Hong Kong: Return of a key tool to protect victims of cyber fraud?

In brief

Cyber fraud continues to pose a significant threat to businesses and individuals in Hong Kong and elsewhere around the world. According to the official statistics for Hong Kong, 2022 saw a significant increase of deception cases of over 8,000 cases, over 70% of which were Internet-related.

The Hong Kong Police has developed a 'No Consent Regime' ("Regime"), which encompassed a practice of issuing so-called 'Letters of No Consent' (LNCs) to banks for accounts which contain suspected proceeds of crime, thereby triggering informal bank freezes on these accounts.

In December 2021, the Court of First Instance (CFI) held that the Regime as operated by the Police under the Organised and Serious Crimes Ordinance (Cap. 455) (OSCO) was unlawful. The Commissioner of Police then appealed against this decision.

The Court of Appeal (CA) handed down its judgment in April 2023, allowing the appeal and setting aside the declaration that had been made by the CFI.

While it is unclear whether the case will be taken to the Court of Final Appeal, there are points in the CA's judgment which are of significance to financial institutions and victims of financial crime.


Contents

Key takeaways

This is a positive development for victims of cyber fraud and financial crime, as LNCs often act as a useful stopgap in preventing the further dissipation of funds, due to the relatively short time it takes for the Police to issue an LNC.

Banks and financial institutions, on the other hand, should periodically review their terms and conditions to ensure their adequacy and flexibility in enabling them to take the necessary measures for tackling money laundering issues. Ineffective safeguards or loosely drafted provisions can be a recipe for disaster as they may expose banks and financial institutions to potential criminal liability (where they deal with illicit funds with the requisite knowledge or suspicion), as well as potential civil liability (where they refuse to comply with a client instruction to release the funds without the contractual power to do so).

In more detail

The Regime

Our previous alerts on this matter (here and here) explained the Police's long-standing practice of issuing LNCs to effect informal freezes on bank accounts that they suspect contain proceeds of crime. The way the Police operated the Regime meant that they could potentially freeze property indefinitely without being subject to any procedural safeguards or judicial oversight. This led to the present judicial review.

Tam Sze Leung & Ors v Commissioner of Police

The applicants in this case were four account holders who were suspected of involvement in market manipulation by way of a 'pump and dump' scheme. In November 2020, the relevant banks were notified of the investigation by the authorities and were urged to file Suspicious Transaction Reports (STRs), which they did. The Police then issued LNCs over the subject bank accounts in December 2020, which led to the banks freezing the funds in the accounts.

The freeze was maintained over the accounts for approximately 10 months and was only lifted upon the Police's successful application for restraint orders against the applicants and the accounts.

The account holders sought leave to apply for judicial review against the Regime on several grounds. The CFI accepted some, but not all, of these grounds and made declarations giving effect to its findings that the Regime "as operated by the Police Commissioner" are: (i) ultra vires of ss.25 and 25A (the anti-money laundering provisions of) OSCO; and (ii) incompatible with constitutional rights to property under Articles 6 and 105 of the Basic Law, as the Regime as operated by the Police is not prescribed by law and is disproportionate.

The Court of Appeal

The CA disagreed and set aside the declarations made by the CFI. Although the CA covered the different grounds, it primarily focused on the "ultra vires" (and "improper purpose", as a related ground) and "prescribed by law" grounds in its judgment.

Ultra vires / improper purpose grounds

The CA held that it is within the Police's powers to refuse consent under s.25A(2)(a) of OSCO, i.e., it is not ultra vires to (i) alert banks of potential money laundering offences and request that they file STRs or (ii) inform banks that they do not have the Police's consent to deal with certain funds by way of an LNC.

The CA's reasoning was that the relevant accounts were "frozen" not because of any mandatory freezing order made by the Police, but because of the banks’ own decisions to refuse to comply with their customers’ instructions due to the risk of exposing themselves to criminal liability under s.25 of OSCO.

The CA also held that the LNCs were not issued for "an improper purpose" as the purpose was to prevent dissipation of funds in accounts while a Police investigation was ongoing and was done in the circumstances where the Police had reasonable suspicion that the property is derived from criminal conduct.

