Introduction
Hong Kong remains one of the most efficient places in the world to incorporate and operate a company, but the era of light-touch administration is over. Over the past several years the territory has rebuilt its corporate transparency and anti-money-laundering framework to meet Financial Action Task Force (FATF) standards. For any founder, finance lead, or advisor running a Hong Kong entity, two regimes now sit at the centre of day-to-day compliance: the Significant Controllers Register (SCR), which forces companies to identify and record who really controls them, and the anti-money-laundering and counter-terrorist-financing (AML/CFT) framework built on the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO).
These rules matter for international businesses in a very practical way. Banks in Hong Kong will not open or maintain an account for a company that cannot evidence its beneficial ownership and a coherent compliance record. Service providers cannot legally onboard you unless they are licensed and have completed proper due diligence. And the Companies Registry, the Inland Revenue Department (IRD), and the Hong Kong Monetary Authority (HKMA) all expect a private company to run a predictable annual compliance cycle, on time, every year.
This guide explains the SCR and the designated representative obligation, the AMLO framework and the TCSP licensing regime that governs corporate service providers, what customer due diligence and sanctions screening look like in practice, and the annual compliance calendar for a private company. It closes with a practical checklist and a clear picture of how AURNÉ supports clients through each of these obligations.
The Significant Controllers Register (SCR)
What the SCR is and who must keep one
The SCR is a private register of the people and entities that ultimately control a Hong Kong company. It was introduced as part of Hong Kong's commitment to FATF beneficial ownership standards and sits within the Companies Ordinance (Cap. 622).
The obligation applies to every company incorporated in Hong Kong: companies limited by shares, companies limited by guarantee, and unlimited companies. The only carve-outs are companies whose shares are listed on the Stock Exchange of Hong Kong (which are subject to separate disclosure rules) and registered non-Hong Kong companies. Importantly, the duty applies whether or not the company trades, holds assets, or has filed anything else. A dormant holding company still needs an SCR.
The SCR is not filed with the Companies Registry and is not open to public search. It is kept at the company's registered office, or another place in Hong Kong notified to the Registrar, and must be produced on demand to specified law enforcement officers.
The SCR is not optional and not public
A common misunderstanding is that beneficial ownership in Hong Kong is filed publicly like the UK PSC register. It is not. The SCR is a private register kept by the company itself, but it must exist, be accurate, and be producible within a reasonable time when a law enforcement officer demands it. The privacy of the register is not an excuse to neglect it.
Who is a significant controller
A person or entity is a significant controller of a Hong Kong company if any one of the following conditions is met, whether held directly or indirectly through intermediate entities:
- Holding more than 25% of the issued shares (or, for a company without share capital, the right to more than 25% of the capital or profits);
- Holding more than 25% of the voting rights;
- Holding the right to appoint or remove a majority of the board of directors;
- Having the right to exercise, or actually exercising, significant influence or control over the company;
- Having the right to exercise, or actually exercising, significant influence or control over a trust or firm (that is not a legal person) whose trustees or members meet any of the conditions above in relation to the company.
The register distinguishes between a registrable person (a natural person with significant control) and a registrable legal entity (a company or corporate body that is itself a significant controller and is the first relevant legal entity in the ownership chain). Where ownership runs through layers of holding companies, the company must trace upward to identify the registrable legal entity and, ultimately, the natural persons behind it.
Identifying and recording controllers
The company must take reasonable steps to identify its significant controllers. This includes reviewing its register of members, articles, shareholders' agreements, and any other documents that bear on control, and giving notice to any person it knows or has reasonable cause to believe is a significant controller. A person who receives such a notice is legally required to respond.
The SCR must record, for each significant controller, the required particulars: name, correspondence address, identity document or registration details, the date the person became a significant controller, and the nature of their control. The register must be kept up to date; when ownership or control changes, the SCR must be updated within a defined period after the change is confirmed.
Keep the SCR aligned with your cap table
Every time you issue shares, bring in an investor, restructure a holding company, or sign a shareholders' agreement that shifts control rights, ask whether the SCR needs updating. The cleanest practice is to treat the SCR as a downstream artefact of any cap table or governance change, updated in the same workflow rather than once a year in a panic.
The designated representative
Every company that must keep an SCR must also appoint at least one designated representative. This is the natural person who serves as the company's contact point and who provides assistance to a law enforcement officer in relation to the SCR.
