In brief
Cyber fraud continues to pose a significant threat to businesses and individuals in Hong Kong and elsewhere around the world. According to the official statistics for Hong Kong, 2022 saw a significant increase of deception cases of over 8,000 cases, over 70% of which were Internet-related.
The Hong Kong Police has developed a ‘No Consent Regime’ (“Regime”), which encompassed a practice of issuing so-called ‘Letters of No Consent’ (LNCs) to banks for accounts which contain suspected proceeds of crime, thereby triggering informal bank freezes on these accounts.
In December 2021, the Court of First Instance (CFI) held that the Regime as operated by the Police under the Organised and Serious Crimes Ordinance (Cap. 455) (OSCO) was unlawful. The Commissioner of Police then appealed against this decision.
The Court of Appeal (CA) handed down its judgment in April 2023, allowing the appeal and setting aside the declaration that had been made by the CFI.
While it is unclear whether the case will be taken to the Court of Final Appeal, there are points in the CA’s judgment which are of significance to financial institutions and victims of financial crime.
Key takeaways
This is a positive development for victims of cyber fraud and financial crime, as LNCs often act as a useful stopgap in preventing the further dissipation of funds, due to the relatively short time it takes for the Police to issue an LNC.
Banks and financial institutions, on the other hand, should periodically review their terms and conditions to ensure their adequacy and flexibility in enabling them to take the necessary measures for tackling money laundering issues. Ineffective safeguards or loosely drafted provisions can be a recipe for disaster as they may expose banks and financial institutions to potential criminal liability (where they deal with illicit funds with the requisite knowledge or suspicion), as well as potential civil liability (where they refuse to comply with a client instruction to release the funds without the contractual power to do so).
In more detail
The Regime
Our previous alerts on this matter (here and here) explained the Police’s long-standing practice of issuing LNCs to effect informal freezes on bank accounts that they suspect contain proceeds of crime. The way the Police operated the Regime meant that they could potentially freeze property indefinitely without being subject to any procedural safeguards or judicial oversight. This led to the present judicial review.
Tam Sze Leung & Ors v Commissioner of Police
The applicants in this case were four account holders who were suspected of involvement in market manipulation by way of a ‘pump and dump’ scheme. In November 2020, the relevant banks were notified of the investigation by the authorities and were urged to file Suspicious Transaction Reports (STRs), which they did. The Police then issued LNCs over the subject bank accounts in December 2020, which led to the banks freezing the funds in the accounts.
The freeze was maintained over the accounts for approximately 10 months and was only lifted upon the Police’s successful application for restraint orders against the applicants and the accounts.
The account holders sought leave to apply for judicial review against the Regime on several grounds. The CFI accepted some, but not all, of these grounds and made declarations giving effect to its findings that the Regime “as operated by the Police Commissioner” are: (i) ultra vires of ss.25 and 25A (the anti-money laundering provisions of) OSCO; and (ii) incompatible with constitutional rights to property under Articles 6 and 105 of the Basic Law, as the Regime as operated by the Police is not prescribed by law and is disproportionate.
The Court of Appeal
The CA disagreed and set aside the declarations made by the CFI. Although the CA covered the different grounds, it primarily focused on the “ultra vires” (and “improper purpose”, as a related ground) and “prescribed by law” grounds in its judgment.
Ultra vires / improper purpose grounds
The CA held that it is within the Police’s powers to refuse consent under s.25A(2)(a) of OSCO, i.e., it is not ultra vires to (i) alert banks of potential money laundering offences and request that they file STRs or (ii) inform banks that they do not have the Police’s consent to deal with certain funds by way of an LNC.
The CA’s reasoning was that the relevant accounts were “frozen” not because of any mandatory freezing order made by the Police, but because of the banksā own decisions to refuse to comply with their customersā instructions due to the risk of exposing themselves to criminal liability under s.25 of OSCO.
The CA also held that the LNCs were not issued for “an improper purpose” as the purpose was to prevent dissipation of funds in accounts while a Police investigation was ongoing and was done in the circumstances where the Police had reasonable suspicion that the property is derived from criminal conduct.
Prescribed by law grounds
The CA also ruled that s.25(1) of OSCO was neither uncertain nor vague. There are sufficient constraints imposed on the exercise of discretion by the Police in giving or refusing consent under s.25A OSCO (e.g., that its power must be exercised in good faith), and sufficient signposts for people to anticipate the scope of the discretion and manner of its exercise, such as the Police’s manuals and procedures governing the issuance of LNCs.
Other observations
The CA emphasized that the decision whether to freeze the account lies with the bank and that the customer may pursue civil remedies and/or interlocutory relief if the bank refuses to comply with instructions, or freezes an account without having any knowledge or proper suspicion to do so.
Banks and financial institutions need to be on the lookout for potential signs of money laundering and exercise their own judgment in deciding whether the circumstances at hand would warrant an account freeze. It is also vital for banks and financial institutions to review their terms and conditions periodically, to ensure their adequacy and flexibility in enabling them to take the necessary measures when faced with money laundering suspicions involving client accounts.
The CA noted that where the Police act contrary to their own guidelines, it would prima facie be a ground for judicial review of the action. Therefore, although the Police have the power to issue LNCs, such power is not unfettered and can be subject to challenge.
Concluding remarks
Victims of cyber fraud and financial crime should ensure that their reports to the relevant banks and the Police are swiftly made, and contain sufficient information of the suspicious circumstances to trigger an informal freeze (whether or not pursuant to an LNC).
It is important to note that an LNC does not have the same legal effect as an injunction, as it does not impose any mandatory obligation to freeze and does not in itself carry any penal consequence if the bank takes a different view and decides not to freeze the account.
Although an LNC will often achieve the same practical effect as an injunction (as banks will generally err on the side of caution and freeze the account when faced with an LNC), victims of financial crime should not view it as a complete substitute to an injunction. Injunctions come in many different forms and variations (e.g., proprietary or Mareva injunctions), and they can often be more adequate and flexible in mitigating the risks at hand, particularly in cases where there are substantial amounts at stake.
