AML and KYC policy
How we check who our clients are, as a Hong Kong licensed TCSP: identity and ownership checks, PEP and sanctions screening, record keeping and reporting.
In plain language
- As a Hong Kong licensed TCSP (TC001305), the AMLO requires us to check who you are before we act.
- We identify you, every beneficial owner above 25% or with control, and anyone acting for you.
- You upload documents in our client portal after you order, not on this website.
- We screen everyone against sanctions lists and check for PEPs.
- Higher-risk files need source of funds and wealth information and senior approval.
- We keep records for at least 5 years after the relationship ends.
- We must report suspicions to the JFIU and cannot tell you if we have.
- You can pay before our checks are complete. We file nothing until we approve them, and we refund you if we decline.
This summary helps you read the document. If it differs from the full text below, the full text applies.
1. Why we check who you are
One IBC Limited holds Hong Kong Trust or Company Service Provider (TCSP) licence TC001305. As a licensee, we must follow the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), known as the AMLO.
The Companies Registry supervises us. Its Guideline on Anti-Money Laundering and Counter-Financing of Terrorism for TCSP licensees (March 2025) sets out how we meet the law.
These checks protect you too. A company formed with clean, complete records is easier to bank and less likely to be struck off or frozen.
2. We use a risk-based approach
We assess the risk of each client before we start work. We look at who you are, where you and your owners live, what the company will do, where its money comes from and which countries it deals with.
Lower-risk files need standard checks. Higher-risk files need more information and approval from our senior management. We review the risk again when something changes.
3. Customer due diligence
Before we act for you, the AMLO requires us to do four things.
- Identify you and verify your identity from reliable, independent documents.
- Identify every beneficial owner and take reasonable steps to verify their identity. For a company, this includes anyone who owns or controls more than 25% of the shares or votes, or who otherwise controls the company.
- Understand the purpose and intended nature of the business relationship.
- If someone acts on your behalf, identify them, verify their identity and check their authority to act.
4. What you will be asked to provide
We do not collect identity documents on this website. After you order, you upload them in our secure client portal.
The usual list is below. For higher-risk files we may ask for more, and for some documents we may need certified copies.
- For each individual (director, shareholder, beneficial owner, authorised person): passport, proof of residential address dated within the last 3 months, and date of birth and nationality as shown on the passport.
- For a corporate shareholder: certificate of incorporation, registers of directors and members, and an ownership chart up to the individuals who own or control it.
- For a trust in the structure: the trust deed or a trustee declaration identifying the settlor, trustees, protector and beneficiaries.
- A short description of the business, the countries it will trade with, and expected activity.
- Where needed: information on source of funds and source of wealth, with supporting evidence.
5. If we do not meet you in person
Most clients start remotely. When a client is not physically present for identification, we take extra steps to manage the higher risk, as the AMLO and the Companies Registry guideline require. For example, we may ask for certified copies of documents or an additional document, or hold a video call if our checks require it.
We tell you which measure applies before you upload.
6. Politically exposed persons
A politically exposed person (PEP) is someone who holds or has held a prominent public function, such as a head of state, minister, senior judge, senior military officer or senior executive of a state-owned company. Their close family and close associates are covered too.
We check every client and beneficial owner for PEP status. If you are a PEP from outside Hong Kong, senior management must approve the relationship, we take reasonable steps to establish your source of wealth and source of funds, and we monitor the relationship more closely.
For Hong Kong PEPs, PEPs of international organisations and former PEPs, we apply the same measures when the risk is higher.
7. Source of funds and source of wealth
Source of funds means where the money for this company or transaction comes from, for example salary, business income or the sale of property.
Source of wealth means how you built your total assets over time.
We ask for this information for PEPs and for other higher-risk files. We may ask for evidence such as bank statements, sale agreements or audited accounts.
8. Nominee and professional director arrangements
Where a company uses a resident or professional director or a nominee shareholder, we identify the person who gives the instructions and the person on whose behalf the shares are held.
These arrangements are disclosed to the registry, to banks and to authorities as the law requires. They do not hide who owns or controls the company. We will not provide a nominee to conceal a beneficial owner.
9. Sanctions screening
We screen every client, director, shareholder, beneficial owner and authorised person against the UN sanctions lists implemented in Hong Kong under the United Nations Sanctions Ordinance (Cap. 537) and the United Nations (Anti-Terrorism Measures) Ordinance (Cap. 575), and against other sanctions lists that matter to our banks and partners abroad.
We screen at onboarding, when the lists change and during the relationship. A possible match is reviewed by a member of our compliance staff before any decision. Software does not refuse you on its own.