The designated representative must be one of the following:
- A shareholder, director, or employee of the company who is a natural person resident in Hong Kong; or
- An accounting professional, a legal professional, or a person licensed to carry on a business as a trust or company service provider (a TCSP licensee).
For most internationally owned companies whose directors and shareholders live abroad, the practical answer is to appoint their TCSP-licensed corporate service provider as the designated representative. The representative's name and contact details form part of the SCR.
Penalties for SCR failures
Failing to keep an SCR, failing to appoint a designated representative, or failing to comply with a notice or a lawful demand for inspection is a criminal offence. The company and every responsible person can be liable to a fine, and where the offence is a continuing one, a further daily default fine can apply. In addition to the statutory penalty, an incomplete or stale SCR is a serious problem at bank onboarding and periodic review, because the bank's own AML obligations require it to verify beneficial ownership.
Key Takeaway
The SCR is a private but mandatory beneficial ownership register that every non-listed Hong Kong company must keep at a Hong Kong address, keep current, and produce to law enforcement on demand, with a designated representative named as the contact point. Treat it as a living document tied to your cap table, not a one-off formation task.
The AML/CFT framework and the AMLO
The AMLO and who it covers
Hong Kong's AML/CFT obligations for businesses are anchored in the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO). The AMLO imposes customer due diligence and record-keeping requirements on specified categories of business, supervised by sector regulators: financial institutions are supervised by bodies such as the HKMA and the Securities and Futures Commission (SFC), while designated non-financial businesses and professions (DNFBPs), including trust or company service providers, accountants, and legal professionals, are supervised by the Companies Registry and the relevant professional bodies.
For an international group, the AMLO matters in two ways. First, your Hong Kong corporate service provider is itself a regulated DNFBP and will apply AML procedures to you as its customer. Second, if your own Hong Kong entity carries on a regulated activity (for example, as a money service operator or a licensed corporation), it inherits AMLO duties directly.
Beneficial ownership and customer due diligence
Customer due diligence (CDD) is the heart of the AMLO regime. Before a regulated business establishes a relationship with a customer, it must:
- Identify the customer and verify its identity using reliable, independent source documents;
- Identify the beneficial owners, generally meaning natural persons who ultimately own or control more than 25% of the customer, and take reasonable measures to verify their identity;
- Understand the purpose and intended nature of the business relationship;
- Where there is a beneficial owner who is a legal person or trust, understand the ownership and control structure.
CDD is not a one-time exercise. Regulated businesses must conduct ongoing monitoring of the relationship, keep CDD information current, and apply enhanced due diligence to higher-risk situations, including politically exposed persons (PEPs), complex structures, and customers connected to higher-risk jurisdictions.
The 25% beneficial ownership test runs through everything
Note the consistency: the SCR uses a more-than-25% control threshold, and AMLO customer due diligence uses a 25% beneficial ownership threshold. This is deliberate. If you keep an accurate SCR, you are already most of the way to satisfying the beneficial ownership questions your bank and service provider must ask. Inconsistencies between the two are exactly what triggers further questions.
Sanctions and screening
Sanctions compliance sits alongside AML/CFT. Hong Kong gives effect to United Nations Security Council sanctions through the United Nations Sanctions Ordinance and related regulations, and terrorist-financing measures through the United Nations (Anti-Terrorism Measures) Ordinance. Dealing with the funds or property of a designated person or entity, or making funds available to them, can be a criminal offence.
In practice this means a regulated business must screen customers, their beneficial owners, and connected parties against applicable sanctions and terrorist-designation lists at onboarding and on an ongoing basis, and must file a suspicious transaction report (STR) with the Joint Financial Intelligence Unit where it knows or suspects that property represents proceeds of crime or is terrorist property.
Sanctions exposure can be indirect
You do not need to deal with a sanctioned party directly to create a problem. A counterparty owned 50% or more by sanctioned persons, a director who appears on a list, or funds routed through a sanctioned bank can all taint a relationship. International groups with cross-border supply chains and investors should expect screening to look through the structure, not just at the named customer.
The TCSP licensing regime
Why the regime exists
Because company and trust service providers are gatekeepers to corporate structures, the AMLO requires anyone carrying on a business of providing trust or company services in Hong Kong to hold a licence issued by the Registrar of Companies. The Companies Registry is the regulator: it reviews applications, maintains the public register of licensed TCSPs, and supervises licensees for ongoing AML/CFT compliance. Carrying on a TCSP business without a licence is a criminal offence.
