Hong Kong TCSP Licensing Requirements: Everything Corporate Service Providers Must Know
Hong Kong's Trust or Company Service Provider (TCSP) licensing regime requires all eligible businesses to obtain a licence from the Companies Registry before offering defined trust or company services. The regime, governed by the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) — commonly referred to as AMLO — mandates ongoing compliance obligations including customer due diligence, record-keeping, and suspicious transaction reporting. Understanding these requirements is not optional; operating without a valid TCSP licence is a criminal offence under Hong Kong law.
What Is the TCSP Licensing Regime and Why Does It Exist?
The TCSP licensing regime was introduced by the Hong Kong Companies Registry as part of the city's commitment to meeting international anti-money laundering (AML) and counter-terrorist financing (CTF) standards set by the Financial Action Task Force (FATF). FATF Recommendation 25 specifically addresses the risks posed by legal arrangements — including trusts and corporate structures — that can be exploited for financial crime.
In practice, the regime captures a wide spectrum of professional service firms: law firms, accounting practices, registered agents, corporate secretarial firms, and specialist trust companies. If your business forms companies, provides registered office addresses, acts as a nominee director or shareholder, or administers trusts on behalf of clients, you fall within scope.
The TCSP framework is not merely a licensing formality. It represents Hong Kong's structural response to FATF pressure and reflects the jurisdiction's ambition to remain a premier international financial centre. Firms that treat licensing as a tick-box exercise — rather than a living compliance commitment — face material legal and reputational risk.
Who Needs a TCSP Licence?
Section 2 of AMLO defines a "trust or company service provider" as any person who, by way of business, provides one or more of the following services:
- Formation of companies or other legal persons — including Hong Kong and offshore incorporations
- Acting as, or arranging for another person to act as, a director or secretary of a company or partner of a partnership
- Providing a registered office, business address, or correspondence address for a company, partnership, or other legal person
- Acting as, or arranging for another person to act as, a trustee of an express trust or nominee shareholder
If your firm provides any of these services to clients — even as a secondary offering alongside legal or accounting work — you must hold a valid TCSP licence. There is no de minimis threshold based on volume or revenue.
Key Hong Kong TCSP Licensing Requirements at a Glance
1. Application to the Companies Registry Applications are submitted to the Hong Kong Companies Registry. As of the current regime, applicants must demonstrate that they are a "fit and proper" person or entity, and that the business has adequate AML/CTF controls in place.
2. Fit and Proper Assessment The fit and proper test applies to the applicant entity and its responsible officers. Factors assessed include:
- Criminal record checks
- Prior regulatory actions or sanctions
- Insolvency history
- Competence and relevant professional experience
3. Designation of a Responsible Officer Every licensed TCSP must designate at least one responsible officer who is accountable for the firm's AML/CTF compliance. This individual must meet the fit and proper standard and be actively involved in the firm's management.
4. AML/CTF Policies and Procedures Applicants must demonstrate they have documented internal policies, procedures, and controls covering:
- Customer due diligence (CDD) and enhanced due diligence (EDD) for high-risk clients
- Ongoing monitoring of business relationships
- Record-keeping for a minimum of five years
- Suspicious transaction reporting to the Joint Financial Intelligence Unit (JFIU)
5. Licence Renewal TCSP licences are valid for three years and must be renewed before expiry. Firms must notify the Companies Registry of any material changes — including changes to responsible officers or ownership — within a prescribed period.
What Ongoing Compliance Obligations Apply?
Obtaining the licence is only the beginning. Licensed TCSPs carry a continuous compliance burden that intensifies as client portfolios grow.
Customer Due Diligence (CDD) TCSPs must conduct CDD before establishing a business relationship or executing a transaction. CDD involves verifying the identity of the client, understanding the nature and purpose of the relationship, and identifying ultimate beneficial owners (UBOs). For politically exposed persons (PEPs) or high-risk jurisdictions, enhanced due diligence is mandatory.
According to the Hong Kong Companies Registry's published guidance, TCSPs are required to identify and verify the identity of all beneficial owners holding 25% or more of a corporate client.
Suspicious Transaction Reporting (STR) When a TCSP knows or suspects that a transaction involves the proceeds of crime or is connected to terrorist financing, it must file a Suspicious Transaction Report (STR) with the JFIU as soon as practicable. Tipping off — disclosing the existence of an STR to the subject — is a criminal offence.
Record-Keeping All client identification records, transaction records, and CDD documentation must be retained for at least five years from the end of the business relationship or the date of the transaction.
How Technology Is Transforming TCSP Compliance
Managing these obligations manually — across multiple clients, jurisdictions, and corporate structures — is operationally unsustainable. The growing complexity of global entity management has driven demand for purpose-built compliance platforms.