Our Restricted and sanctioned countries page explains how we treat clients connected with listed countries.
10. Ongoing monitoring
Our duties continue after your company is formed. We keep your information up to date, review higher-risk files more often and watch for activity that does not fit what you told us.
Please tell us when a director, shareholder, beneficial owner, address or business activity changes. At renewal we may ask you to confirm or update your documents.
11. Record keeping
We keep identification records, due diligence documents and business correspondence for the whole relationship and for at least 5 years after it ends. The Registrar can require us to keep them longer.
Our Privacy Notice explains how we protect these records and your rights over them.
12. Suspicious transaction reports
Hong Kong law requires anyone who knows or suspects that property is the proceeds of crime or is terrorist property to report it to the Joint Financial Intelligence Unit (JFIU). We have a Money Laundering Reporting Officer who makes these reports.
Tipping off is a criminal offence in Hong Kong. We cannot tell anyone that a report has been made or is being considered, and we may not be able to give reasons for our decisions.
13. Our right to refuse or stop work
You may pay before due diligence is complete. We do not file anything with a registry, pay government fees or act as your company's officer until we approve it. Please send what we need within 30 days after payment. If we still do not have it after that and a reminder, we may cancel the order and refund you under our Refund policy.
If you do not provide what we need, or we cannot verify it, we will decline the order or end the relationship, as the AMLO requires. We may also decline or end a relationship where the risk is too high for us to manage, where a bank or local partner will not act, or where we are legally prevented from acting.
If we decide not to act for you, we refund what you paid under our Refund policy. If the law requires us to freeze or report funds, we must follow the law first.
14. Virtual assets and the travel rule
We do not provide virtual asset services, and we do not accept or send payments in virtual assets. The travel rule for virtual asset transfers therefore does not apply to our services.
If you plan to run a virtual asset business through your company, tell us at the start. The company may need its own licence, and we will apply extra checks.
15. Work done by performing companies and local partners
Where One IBC Pte. Ltd in Singapore, another performing company or a licensed local partner in another country does regulated work for your company, that company must also apply its own country's anti-money laundering rules. It may ask for extra or different documents. We coordinate so that you upload once where the rules allow.
16. Staff training and review of this policy
Our staff are trained on these duties when they join and regularly after that.
We review this statement at least once a year and when the law or the Companies Registry guideline changes. It was last reviewed on 27 September 2026.
Change log
What changed in version 2026-09-27 (17)
Why we check who you are: New public AML and KYC statement. OCC has no live page for this; the live site covers only the FATF country list.
Why: Clients and banks ask how OCC does KYC. A public statement also sets expectations before checkout.
Law: AMLO (Cap. 615) s.7 and Sch. 2; CR Guideline on AML/CFT for TCSP licensees (March 2025) para 1.1
We use a risk-based approach: Describes the risk-based approach and senior approval for higher-risk files.
Why: Required by the CR Guideline and needed to explain why document lists differ between clients.
Law: CR Guideline (March 2025) Chapter 2 and para 3.2; AMLO Sch. 2 s.15
Customer due diligence: Lists the four CDD measures and the more-than-25% beneficial owner test.
Why: Uses the statutory wording so it cannot overstate or understate the duty.
Law: AMLO Sch. 2 s.1 (beneficial owner) and s.2(1); CR Guideline (March 2025) paras 4.1.3, 4.6
What you will be asked to provide: Lists typical documents and confirms none are collected on the website.
Why: Matches the site's data design (KYC in the portal after checkout) and data minimisation.
Law: CR Guideline (March 2025) paras 4.3.2–4.3.3, 4.4.19; GDPR Art. 5(1)(c); PDPO (Cap. 486) DPP1
If we do not meet you in person: Explains extra measures for clients not physically present.
Why: Almost all OCC clients start remotely.
Law: AMLO Sch. 2 s.9; CR Guideline (March 2025) paras 4.10.1–4.10.2
Politically exposed persons: Explains PEP checks and the enhanced measures.
Why: Required EDD for non-Hong Kong PEPs; risk-based for others.
Law: AMLO Sch. 2 ss.1, 5(3)(b), 10; CR Guideline (March 2025) paras 4.9.7–4.9.12
Nominee and professional director arrangements: States that nominee and professional director arrangements are disclosed and never used to hide owners.
Why: Required by the CR Guideline and by the banned-claims list in VOICE.md.
Law: CR Guideline (March 2025) para 4.4.19; Companies Ordinance (Cap. 622) Part 12 Division 2A (significant controllers register)
Sanctions screening: Describes screening lists, timing and human review of matches.
