 31; Lonsdale v National Westminster Bank plc [2018] EWHC 1843; see also Crown Aim Ltd v UCO Bank [2020] HKCFI 212 which concerned a bank’s decision to suspend a customer’s account due to investigations by foreign authorities."
• "[S]ection 25A(2) provides that a bank is not criminally liable under section 25(1) for releasing funds to a customer (even with the requisite mental element) if either (a) it makes disclosure pursuant to section 25A(1) before releasing the funds and it releases the funds with the consent of an authorised officer; or (b) it makes disclosure pursuant to section 25A(1) after releasing the funds, on its initiative, and as soon as reasonable.?These two limbs of section 25A(2) provide protection to the bank from criminal liability where it is minded to release funds pursuant to the customer’s instruction.?The practice of issuing letters of consent and LNCs stems from the first limb.?(Section 25(2) further provides a defence where the bank intended to make disclosure and there is reasonable excuse for its failure to make disclosure.) "
• "[T]he correct legal analysis is that... the account is 'frozen' not because there is any enforceable order made by the police (like a Mareva injunction granted by a civil court) that blocks the account, but because the bank has chosen, whether or not permissibly under the banking contract, not to comply with its customer’s instruction, no doubt due to its concern about criminal liability under section 25(1) for dealing with property that represents proceeds of crime.?The withholding of consent no more 'freezes' an account than the giving of consent compels the bank to release money.?The police have no power to require the bank to do anything.?What the police are empowered by the statute to do is to give consent, as an authorised officer, for an act in contravention of section 25(1), i.e. a dealing with the property.?Coupled with prior disclosure under section 25A(1), such consent immunises the bank from criminal liability under section 25(1)."
• "[T]he steps taken by the Commissioner in this case... [e]ssentially... are two: (1) first, the police sent emails to three of the Banks..., alerting them to potential money laundering offences and requesting for STRs; (2) after the Banks filed STRs, the police issued LNCs to them."
• "As to (1),... [i]f [the police] reasonably suspect that a criminal has put the fruits of crime in a bank account, they would be acting within their duties to try to prevent him from using the money, for that would be a further crime of money laundering contrary to section 25(1)... [T]he police have the power to alert financial institutions to potential money laundering offences by informing them of suspicions arising from the police’s own investigations."
• Turning to (2), "the issuance of LNCs [cannot] be said to be ultra vires....?The police have the power to refuse consent and it is not ultra vires for them to inform a bank, as they do in practice by an LNC, that in relation to a particular account, the bank does not have the police’s consent to deal further with the funds in that account."
• "Alerting the banks to relevant investigations and suspicions is admittedly within the power of the police."
• "The subsequent issuance of an LNC simply informs the bank it does not have immunity under section 25A(2)(a) to deal with the funds.?Even if no LNC is issued..., the fact remains that no consent has been given by an authorised officer.?The bank will remain unprotected by section 25A(2)(a), and insofar as it considers it is exposed to criminal liability under section 25(1), it will in all probabilities continue to 'freeze' the account."

For these and other reasons, the HKCA restored the Regime's constitutionality and legality, thereby enabling Hong Kong civil fraud practitioners to continue helping their clients speedily to preserve their valuable assets in Hong Kong bank accounts, and to launch meaningful (and fruitful) civil freezing / tracing / recovery proceedings.