Profession-specific playbook Current
Operating playbook for Hong Kong accounting firms
Three frameworks apply at once: professional supervision, data protection, and AML/CFT.
A Hong Kong accounting firm sits under HKICPA's professional supervision, the Personal Data (Privacy) Ordinance's data-handling duties, and AML/CFT obligations under AMLO wherever the firm's services trigger them. This playbook sets out how those three pieces fit together. It is general information, not legal or compliance advice.
Action plan
1 Confirm your firm's AML/CFT obligations as an accounting professional This sits alongside HKICPA's professional supervision, not instead of it.
Accounting professionals, including certified public accountants, CPA firms, and corporate practices, are among the persons subject to statutory customer due diligence, ongoing monitoring, and record-keeping requirements under the AML/CTF framework, reflected in HKICPA's own AML/CTF Guidelines. Confirm which of your firm's services actually trigger these obligations, rather than assuming general accounting or tax work is automatically covered or automatically excluded.
- Review HKICPA's AML/CTF Guidelines against your firm's actual service lines
- Don't assume routine accounting or tax work is automatically inside or outside statutory CDD
- Re-check this whenever your firm adds a new service line
Done when: Your firm's service lines have been checked individually against HKICPA's AML/CTF Guidelines, not assumed
HKICPA: AML/CTF Guidelines for Professional Accountants2 Check whether your firm needs a TCSP licence for company-secretarial work Most CPA firms are exempt from the licence itself, but not every structure qualifies.
Where your firm provides a registered office, acts as a nominee, or provides company secretarial services for clients, this falls within the statutory definition of a trust or company service. A CPA firm or corporate practice, as defined by the Accounting and Financial Reporting Council Ordinance, is exempt from the TCSP licensing requirement itself, but a mixed partnership with even one non-accountant partner, or a corporation that isn't a corporate practice, does need a licence.
- Map which of your firm's services fall within the statutory trust or company service definition
- Confirm your firm's structure actually meets the CPA firm or corporate practice exemption
- Reassess licensing status if your firm's partnership or ownership structure changes
Done when: Your firm's TCSP licensing status has been confirmed for every company-secretarial or trust-type service it provides
See the TCSP licensing and AML/CFT obligations overview3 Build PDPO data handling into every client engagement Collection, use, and security obligations apply across the whole client lifecycle, not just at intake.
The Personal Data (Privacy) Ordinance's Data Protection Principles apply from the moment your firm collects a client's personal data through to how it's used and secured. Build lawful, non-excessive collection, purpose-limited use, and practicable security steps into your firm's standard engagement process, rather than treating PDPO compliance as a one-off policy document.
- Apply DPP1's collection standard and DPP3's use standard consistently across engagements
- Apply DPP4's security standard to how client data and identity evidence are stored
- Review your firm's PDPO practices periodically, not only when onboarding a new client type
Done when: PDPO collection, use, and security principles are reflected in the firm's standard engagement process
See PDPO principles for collecting and using client dataDesignated services
Corporate services
Company secretarial services for clients
Acting as company secretary, or providing a registered office, business address, or correspondence address, for a client company falls within the statutory trust or company service definition. Check your firm's licensing status for this specific service, rather than assuming your professional exemption automatically covers every structure your firm operates under.
Entity roles
Nominee director or shareholder arrangements
Acting as a nominee shareholder or director for a client, by way of business, also falls within the trust or company service definition. Review each nominee arrangement your firm holds against the licensing exemption individually, since a one-off, non-commercial arrangement is treated differently to an ongoing service.
Registered office
Registered office and business address provision
Providing a registered office, business address, or correspondence address for a client corporation, partnership, or other legal arrangement is expressly covered by the statutory definition. Where this service is provided as part of an accounting professional's practice within the exemption, the licensing requirement doesn't apply, but the underlying CDD and record-keeping duties still do.