Prescribed by law grounds

The CA also ruled that s.25(1) of OSCO was neither uncertain nor vague. There are sufficient constraints imposed on the exercise of discretion by the Police in giving or refusing consent under s.25A OSCO (e.g., that its power must be exercised in good faith), and sufficient signposts for people to anticipate the scope of the discretion and manner of its exercise, such as the Police's manuals and procedures governing the issuance of LNCs.

Other observations

The CA emphasized that the decision whether to freeze the account lies with the bank and that the customer may pursue civil remedies and/or interlocutory relief if the bank refuses to comply with instructions, or freezes an account without having any knowledge or proper suspicion to do so.

Banks and financial institutions need to be on the lookout for potential signs of money laundering and exercise their own judgment in deciding whether the circumstances at hand would warrant an account freeze. It is also vital for banks and financial institutions to review their terms and conditions periodically, to ensure their adequacy and flexibility in enabling them to take the necessary measures when faced with money laundering suspicions involving client accounts.

The CA noted that where the Police act contrary to their own guidelines, it would prima facie be a ground for judicial review of the action. Therefore, although the Police have the power to issue LNCs, such power is not unfettered and can be subject to challenge.

Concluding remarks

Victims of cyber fraud and financial crime should ensure that their reports to the relevant banks and the Police are swiftly made, and contain sufficient information of the suspicious circumstances to trigger an informal freeze (whether or not pursuant to an LNC).

It is important to note that an LNC does not have the same legal effect as an injunction, as it does not impose any mandatory obligation to freeze and does not in itself carry any penal consequence if the bank takes a different view and decides not to freeze the account.

Although an LNC will often achieve the same practical effect as an injunction (as banks will generally err on the side of caution and freeze the account when faced with an LNC), victims of financial crime should not view it as a complete substitute to an injunction. Injunctions come in many different forms and variations (e.g., proprietary or Mareva injunctions), and they can often be more adequate and flexible in mitigating the risks at hand, particularly in cases where there are substantial amounts at stake.

Contact Information
Gary Seib
Partner at BakerMcKenzie
Hong Kong
gary.seib@bakermckenzie.com
Gillian Lam
Senior Associate
Hong Kong
gillian.lam@bakermckenzie.com
Victor Yip
Senior Associate
Hong Kong
victor.yip@bakermckenzie.com

Copyright © 2024 Baker & McKenzie. All rights reserved. Ownership: This documentation and content (Content) is a proprietary resource owned exclusively by Baker McKenzie (meaning Baker & McKenzie International and its member firms). The Content is protected under international copyright conventions. Use of this Content does not of itself create a contractual relationship, nor any attorney/client relationship, between Baker McKenzie and any person. Non-reliance and exclusion: All Content is for informational purposes only and may not reflect the most current legal and regulatory developments. All summaries of the laws, regulations and practice are subject to change. The Content is not offered as legal or professional advice for any specific matter. It is not intended to be a substitute for reference to (and compliance with) the detailed provisions of applicable laws, rules, regulations or forms. Legal advice should always be sought before taking any action or refraining from taking any action based on any Content. Baker McKenzie and the editors and the contributing authors do not guarantee the accuracy of the Content and expressly disclaim any and all liability to any person in respect of the consequences of anything done or permitted to be done or omitted to be done wholly or partly in reliance upon the whole or any part of the Content. The Content may contain links to external websites and external websites may link to the Content. Baker McKenzie is not responsible for the content or operation of any such external sites and disclaims all liability, howsoever occurring, in respect of the content or operation of any such external websites. Attorney Advertising: This Content may qualify as “Attorney Advertising” requiring notice in some jurisdictions. To the extent that this Content may qualify as Attorney Advertising, PRIOR RESULTS DO NOT GUARANTEE A SIMILAR OUTCOME. Reproduction: Reproduction of reasonable portions of the Content is permitted provided that (i) such reproductions are made available free of charge and for non-commercial purposes, (ii) such reproductions are properly attributed to Baker McKenzie, (iii) the portion of the Content being reproduced is not altered or made available in a manner that modifies the Content or presents the Content being reproduced in a false light and (iv) notice is made to the disclaimers included on the Content. The permission to re-copy does not allow for incorporation of any substantial portion of the Content in any work or publication, whether in hard copy, electronic or any other form or for commercial purposes.