Hong Kong

KYB in Hong Kong: Complete Compliance Guide (2025)

Complete guide to Hong Kong KYB requirements: ICRIS verification, SCR (Significant Controllers Register), AMLO compliance, document requirements, and regulator-specific obligations.

15 min read
Quickyb Team
#Hong Kong #KYB #ICRIS #SCR #compliance #AMLO

KYB in Hong Kong: Complete Compliance Guide (2025)

Hong Kong compliance checklist:

  • Verify via ICRIS (Companies Registry)
  • Check Business Registration Certificate (current and valid)
  • Identify Ultimate Beneficial Owners via SCR (≥25%)
  • Screen directors and authorized signatories
  • Conduct risk screening (sanctions, PEP, adverse media)
  • Document decisions and maintain records

Quick Navigation:

Overview

Why are Hong Kong KYB requirements unique?

Hong Kong has a sophisticated regulatory framework for business verification, combining international AML/CFT standards with local requirements specific to companies registered in Hong Kong.

Key differences from other jurisdictions:

Two-number system

  • Hong Kong companies have BOTH a 7-digit Company Number (Companies Registry) and a Business Registration Number (BRN) (Inland Revenue Department)
  • Both must be verified and must match documents provided

Significant Controllers Register (SCR)

  • Mandatory since March 2018 under the Companies Ordinance
  • All companies must identify individuals with ≥25% ownership/control
  • Non-compliance penalties up to HK$50,000 (individuals) and HK$250,000 (companies)

ICRIS (Integrated Companies Registry Information System)

  • Centralized online portal for all Hong Kong company searches
  • Real-time access to company documents (NNC1, NAR1, ND2A, etc.)
  • Pay-per-search model (HK$20-40 per document)

Annual return filing requirements

  • NAR1 must be filed annually within 42 days of incorporation anniversary
  • Late filings are common but indicate compliance issues
  • Most recent NAR1 is critical for current directorship information

Who needs to comply with Hong Kong KYB requirements?

Under AMLO Cap. 615 (Anti-Money Laundering Ordinance):

  • Banks and deposit-taking companies (HKMA-regulated)
  • Payment service operators and SVF license holders
  • Money services operators (MSOs)
  • Securities and futures brokers (SFC-licensed)
  • Designated non-financial businesses and professions (DNFBPs)
  • Insurance companies and intermediaries
  • Trust or company service providers (TCSPs)

Voluntary compliance recommended for:

  • B2B platforms and marketplaces
  • Fintech companies
  • Corporate service providers
  • Real estate agents (if not already DNFBPs)
  • Professional service firms (lawyers, accountants)

New to KYB? Start with our comprehensive guide: What is KYB? The Complete FAQ Guide to understand the fundamentals before diving into Hong Kong-specific requirements.

Process

Hong Kong KYB verification process

Step 1: Verify via ICRIS

Search the company on ICRIS to confirm:

  • Company incorporation number (7 digits)
  • Business Registration Number (BRN)
  • Current status (active, dissolved, struck off, registered non-Hong Kong company)
  • Date of incorporation and company type
  • Registered office address in Hong Kong

Red flag: Company doesn’t appear in ICRIS or is listed as “dissolved” or “struck off”

Step 2: Retrieve core documents

For Hong Kong limited companies:

  • Business Registration Certificate — Must be current (renewed annually)
  • Certificate of Incorporation — Proves legal existence
  • NNC1 (Incorporation Form) — Initial directors and shareholders
  • NAR1 (Annual Return) — Most recent filing with current information
  • Articles of Association — Company constitution and rules
  • SCR (Significant Controllers Register) — UBO identification

For sole proprietorships and partnerships:

  • Business Registration Certificate — Shows owner details
  • Proof of identity — Hong Kong ID or passport of owners

Step 3: Identify Ultimate Beneficial Owners (UBOs)

Request the SCR from the company. Hong Kong law requires all companies to maintain this register identifying:

  • Anyone owning ≥25% of issued shares (direct or indirect)
  • Anyone holding ≥25% of voting rights
  • Anyone with right to appoint/remove majority of directors
  • Anyone exercising significant influence or control

Trace through corporate shareholders:

  • If another company owns shares, trace that company’s ownership
  • Continue until you reach natural persons (humans, not companies)
  • Aggregate ownership percentages across all ownership paths

Step 4: Verify directors and authorized signatories

Cross-check names against:

  • Most recent NAR1 (annual return) filed with Companies Registry
  • NNC1 for initial directors (compare to identify changes)
  • ND2A filings (notices of director changes)

Verify authority:

  • Who’s authorized to sign on behalf of the company?
  • Board resolutions if needed
  • Company secretary details

Step 5: Conduct risk screening

Screen the following against sanctions, PEP, and adverse media lists:

  • Company entity (name + registration number)
  • All UBOs identified via SCR
  • All directors and authorized signatories
  • Company secretary (if applicable)

Hong Kong-specific considerations:

  • Check for Hong Kong Monetary Authority (HKMA) enforcement actions
  • Check Securities and Futures Commission (SFC) disciplinary records
  • Review Hong Kong court judgments and insolvency records

Step 6: Assess risk and document

Make a risk-based decision:

  • Low risk — Standard KYB completed, proceed
  • Medium risk — Enhanced monitoring required
  • High risk — Enhanced Due Diligence (EDD) or decline

Document everything:

  • ICRIS search results and document copies
  • SCR information provided
  • Risk screening results
  • Decision rationale with supporting evidence

How long does Hong Kong KYB take?

Simple cases: 1-2 days

  • Local Hong Kong company
  • Clear ownership structure (no corporate shareholders)
  • All documents available via ICRIS
  • No adverse flags

Standard cases: 3-5 days

  • Hong Kong company with some corporate shareholders
  • Need to request SCR directly from company
  • Additional verification steps required

Complex cases: 1-3 weeks

  • Multi-layer ownership (Hong Kong company → BVI company → other jurisdictions)
  • Registered non-Hong Kong companies with Hong Kong presence
  • Cross-border elements and international shareholders
  • Incomplete documentation or language barriers

What slows things down:

  • Waiting for company to provide SCR (not public)
  • Tracing through offshore companies (BVI, Cayman, etc.)
  • Verifying parent companies in other jurisdictions
  • Translating documents (different languages)
  • Manual review of complex ownership structures

ICRIS Guide

How to search Hong Kong companies using ICRIS

ICRIS (Integrated Companies Registry Information System) is Hong Kong’s official online company search portal, maintained by the Companies Registry.

Search options:

  • Company name — Exact or partial match
  • Company incorporation number — 7-digit number
  • Business Registration Number (BRN) — 8-digit number (may include prefix)

Information available via ICRIS

Current company status:

  • Active / Not active
  • Dissolved / Struck off
  • Registered non-Hong Kong company
  • Winding up proceedings

Company details:

  • Incorporation date
  • Company type (private limited, public limited, etc.)
  • Registered office address
  • Company secretary information

Directors and officers:

  • Current directors
  • Past directors (history available)
  • Company secretaries

Share capital:

  • Authorized share capital
  • Issued share capital
  • Share classes and par value

Filed documents (available for download):

  • NNC1 — Incorporation Form
  • NAR1 — Annual Return (most recent and historical)
  • ND2A — Change of directors/company secretary
  • ND2B — Change of registered office
  • ND4 — Alteration of Articles of Association
  • NR1 — Return of allotments
  • NR2 — Location of Significant Controllers Register
  • Mortgage and charges documents

Access options and pricing

Cyber Search Centre (online):

  • Pay-per-search model
  • Most documents: HK$20-40 per document
  • Real-time search available (premium)
  • Account registration required
  • Credit card payment accepted

Company Search Mobile Service:

  • Mobile app for basic searches
  • Reduced functionality compared to web portal
  • Same pricing structure

Registered search users:

  • Bulk search accounts for frequent users
  • Monthly billing options
  • API access available for enterprise users
  • Suitable for high-volume KYB operations

Cost examples:

  • Basic company search: HK$20
  • Document image (NNC1, NAR1, etc.): HK$40
  • Annual return: HK$40
  • Real-time search: Premium pricing

Access ICRIS

ICRIS search tips for KYB

Always verify:

  • BRN on Business Registration Certificate matches ICRIS
  • Company incorporation number is valid (7 digits)
  • Company status is “Active” (not dissolved or struck off)
  • Registered office address matches documents provided

Request the most recent NAR1:

  • Shows current directors and shareholders
  • Filed annually, so usually within 12 months
  • Critical for verifying current ownership

Check filing history:

  • Late NAR1 filings indicate compliance issues
  • Frequent ND2A filings (director changes) are a red flag
  • No recent filings may indicate inactive company

Cross-check with SCR:

  • Companies must file NR2 stating where SCR is kept
  • Request SCR from company directly
  • Verify UBOs listed in SCR against NAR1 shareholders

SCR Requirements

Hong Kong Significant Controllers Register (SCR)

The Significant Controllers Register (SCR) is Hong Kong’s UBO identification requirement, effective since March 2018 under the Companies Ordinance (Cap. 622).

