Hong Kong Puts Accounting Firms on Notice as AML Compliance Becomes an Enforcement Priority
Hong Kong’s Accounting and Financial Reporting Council has identified non-compliance with anti-money laundering and counter-terrorist financing requirements as one of its six principal enforcement themes, signalling heightened scrutiny of the accounting profession’s gatekeeper obligations.
The Accounting and Financial Reporting Council (AFRC) has published its 2025–26 inspection findings and first annual enforcement report, revealing continuing weaknesses across Hong Kong’s audit sector and a more assertive approach to regulatory enforcement.
For the AML community, the most significant development is the AFRC’s decision to identify breaches of anti-money laundering and counter-terrorist financing requirements as a distinct enforcement priority. The move demonstrates that AML/CFT compliance is no longer being treated as a secondary professional obligation for accounting firms.
Persistent weaknesses in audit quality
During its second three-year inspection cycle, covering 2023–24 to 2025–26, the AFRC conducted regular inspections of 39 accounting firms and reviewed 90 completed audit engagements. Of these, 58 involved listed entities.
Although larger firms generally demonstrated more mature technical capabilities, the regulator continued to identify weaknesses in areas requiring substantial professional judgement. These included:
- Revenue recognition;
- Asset impairment assessments;
- Going-concern evaluations;
- Identification and assessment of fraud risks; and
- The appropriate challenge of management assumptions.
The AFRC also highlighted broader risks associated with staffing, audit fees and commercial competition, cross-border engagements, and the use of emerging technologies.
Its message is that commercial pressure must not compromise professional scepticism or audit quality. Firms are expected to allocate sufficient personnel with the necessary skills, industry knowledge and experience to each engagement.
More than HK$11.7 million in penalties
During the reporting period, the AFRC completed 81 investigation and enquiry cases and concluded 22 disciplinary cases. It imposed sanctions on 35 regulated persons, with financial penalties exceeding HK$11.7 million.
Approximately HK$10 million of the penalties related to misconduct involving audits of listed entities. Depending on the seriousness of the conduct, the regulator also imposed non-financial sanctions, including suspensions of registration and the cancellation of practising certificates.
The figures underline the AFRC’s shift towards more visible and consequential enforcement. However, the total penalty amount should not be interpreted as relating entirely to AML/CFT breaches. Anti-money laundering compliance was one of several areas covered by the regulator’s enforcement programme.
Six principal enforcement themes
The AFRC identified six recurring themes that will shape its enforcement work:
- Deficiencies in quality management and monitoring systems;
- Serious audit deficiencies and inappropriate audit opinions;
- Systematic late filing or improper backdating of audit working papers;
- Breaches of registration requirements;
- Violations of auditor-independence requirements; and
- Non-compliance with AML/CFT requirements applicable to professional accountants.
The inclusion of AML/CFT as a standalone theme is particularly important. It indicates that the regulator will examine whether accounting firms have established and implemented effective controls—not merely whether they possess written compliance policies.
A firm may face disciplinary consequences even where no underlying money-laundering offence has been established. Failure to conduct required risk assessments, identify beneficial owners, perform customer due diligence or maintain appropriate internal controls can itself amount to professional misconduct.
Earlier cases foreshadowed the tougher approach
In March 2026, the AFRC announced its first disciplinary actions against multiple practice units for non-compliance with AML requirements. The three separate cases resulted in public reprimands and combined fines of HK$290,000.
The cases arose from AML compliance-monitoring inspections conducted between 2023 and 2025. The regulator identified serious deficiencies, including the absence of adequate internal policies, procedures and controls when firms were providing specified services.
The sanctioned practitioners included both a public interest entity auditor and smaller practice units. This demonstrates that AML obligations apply across the profession and are not confined to large international firms or auditors of listed companies.
In another case, an accountant was suspended for 18 months and fined HK$200,000 after failing to comply with statutory requests for information and documents issued in connection with an AML inspection and investigation.
That case illustrates a separate but equally important risk: failure to cooperate with the regulator may produce serious disciplinary consequences, regardless of whether the AFRC is ultimately able to establish underlying AML control failures.
Why accounting firms face gatekeeper risk
Accountants may provide services that can be exploited to conceal ownership, move assets or give legitimacy to opaque commercial arrangements. These may include:
- Forming or administering companies;
- Managing client money or assets;
- Organising contributions for the creation or management of companies;
- Facilitating transactions involving businesses or legal entities; and
- Assisting with complex corporate or cross-border structures.
These activities can expose firms to risks involving shell companies, nominee arrangements, hidden beneficial ownership, unexplained sources of funds and transactions lacking an apparent commercial purpose.
AML compliance must therefore extend beyond collecting identification documents when a client is onboarded. Firms need a risk-based framework covering the entire client relationship.
What firms should review
Accounting practices should assess whether their current controls adequately address:
- Firm-wide and client-specific money-laundering risk assessments;
- Customer and beneficial-owner identification and verification;
- Enhanced due diligence for high-risk clients and politically exposed persons;
- Source-of-funds and source-of-wealth enquiries where appropriate;
- Ongoing monitoring and periodic updating of client information;
- Identification and internal escalation of suspicious activity;
- Suspicious transaction reporting procedures;
- Record-keeping and audit trails;
- The responsibilities of compliance and money-laundering reporting officers;
- Staff training and awareness; and
- Independent testing of the AML control framework.
Smaller firms should pay particular attention to governance arrangements where one individual acts simultaneously as owner, managing partner, compliance officer and money-laundering reporting officer. Limited resources do not remove the obligation to establish controls proportionate to the nature and risk of the services provided.
From written policies to operational effectiveness
The AFRC’s enforcement direction suggests that future inspections will increasingly test whether controls operate effectively in practice.
A generic AML manual will offer limited protection if client files do not contain adequate risk assessments, beneficial-ownership evidence, due-diligence records or explanations for unusual transactions. Similarly, low-risk classifications that are unsupported or never reviewed may attract regulatory scrutiny.
Firms should be able to demonstrate, through contemporaneous documentation, how risks were identified, assessed, escalated and resolved. Senior management must also be able to show active oversight of the compliance framework.
By elevating AML/CFT breaches into its principal enforcement themes, the AFRC is reinforcing the role of accountants as gatekeepers to Hong Kong’s financial system. For accounting firms, AML compliance is no longer simply a component of professional ethics. It is a regulatory responsibility capable of affecting reputation, financial exposure and the right to practise.