"Trust or company service" covers activities such as forming companies, acting as (or arranging for another person to act as) a director or company secretary, providing a registered office or business address, and acting as (or arranging for another to act as) a trustee or nominee shareholder.
What this means when you choose a provider
For an international client, the most important takeaway is that your Hong Kong corporate service provider must be licensed. Engaging an unlicensed provider is risky on multiple fronts: the engagement may be unlawful, the provider cannot lawfully act as your designated representative, and banks may discount paperwork that comes from an unregulated source.
Verify your provider's licence
You can check whether a corporate service provider holds a valid TCSP licence on the Companies Registry's public TCSP licensee register. Confirming this before you engage is a simple, high-value due diligence step, and it tells you the provider is subject to ongoing AML supervision rather than operating informally.
A licensee's ongoing obligations
A TCSP licensee is a regulated business under the AMLO and must maintain a full AML/CFT programme: customer due diligence and ongoing monitoring, customer and transaction risk assessment, sanctions screening, record keeping (generally for the duration of the relationship and for a defined period afterwards), staff training, an appointed compliance officer and money laundering reporting officer, and the filing of suspicious transaction reports where required. The licence is renewable and the Registry can inspect, fine, or refuse renewal where standards are not met.
How AURNÉ Can Help
AURNÉ is a licensed corporate services provider, and SCR and AML/CFT compliance is core to what we do rather than an add-on. Working with international clients on Hong Kong structures, we support you across the full lifecycle.
- Entity setup. We incorporate your Hong Kong company, establish the registered office, and put the statutory registers in place from day one, including a correctly constituted SCR.
- SCR and designated representative. We identify your significant controllers, draft and maintain the SCR with the required particulars, issue the necessary notices, and act as (or appoint a qualified) designated representative so you have a compliant Hong Kong contact point for law enforcement.
- AML/CFT and onboarding. As a regulated provider, we conduct customer due diligence, build your beneficial ownership picture so it is consistent across the SCR and your bank's requirements, and screen for sanctions and PEP exposure. This is also what makes your file bankable when you open or review accounts.
- Annual compliance calendar. We run the recurring cycle for you: the NAR1 annual return, the Business Registration Certificate renewal, the Employer's Return, and the Profits Tax Return, coordinating with your auditor on the financial statements that support the tax filing.
- Tax and structuring advisory. We advise on the two-tiered profits tax regime, the territorial source basis, and how your Hong Kong entity fits into a wider cross-border structure, and we liaise with the Companies Registry, the IRD, and your auditor on your behalf.
The annual compliance calendar for a private company
A Hong Kong private company runs on a predictable rhythm. The dates differ slightly for each company because some are tied to the incorporation anniversary and others to the issue of a return, but the components are consistent.
Companies Registry: the annual return (NAR1)
Every local private company limited by shares must file an annual return, Form NAR1, with the Companies Registry within 42 days after the anniversary of its incorporation. The NAR1 is a snapshot of the company's particulars: registered office, directors, company secretary, and shareholders. It is not a financial statement and has nothing to do with profits or tax.
The on-time filing fee for a private company's NAR1 is low (HK$105). The cost of missing the 42-day window, however, escalates sharply on a tiered scale, rising into the hundreds and then thousands of Hong Kong dollars the longer the delay runs. Persistent late filing can also lead to prosecution of the company and its officers.
The 42-day NAR1 window is unforgiving
The penalty for a late NAR1 is driven entirely by how late you are, not by the company's size or activity. A dormant holding company pays the same escalating late fee as a trading one. Diarise the anniversary date and file early; there is no upside to using the full 42 days.
Inland Revenue Department: Business Registration Certificate
Separately from incorporation, every business must hold a valid Business Registration Certificate (BRC) issued by the IRD, renewed either annually or on a three-year cycle. From 1 April 2026 the one-year certificate fee is HK$2,350, comprising a registration fee of HK$2,200 plus the HK$150 levy to the Protection of Wages on Insolvency Fund, the levy having resumed after a temporary waiver period. The three-year option is HK$6,170. The IRD issues a renewal demand before expiry; the certificate must be renewed and displayed.
