Who this applies to
If your firm is a trust or company service provider licensed by the Companies Registry, or you practise as an accountant, an estate agent, a solicitor, or in one of the other sectors covered by the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, you carry customer due diligence duties regardless of how small the firm is. There is no size exemption for having a compliance department; there is only a difference in how the work gets organised.
Many owner-managers in these sectors know they must "check" a new client, but the routine around it is informal — a quick search engine look-up, done once, by whoever happens to be onboarding the client that day. That is not the same as name screening, and it will not hold up if your regulator asks to see your records.
What name screening actually means
Name screening is the practice of checking a person's or company's name against lists that flag specific risks:
- Sanctions lists — names subject to financial sanctions issued by relevant authorities, where dealing with the person or entity may itself be unlawful.
- Politically exposed persons (PEPs) — individuals who hold or have held prominent public functions, and their close family and associates, who carry higher inherent risk because of their position.
- Adverse media — credible reporting linking a name to financial crime, fraud, or other serious wrongdoing, which does not appear on a formal list but is still relevant to your risk assessment.
A name match on any of these does not automatically mean you refuse the client. It means you look closer, understand why the match arose, and make a documented decision about whether to proceed and on what terms.
A routine a five-person firm can run
You do not need specialist software to have a defensible process. You need a routine that is written down and followed every time.
Screen at onboarding, before you take on the client. This should happen before, not after, the engagement letter is signed. Screening a client after the relationship has already started defeats much of the purpose.
Screen again at a set interval. A person's status can change after onboarding — someone can become a PEP, or a company can be added to a sanctions list later. Decide a review interval that suits your risk profile, commonly annual for lower-risk clients and more frequent for higher-risk ones, and stick to it.
Record the result every time, even when there is no match. "Screened on [date], no match" is as important a record as a hit, because it shows you actually did the check rather than skipped it.
Decide in advance who signs off a hit. In a five-person firm this is usually the principal or a designated compliance officer. Write down that this person, by name of role rather than by name, is the one who reviews any match before the firm proceeds.
Keep the record for the retention period your regulator specifies. Retention periods differ by sector and by document type, so check your own regulator's current guidance rather than assuming a figure — do not rely on a number from a general article, including this one.
False positives and how to document them
Most matches you encounter will be false positives — a common name that happens to resemble a name on a list, with no other connection to your actual client. The mistake is treating a false positive as "nothing happened" and moving on without a record.
Document, for every match: the name and list that triggered it, the additional information you checked to distinguish your client from the listed person (date of birth, nationality, identification number, address), who made the decision, and the date. This record is what shows a regulator, months or years later, that the match was properly considered rather than ignored.
Tools worth knowing
For the screening step itself, options range from manually checking the relevant published lists, to paid screening databases aimed at larger institutions, to lighter tools built for smaller firms. A free name-screening tool built for small Hong Kong firms is one option worth looking at if you want something faster than manual checking without the cost of an enterprise database. Whichever method you use, the record you keep matters more than the tool that produced it.
This is general information, not legal advice.