Why: The CR Guideline requires an effective screening mechanism. Human review avoids refusals made only by software.
Law: CR Guideline (March 2025) paras 6.11–6.16; UNSO (Cap. 537); UNATMO (Cap. 575); GDPR Art. 22
Record keeping: States the 5-year minimum after the relationship ends.
Why: Statutory period.
Law: AMLO Sch. 2 s.20; CR Guideline (March 2025) Chapter 8
Suspicious transaction reports: Explains STRs to the JFIU and the tipping-off offence.
Why: Explains why OCC may refuse without giving reasons.
Law: Drug Trafficking (Recovery of Proceeds) Ordinance (Cap. 405) s.25A; Organized and Serious Crimes Ordinance (Cap. 455) s.25A; UNATMO (Cap. 575) ss.12, 14; CR Guideline (March 2025) paras 1.22–1.23
Our right to refuse or stop work: States the duty not to proceed without completed CDD, plus OCC's discretion to decline.
Why: Statutory duty and business protection.
Law: AMLO Sch. 2 s.3(4); CR Guideline (March 2025) para 4.7.4
Virtual assets and the travel rule: States that the travel rule does not apply because OCC provides no virtual asset services.
Why: Clients often ask about crypto businesses.
Law: AMLO (Cap. 615) Sch. 2 s.13A and Part 5B
Our right to refuse or stop work: Payment may come before due diligence; nothing is filed, no government fee is paid and no officer role starts until approval; documents are due within 30 days after payment; refund under the Refund policy if we decline.
Why: Owner KYC decision of 27 September 2026, made consistent with the Terms and the Refund policy.
Law: AMLO (Cap. 615) Sch. 2 s.3; CR AML/CFT Guideline for TCSP licensees (March 2025)
Sanctions screening: Removed the public commitment to OFAC, UK and EU consolidated lists; screening now refers to UN lists implemented in Hong Kong and other lists that matter to our banks and partners.
Why: Owner decision of 27 September 2026: screening without a public list commitment.
Law: CR Guideline (March 2025) para 6.11
If we do not meet you in person: Extra measures for non-face-to-face clients described in general terms, with a video call only where required.
Why: The earlier list followed pre-2023 wording of Sch. 2 s.9. Owner decision: video call only if required.
Law: AMLO (Cap. 615) Sch. 2 s.9
Staff training and review of this policy: Removed "our systems are subject to independent review".
Why: The statement was not verified. A policy must not claim controls that are not in place.
Law: Trade Descriptions Ordinance (Cap. 362) s.7
Why we check who you are: Published: status, version and effective date 27 September 2026.
Why: Owner decision to publish the legal set on 27 September 2026.
Law: AMLO (Cap. 615) Sch. 2
Sources
- Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), Department of Justice, Hong Kong (e-Legislation) (accessed Sep 2026) (opens in a new tab)
- Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For TCSP Licensees), March 2025, Companies Registry, Hong Kong (accessed Sep 2026) (opens in a new tab)
- Guidelines (AML/CFT and TCSP licensing), Companies Registry, Hong Kong (accessed Sep 2026) (opens in a new tab)
- Suspicious transaction reporting (STREAMS 2), Joint Financial Intelligence Unit (accessed Sep 2026) (opens in a new tab)
- Organized and Serious Crimes Ordinance (Cap. 455), Department of Justice, Hong Kong (e-Legislation) (accessed Sep 2026) (opens in a new tab)
- Drug Trafficking (Recovery of Proceeds) Ordinance (Cap. 405), Department of Justice, Hong Kong (e-Legislation) (accessed Sep 2026) (opens in a new tab)
- United Nations Sanctions Ordinance (Cap. 537), Department of Justice, Hong Kong (e-Legislation) (accessed Sep 2026) (opens in a new tab)
- United Nations (Anti-Terrorism Measures) Ordinance (Cap. 575), Department of Justice, Hong Kong (e-Legislation) (accessed Sep 2026) (opens in a new tab)
- Companies Ordinance (Cap. 622), Department of Justice, Hong Kong (e-Legislation) (accessed Sep 2026) (opens in a new tab)
- Regulation (EU) 2016/679 (GDPR), EUR-Lex (accessed Sep 2026) (opens in a new tab)
Laws and regulator guidance this document follows. They explain our obligations; they are not legal advice for your situation.
One IBC Limited · HK TCSP Licence TC001305 · Unit 1411, 14/F, COSCO Tower, 183 Queen's Road Central, Sheung Wan, Hong Kong