Inland Revenue Department: Employer's Return
If the company has employees (and a working director is typically treated as an employee), it has employer obligations. The IRD issues the Employer's Return, the BIR56A, on or around 1 April each year, and the employer must file it together with a Form IR56B for each relevant employee, generally within one month of the date of issue. The return covers remuneration for the year of assessment ended 31 March. Electronic filing through the IRD's Employer's Return e-Filing Services is now the standard channel. Even a company with no employees must usually return the BIR56A as a nil return.
Profits Tax Return and audited accounts
The IRD issues the Profits Tax Return (Form BIR51 for corporations), typically in the first batch in early April, with a filing deadline that depends on the company's financial year-end. A tax representative can apply for the block extension that aligns the deadline with the accounting date. Hong Kong companies must prepare financial statements audited by a Hong Kong practising certified public accountant, and those audited accounts support the Profits Tax Return. Under the two-tiered regime, the first HK$2 million of assessable profits of a qualifying corporation is taxed at 8.25%, with the balance at 16.5%; only one entity in a connected group can elect the lower band.
The cycle at a glance
| Obligation | Authority | Typical timing | Notes |
|---|---|---|---|
| Annual Return (NAR1) | Companies Registry | Within 42 days of incorporation anniversary | Particulars only; steep late-filing penalties |
| Business Registration Certificate renewal | Inland Revenue Department | Before expiry (annual or 3-year) | HK$2,350 for one year from 1 April 2026 |
| Employer's Return (BIR56A and IR56B) | Inland Revenue Department | Issued around 1 April; file within one month | Covers year ended 31 March; nil return if no staff |
| Profits Tax Return (BIR51) | Inland Revenue Department | Issued from early April; deadline by year-end | Requires audited accounts; extension via tax representative |
| SCR review | Kept by the company | Ongoing; update after any control change | Not filed; produced to law enforcement on demand |
A practical compliance checklist
Confirm your obligations on incorporation
Establish the registered office, statutory registers, and SCR from day one. Confirm the company is in scope for the SCR (it is, unless listed or a registered non-Hong Kong company) and identify any registered activity that brings direct AMLO duties.
Build and maintain the SCR
Identify significant controllers using the more-than-25% and control tests, issue notices where needed, and record the required particulars. Update the register whenever ownership or control changes.
Appoint a designated representative
Name at least one designated representative who is a Hong Kong-resident shareholder, director, or employee, or a TCSP licensee, accountant, or lawyer, and record them in the SCR.
Engage a licensed provider and complete CDD
Verify your corporate service provider holds a valid TCSP licence, complete customer due diligence, and ensure your beneficial ownership picture is consistent across the SCR and your bank's records. Resolve any sanctions or PEP flags.
Run the annual calendar on time
Diarise the NAR1 anniversary (42-day window), the BRC renewal, the Employer's Return (around 1 April), and the Profits Tax Return, and start the audit early enough to meet the tax deadline.
Review annually and on every change
Once a year, reconcile the SCR, the register of members, and your bank's beneficial ownership records. After any funding round, transfer, or restructuring, update the SCR immediately rather than waiting for the next review.
Conclusion
Hong Kong's appeal as a business hub now comes packaged with real compliance expectations. The Significant Controllers Register and the designated representative requirement put beneficial ownership at the centre of corporate housekeeping, while the AMLO framework and the TCSP licensing regime mean that both you and your service provider operate under genuine AML/CFT discipline. None of this is unusually onerous in isolation, but the obligations are continuous, they overlap, and the penalties for neglect range from statutory fines to the far more painful outcome of losing a bank account.
The practical answer is to treat compliance as a system rather than a series of one-off tasks: a current SCR tied to your cap table, a named designated representative, a licensed provider running consistent due diligence, and an annual calendar that nobody has to remember because it is already scheduled. Handled this way, Hong Kong stays exactly what it should be for an international business, a clean, efficient, and bankable place to operate. AURNÉ exists to run that system for you.
Source & References
- https://www.cr.gov.hk/en/legislation/scr/faq.htm
- https://www.tcsp.cr.gov.hk/tcspls/portal/guide/59/eng
- https://www.ird.gov.hk/eng/tax/ere.htm
- https://www.ird.gov.hk/eng/faq/2tr.htm
- https://www.cr.gov.hk/en/home/index.htm
This article is for general information only and does not constitute professional, legal, tax, or financial advice. Speak to AURNÉ for guidance specific to your situation.