Hong Kong AML for Accountants: First AFRC Fines Under the HKICPA Guidelines

Hong Kong's accountancy profession has had anti-money laundering (AML) duties for several years, but in March 2026 those duties produced their first formal enforcement outcomes. The Accounting and Financial Reporting Council (AFRC) announced disciplinary actions against audit firms and individual practitioners for failing to follow the AML Guidelines for professional accountants. This article explains the framework, what the regulator found and what a practice should check in its own procedures. It is based on a report of the AFRC announcement and on Hong Kong Institute of Certified Public Accountants (HKICPA) material, so read the primary guidelines before you rely on any detail.

The framework in brief

According to a report of the AFRC announcement, the Guidelines on Anti-Money Laundering and Counter-Terrorist Financing for Professional Accountants are integrated into the Code of Ethics for Professional Accountants. They were issued under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO, Cap. 615) and are said to align with the Financial Action Task Force (FATF) Recommendations. The HKICPA published a revised version of the Guidelines for gazettal in May 2023.

The AMLO changes took effect on 1 March 2018, according to an HKICPA article from that period. That article describes a licensing regime for trust or company service providers (TCSPs) and a requirement for locally incorporated companies to keep a significant controllers register. It says accounting professionals handling specified transactions must meet AML duties, and that they are exempt from TCSP licensing. Accountants who also provide trust or company services should check the current position with the Companies Registry.

Who has to follow the procedures

A 2019 HKICPA article on its AML monitoring regime explains that practices that, by way of business, prepare for or carry out specified transactions must follow AML procedures. Examples include buying or selling real estate or business entities and creating or forming legal persons. It also says every practice must appoint a money laundering reporting officer (MLRO), and that a sole practitioner can act as MLRO provided they tell any staff. Suspicious transaction reporting and financial sanctions obligations apply regardless of the services a practice provides. That article is several years old and the Guidelines have since been revised, so use it for orientation only. Our guide to the role of the MLRO in an accountancy firm explains the role in general terms.

The March 2026 enforcement actions

The report says the AFRC announced the actions on 5 March 2026 and that they were its first disciplinary actions under the AML Guidelines.

• Prism Hong Kong Limited, a public interest entity auditor, was fined HK$150,000.
• Wong Ka Chun, a sole practitioner, received a HK$70,000 penalty and a public reprimand.
• A further firm and its principal also received penalties and public reprimands. The report gives inconsistent figures for these two, so we do not repeat an amount here.

What the AFRC found

In the Prism case, which arose from a 2023 inspection of new engagement acceptances for specified services, the failings reported were that the firm:

• carried out no mandatory client risk assessments to flag higher money laundering or terrorist financing risk;
• did not verify that individuals had authority to act for clients; and
• did not run name checks against the United Nations Security Council Sanctions List.

The smaller practices were reviewed in 2025. The failings reported were that they had no basic internal AML policies, procedures or controls, failed to perform proper customer due diligence (CDD) and carried out inadequate sanctions list checks. The AFRC described these as systemic failures at firm level.

How the AFRC treated the cases

The report says the AFRC took account of mitigating factors in the Prism case: the limited frequency, duration and impact of the breaches, prompt fixes and an external AML review. All of the firms cooperated and admitted misconduct, and the smaller firms' scale was also considered. The AFRC treated the conduct as misconduct under the Accounting and Financial Reporting Council Ordinance (Cap. 588), together with the professional competence and due care principles in the Code of Ethics.

Lessons for practices

1. Risk assess every new client. A mandatory client risk assessment at acceptance was one of the gaps. Our guide to the firm-wide AML risk assessment shows how firm-level and client-level assessments fit together.
2. Verify authority to act. Confirm that the individual instructing you is entitled to act for the client, and keep the evidence.
3. Screen against sanctions lists. Check names against the United Nations list and keep a record. See our guide to sanctions screening for accountants.
4. Write down your policies. The smaller firms lacked even basic procedures, so a short, documented set that staff actually follow is the starting point.
5. Test the process. Prism's mitigation included an external AML review, which suggests that independent testing helps both control and credibility.
6. Keep records of what you did. Regulators judge what you can show, not what you meant to do.

Frequently asked questions

Who announced the first disciplinary actions?

The AFRC, on 5 March 2026, according to the report we used.

What was the largest penalty reported?

HK$150,000, imposed on Prism Hong Kong Limited.

Do the Guidelines apply to every accountant in Hong Kong?

The HKICPA material describes the duties as applying to practices that carry out specified transactions by way of business, with suspicious transaction reporting and sanctions obligations applying more widely. Check the current Guidelines for your own position.

Are the Hong Kong rules the same as the UK rules?

No. The principles are similar, but the legislation, supervisors and penalties differ.

Next steps

Compare your client acceptance process with the failures listed above, then confirm that you hold a written set of AML policies and a record of sanctions checks. This article is general information and not legal advice. To build your wider compliance skills, explore Learnsignal's CPD courses.