Who must maintain an SCR?

Required for:

  • All Hong Kong incorporated companies (limited companies)
  • Registered non-Hong Kong companies (foreign companies registered in HK)

Exemptions (very limited):

  • Public companies listed on Hong Kong Stock Exchange (HKEX) — have separate disclosure requirements
  • Companies covered by other prescribed legislations

Who counts as a “significant controller”?

A person (individual or legal entity) is a significant controller if they meet ANY of these criteria:

Ownership thresholds:

  • Owns ≥25% of issued shares (direct or indirect)
  • Holds ≥25% of voting rights
  • Has right to appoint or remove majority of directors

Control thresholds:

  • Exercises significant influence or control over the company
  • Has absolute trust (for trusts) over the company

Important: Legal entities can be significant controllers too (e.g., Company B owns 30% of Company A). You must trace through until you find the natural persons.

SCR requirements

What the register must contain:

For individual significant controllers:

  • Full legal name
  • Hong Kong ID card number OR passport number
  • Residential address (can be partial address for privacy)
  • Nature of control (ownership, voting rights, director appointment, etc.)
  • Date became a significant controller

For legal entity significant controllers:

  • Legal name
  • Registered office address
  • Legal form (e.g., limited company, partnership)
  • Registration number/jurisdiction
  • Nature of control
  • Date became a significant controller

Required documents:

  • SCR register itself (maintained at registered office)
  • Form NR2 — Notice of location of Significant Controllers Register (filed with Companies Registry)
  • Supporting identification documents for controllers

SCR compliance obligations

Maintenance:

  • Keep SCR at company’s registered office in Hong Kong
  • Update within 7 days of any change
  • Retain records for specified period

Inspection rights:

  • Law enforcement officers can inspect without warrant
  • Company members can inspect (with restrictions)
  • Designated officers can inspect for compliance purposes

Filing requirements:

  • File Form NR2 stating where SCR is kept (initial filing)
  • Update NR2 if location changes
  • No annual filing required (unlike NAR1)

Penalties for non-compliance

For individuals:

  • Fine up to HK$50,000
  • Additional daily fine for continued non-compliance

For companies:

  • Fine up to HK$250,000
  • Additional daily fine for continued non-compliance
  • Potential prosecution

Enforcement:

  • Companies Registry can issue compliance notices
  • Inspectors can investigate and penalize
  • Court action possible for serious breaches

SCR for KYB purposes

Why request the SCR:

  • Identifies UBOs who may not appear in NAR1 (nominee directors vs. real owners)
  • Legal requirement means companies should have it readily available
  • More up-to-date than NAR1 (which is only filed annually)
  • Shows complete ownership picture, including indirect control

How to request:

  • Ask company directly during KYB process
  • Legitimate companies should provide SCR information for compliance purposes
  • SCR is not public, but must be shared for AML/CFT verification
  • Consider requesting a copy of the SCR for your records

Red flags:

  • Company refuses to provide SCR information
  • SCR hasn’t been updated (changes not recorded within 7 days)
  • SCR doesn’t match NAR1 information
  • Nominee directors listed but no individual UBOs identified

Regulators

Hong Kong KYB regulators and legislation

Anti-Money Laundering Ordinance (AMLO) Cap. 615

Principal legislation for AML/CFT in Hong Kong

Scope:

  • Sets Customer Due Diligence (CDD) requirements
  • Applies to financial institutions and DNFBPs
  • Establishes record-keeping requirements
  • Defines enforcement powers and penalties

Key requirements:

  • Verify business customers before onboarding
  • Identify Ultimate Beneficial Owners (≥25% threshold)
  • Conduct ongoing monitoring of business relationships
  • Maintain records for 5 years after relationship ends

Penalties:

  • Fines up to HK$1,000,000 for individuals
  • Fines up to HK$10,000,000 for companies
  • License suspension or revocation
  • Criminal prosecution for serious breaches

Authoritative sources:

Companies Registry

Maintains official business records for all Hong Kong companies

Responsibilities:

  • Incorporation and registration of companies
  • Maintenance of ICRIS system
  • Oversight of SCR compliance
  • Public registry services

For KYB purposes:

  • Primary source for company verification
  • ICRIS provides access to all filed documents
  • Registers company charges and mortgages
  • Issues certificates of incorporation

Contact:

Hong Kong Monetary Authority (HKMA)

Regulates banks and deposit-taking companies

KYB/CDD requirements:

  • Comprehensive CDD for all business customers
  • Enhanced due diligence for high-risk relationships
  • Ongoing monitoring and periodic reviews
  • Record-keeping and reporting obligations

Guidelines and circulars:

  • CG-1: Authorization of banks
  • TM-1: AML/CFT Guideline for Authorized Institutions
  • Various circulars on CDD requirements

Enforcement:

  • Supervisory reviews and on-site inspections
  • Enforcement actions for non-compliance
  • Monetary penalties
  • Disciplinary actions against bank staff

Authoritative sources:

Securities and Futures Commission (SFC)

Regulates securities and futures markets

KYB requirements for licensed corporations:

  • CDD for all corporate clients
  • Identification of beneficial owners
  • Risk-based approach to CDD
  • Enhanced due diligence for high-risk clients

Guidance:

  • Circular on CDD requirements for corporate clients
  • Code of Conduct requirements
  • AML/CFT Guide for Management of Licensed Corporations

Enforcement:

  • Compliance inspections
  • Enforcement actions for breaches
  • Suspension or revocation of licenses
  • Prosecution for serious offences

Authoritative sources:

Customs and Excise Department

Regulates Money Services Operators (MSOs)

KYB requirements for MSOs:

  • CDD before providing money services
  • UBO identification for business customers
  • Transaction monitoring
  • Suspicious transaction reporting

Licensing:

  • MSO license required for money changers, remittance agents, etc.
  • AML/CFT compliance condition for license
  • Regular compliance reviews

Authoritative sources:

Sector-specific requirements

Financial services and banking:

  • Regulator: HKMA
  • Requirements: AMLO Cap. 615 + HKMA guidelines
  • Enhanced scrutiny for high-risk jurisdictions

Payment services and fintech:

  • Regulator: HKMA (for SVF) + Customs (for MSO)
  • Requirements: Payment Systems and Stored Value Facilities Ordinance (Cap. 584)
  • AML/CFT compliance condition for licensing

Securities and futures:

  • Regulator: SFC
  • Requirements: Securities and Futures Ordinance (Cap. 571) + SFC AML/CFT Guide
  • Corporate client due diligence mandatory

DNFBPs (casinos, real estate, lawyers, accountants):

  • Regulator: Various (sector-specific)
  • Requirements: AMLO Cap. 615
  • Sector-specific guidance from relevant regulators

Red Flags

Hong Kong-specific red flags for KYB

Company status red flags

Critical (reject or require explanation):

  • Company status: “Dissolved” or “Struck off”
  • Company in winding-up or liquidation proceedings
  • Business Registration Certificate expired (not renewed annually)
  • No ICRIS record exists

Warning signs (enhanced scrutiny):

  • Frequent changes in directors (multiple ND2A filings)
  • Late NAR1 filings (indicates poor compliance culture)
  • Registered office address is only a P.O. box
  • No physical presence or employees

Document red flags

Business Registration Certificate issues:

  • Expired BRN (renewable annually, so should never be expired)
  • BRN prefix doesn’t match business type (e.g., “1” for local companies)
  • Photocopy appears altered or forged
  • BRN on documents doesn’t match ICRIS record

Annual Return (NAR1) issues:

  • Most recent NAR1 is more than 18 months old
  • NAR1 was filed late (check anniversary date)
  • No NAR1 filings on record (should be filed annually)
  • Shareholder information doesn’t match SCR

Incorporation Form (NNC1) issues:

  • Only NNC1 available (company may be shell, no activity since incorporation)
  • No subsequent filings or changes since incorporation
  • Incorporation date is recent (<3 months) with complex structure

Ownership and control red flags

SCR issues:

  • Company refuses to provide SCR
  • SCR hasn’t been updated (changes not recorded)
  • Only nominee directors listed, no individual UBOs identified
  • Legal entity controllers but no natural persons traced

Complex ownership structures:

  • Multiple layers of Hong Kong companies owning each other
  • Ownership through offshore jurisdictions (BVI, Cayman, etc.)
  • Trust structures with no identifiable beneficiaries
  • Corporate shareholders with no UBO identification

Director and signatory red flags

Nominee directors:

  • Directors with Hong Kong IDs but no apparent connection to business
  • Multiple directorships across many unrelated companies
  • Professional nominee service providers listed as directors
  • Director addresses are all the same (service company address)

Authorized signatory issues:

  • Person signing not listed as director or authorized signatory
  • No board resolution authorizing signatory
  • Company secretary cannot confirm signatory authority

Geographic red flags

Registered office issues:

  • Address is only a P.O. box or mail forwarding service
  • Multiple companies registered at same address (hundreds or thousands)
  • Address is in industrial building with no office presence
  • No one answers phone at registered office

Physical presence:

  • No website or online presence
  • Phone number disconnected or invalid
  • Email address uses free email service (Gmail, Yahoo, etc.)
  • No employees or staff listed

Compliance and regulatory red flags

Regulatory actions:

  • HKMA enforcement actions (for banks/payment firms)
  • SFC disciplinary records (for securities firms)
  • Customs MSO license issues or revocations
  • Companies Registry penalties or compliance notices

Court records:

  • Winding up petitions filed
  • Court judgments against company
  • Insolvency or bankruptcy proceedings
  • Directors disqualified from acting as directors

Industry-specific red flags

Trading companies:

  • No inventory or warehouses
  • Revenue figures don’t match industry norms
  • Multiple changes in business activities
  • Vague business description (“general trading”)

Professional services:

  • No professional licenses displayed
  • No proof of qualifications
  • Regulatory body not listed as issuer

Property-related:

  • No properties in company name despite property business
  • No estate agency license (if required)
  • No property transactions recorded

Transactional red flags

During onboarding:

  • Reluctance to provide SCR or documents
  • Cannot explain ownership structure clearly
  • Unwilling to disclose UBOs
  • Urgent requests to bypass verification steps

Payment behavior:

  • Large cash transactions requested
  • Unusual transaction patterns for industry
  • Requests to bypass normal payment channels
  • Reluctance to provide business purpose for transactions

When to escalate to Enhanced Due Diligence (EDD)

Mandatory EDD triggers under AMLO:

  • High-risk jurisdictions involved
  • PEPs identified as UBOs or directors
  • Complex or opaque ownership structures
  • Shell company indicators present
  • Adverse media or sanctions hits
  • Unusual transaction patterns

Hong Kong-specific EDD considerations:

  • Company structures involving BVI/Cayman (common in Hong Kong)
  • Cross-border structures with international entities
  • Family ownership structures with complex inter-company holdings
  • Use of professional nominee directors

Bottom Line

Hong Kong’s KYB requirements are comprehensive and well-defined, combining international AML/CFT standards with local specifics like the SCR and ICRIS system.

For Hong Kong businesses:

  • Use ICRIS as your primary verification source
  • Always request and verify the SCR for UBO identification
  • Check both Company Number and BRN match documents
  • Verify Business Registration Certificate is current
  • Cross-check NAR1 for recent director/shareholder changes

Red flags that warrant enhanced scrutiny:

  • Dissolved or struck-off company status
  • Expired Business Registration Certificate
  • Refusal to provide SCR
  • Nominee directors with no real connection
  • Complex offshore ownership structures

Compliance is not optional:

  • AMLO Cap. 615 carries significant penalties
  • SCR non-compliance fines up to HK$250,000
  • Regulators actively enforce KYB requirements
  • Document all decisions thoroughly

The companies that get Hong Kong KYB right build trust with legitimate partners, avoid regulatory penalties, and protect themselves from fraud. Focus on the fundamentals: verify via ICRIS, check documents are current, identify UBOs via SCR, screen for risks, and document everything.

Authoritative Sources

This article references official Hong Kong government and regulatory resources:

Hong Kong Legislation:

Hong Kong Regulators:

Government Resources:

International Standards:

Disclaimer: This article is for educational purposes only and doesn’t constitute legal or regulatory advice. Hong Kong regulations are subject to change. Consult with compliance professionals and refer to official sources (Companies Registry, HKMA, SFC, AMLO Cap. 615) for guidance specific to your business and jurisdiction.

Ready to streamline your KYB verification?

Quickkyb provides fast, accurate, and automated business verification solutions. Get started in minutes, not days.

Start Free Trial Learn More