The convergence of TCSP licensing obligations, increasing FATF scrutiny, and the scale of modern corporate service portfolios has created a compelling case for technology-first compliance operations. Firms that rely on spreadsheets or fragmented systems face structural gaps in their AML defences — gaps that regulators are actively looking for.
Platforms purpose-built for Hong Kong-licensed TCSPs — such as those offering both a Corporate Service Providers Mode and an Equity Management Mode on a single enterprise-grade platform — are increasingly the standard for firms managing large entity portfolios. These dual operational modes allow corporate secretarial teams and equity administrators to work within one unified environment, eliminating the data silos that create compliance risk.
Bank-grade security is now a baseline expectation, not a differentiator. Look for platforms that offer 256-bit AES encryption, a full audit trail system, and multi-cloud storage across AWS, Azure, and Cloudflare — infrastructure that meets the resilience and security expectations of institutional clients and regulators alike.
For KYC and AML workflows specifically, integrated automation tools — including NameScan and Didit integrations for identity verification and sanctions screening — eliminate the manual effort of checking clients against global watchlists. Risk assessment automation and built-in suspicious transaction reporting functionality further ensure that STR obligations are met consistently, without dependence on individual staff remembering to escalate.
Q&A: Common Questions About Hong Kong TCSP Licensing
Q: What happens if I provide TCSP services without a licence? Operating as a TCSP without a valid licence is a criminal offence under Schedule 2B of AMLO. Upon conviction, individuals face a fine of up to HKD 100,000 and imprisonment for up to six months. Corporate entities face significant financial penalties. The Companies Registry actively investigates unlicensed operators.
Q: Do overseas firms providing services to Hong Kong companies need a TCSP licence? If an overseas entity carries on trust or company service business in Hong Kong, it must hold a TCSP licence. The determination of whether business is carried on in Hong Kong depends on where the services are substantially performed. Firms based in the British Virgin Islands, Cayman Islands, Singapore, the UAE, or the United States that have Hong Kong-based operations or clients should seek legal advice to confirm their licensing obligations.
Q: How long does it take to obtain a TCSP licence? The Companies Registry does not publish a fixed processing timeline. In practice, straightforward applications are typically processed within several months, depending on the completeness of the submission and the Registry's current workload. Firms should plan for this timeline when entering new service lines.
Practical Steps for Maintaining TCSP Compliance
- Conduct an annual AML/CTF policy review — regulatory expectations evolve, and your internal procedures must keep pace with updated FATF guidance and local regulatory circulars.
- Maintain a current risk assessment for each client — risk profiles change as client businesses, ownership structures, or jurisdictions of operation change.
- Train staff regularly — all employees involved in TCSP services must receive AML/CTF training appropriate to their role.
- Document everything — in the event of a regulatory inspection, the quality of your documentation is often more determinative than the quality of your processes.
- Leverage technology to close manual gaps — automated screening, audit trails, and integrated STR workflows reduce the human error risk inherent in manual compliance operations.
The Regulatory Outlook: What TCSPs Should Anticipate
Hong Kong's TCSP regime continues to tighten. The Financial Services and the Treasury Bureau and the Companies Registry have signalled ongoing work to strengthen the beneficial ownership framework and enhance supervision of the TCSP sector. The 2023–2024 FATF mutual evaluation of Hong Kong's AML/CTF framework has placed additional focus on the effectiveness — not just the technical compliance — of the regime.
For TCSPs operating globally across Hong Kong, the Cayman Islands, BVI, Canada, UAE, Singapore, and the United States, the direction of travel is consistent: regulators in every major jurisdiction are demanding more granular beneficial ownership data, faster STR reporting, and demonstrable technology infrastructure to support compliance programmes.
Firms that invest now in purpose-built compliance infrastructure — with robust KYC/AML automation, full audit trails, and enterprise-grade security — will be positioned to meet these expectations rather than scramble to retrofit systems when enforcement intensifies.
Key Takeaways
- A TCSP licence from the Hong Kong Companies Registry is legally required before providing trust or company services in Hong Kong
- The fit and proper test, responsible officer designation, and documented AML/CTF procedures are non-negotiable licensing requirements
- Ongoing obligations include CDD, EDD for high-risk clients, five-year record retention, and suspicious transaction reporting to the JFIU
- Technology platforms built specifically for licensed TCSPs — with integrated KYC/AML automation, dual operational modes, and bank-grade security — are now essential infrastructure for compliant, scalable operations
- The regulatory environment is tightening globally; firms operating across multiple jurisdictions must build compliance programmes that are both technically sound and operationally effective
Last Reviewed: July 2025
External Reference: Hong Kong Companies Registry — TCSP Licensing guidance is available directly via the Companies Registry official portal.