For victims of financial crimes, especially online and cybercrimes, the first port of call is the Hong Kong Police.
Victims of on-line fraud and cybercrimes are advised to report the fraud to the Police as soon as possible. Upon receiving and reviewing a complaint of financial crime, the Police – or the Joint Financial Intelligence Unit (“JFIU”) – would routinely issue “letters of no consent” (“LNC”) to banks and financial institutions effectively, but informally, freezing bank accounts identified as being the potential recipients of criminal proceeds. This provided victims with time to apply for their own freezing order from the Court in civil proceedings and in some cases enabled the victims to ascertain whether the amounts informally frozen by the Police justified the expense of applying for their own formal freezing order from the Court. In some cases, the accounts would remain effectively frozen under a LNC until the victim obtained judgment against the wrongdoer and recovered the funds either by way of garnishee proceedings or by way of a vesting order under the Trustee Ordinance requiring the bank to transfer the funds back to the victim. While this scheme was very convenient and provided victims with a speedy way in which they could seek to protect themselves, on 30 December 2021, the Court of First Instance (“CFI”) issued a judgment in Tam Sze Leung & Ors v Commissioner of Police [2021] HKCFI 3118 in respect of a judicial review application challenging the legality of the freezing of accounts following the issuance of LNCs holding the informal, de facto freezing regime under which LNCs are issued (the “No Consent Regime”) as operated by the Police to be unlawful and beyond the powers conferred on them under the Organised Serious Crimes Ordinance (“OSCO”). The Court subsequently issued a further decision in the same case on relief and costs on 23 March 2022, holding that the LNCs in question were, and the No Consent Regime as operated by the Police is (1) ultra vires sections 25 and 25A of OSCO; and (2) incompatible with articles 6 and 105 of the Basis Law, because the No Consent Regime as operated by the Police is not prescribed by law and is disproportionate.
Previously, in Interush Ltd v Commissioner of Police [2019] HKCA 70, the Court of Appeal (“CA”) had rejected an earlier judicial review application regarding the No Consent Regime, where its legality was confirmed to be constitutional. In Tam Sze Leung, however, the CFI found that there were fundamental differences in the underlying facts and issues in the two cases, meaning that the Court in Tam Sze Leung was not bound to reach the same conclusion as the CA in Interush Ltd.
S.25 and S.25A OSCO
Under S.25 OSCO, it is an offence to deal with property known or reasonably believed to represent the proceeds of crime. S.25A requires those dealing with such property to notify the Police if they know or suspect it to be the proceeds of crime by filing suspicious transaction reports (“STRs”). Once a STR has been filed, it is an offence to permit dealing with the suspicious funds unless the Police consent to such dealing.
In practice, however, rather than issuing LNCs upon the receipt of STRs, in many cases the Police/JFIU were urging banks to issue STRs and to freeze the accounts following which the Police/JFIU would issue LNCs stating that the recipient banks were not authorised to deal with the funds – thereby informally freezing the accounts in question.
In Tam Sze Leung, the Applicants were suspected of involvement in a “pump and dump” stock market manipulation scheme being investigated by the Securities and Futures Commission (“SFC”). The SFC referred the matter to the Police, as a result of which the JFIU notified banks with which the Applicants held accounts, urging them to issue STRs, which the banks duly did. Thereafter, the JFIU issued LNCs to the banks, causing around HK$40 million to be frozen.
The Applicants sought judicial review of the Commissioner of Police’s decision to issue the LNCs, raising 6 grounds of challenge to the legality and constitutionality of the LNCs in question and the No Consent Regime:
- The issue and maintenance of the LNCs was tainted by procedural impropriety and unfairness;
- The LNCs were ultra vires of OSCO, which does not confer power on the Commissioner top operate a de facto property freezing regime (“Ground 2”);
- The LNCs interfered the Applicants’ constitutional rights under the Basic Law and Bill of Rights, and such interference is not prescribed by law (“Ground 3”);
- The LNCs breached the Applicants’ right to a fair hearing;
- The No Consent Regime and the LNCs disproportionately interfered with the Applicants’ property rights under Articles 6 and 105 of the Basic Law and rights to privacy and family under Article 14 of the Bill of Rights (“Ground 5”); and
- The decisions to refuse even partial consent to release funds were unlawful.
No consent regime found unlawful
The Court found that Grounds 2, 3 and 5 were made out, namely that the LNCs were ultra vires of OSCO, not prescribed by law and disproportionately interfered with the Applicants’ property rights and that S.25A OSCO was not intended to empower the Police to operate the No Consent Regime as an informal, de facto freezing regime.
Ground 2 – ultra vires
In the Interush Ltd case, the Police had maintained, and the Court of Appeal accepted, that the freezing of accounts subject to LNCs was by the financial institutions themselves, rather than the accounts being frozen by the LNCs, pointing out the Police’s power to seek a restraint order from the Court under S.15 OSCO. The CA further found that the consent regime (whereby the Police might consent, or decline to consent, to dealing after the filing of a STR) only operated at the investigation stage while the restraint order regime only operated at the prosecution stage, with the availability of the restraint order regime at a later stage not pointing towards the consent regime at an earlier stage being disproportionate, when investigations are ongoing.
In Tam Sze Leung, however, the Police’s evidence was that S.25 and S.25A OSCO do create an informal freezing regime and that the freezing of assets was the deliberate object of its operation of the No Consent Regime. This, the Court held, changed the contours of the argument.
The Court found there was a high threshold to be met before it could accept that it was the statutory intention for the No Consent Regime to be utilised as it had been used. The Court noted the numerous substantive and procedural safeguards applicable to the express asset freezing powers provided for in S.15 OSCO – including judicial oversight, that the Court may make such orders once proceedings have been instituted against a defendant for a specified offence and where such proceedings have not been concluded, that the Court must be satisfied to a specific evidential threshold, where a defendant has not yet been charged that the Court must be satisfied that there is reasonable cause to believe that the defendant may be charged with a specified offence, specific time limits for the expiry of such orders (and in any event not later than 6 months after the date on which made), and the fact that while made ex parte, notice must be given to persons affected by the order.
This was in stark contrast to the absence of such procedural safeguards in relation to the informal No Consent Regime operated by the Police under S.25 and S.25A OSCO, leading the Court to find it was “implausible that the legislature could have simultaneously “consciously enacted” a secret, informal and unregulated freezing power of the kind which the Commissioner now asserts he enjoys under section 25A(2)(a)” and to conclude that the regime was ultra vires.
Ground 3 – not prescribed by law
The Court also held that the No Consent Regime was not prescribed by law as there was insufficient clarity or certainty in OSCO itself regarding the scope of the power (perhaps also simply a reflection of the fact that the regime as operated is ultra vires of OSCO) and the manner of its exercise and insufficient safeguards against abuse.
Ground 5 – not proportional
The No Consent Regime was found to interfere disproportionally with rights, and in particular with property rights enshrined in the Basic Law. While the Court accepted that there is an obvious legitimate purpose in deterring criminal activity by restricting access to the proceeds of crime, the Court noted that “there are myriad alternatives for the Commissioner to take on a proactive role in tackling money laundering at an early stage of investigation, albeit with clearly defined powers and safeguards”.
Current position
There is clearly now a high degree of uncertainty regarding the operation of S.25 and S.25A OSCO. Notably, the Court in Tam Sze Leung has not suggested that the entire No Consent Regime is ultra vires, only the No Consent Regime “as operated” by the Police. It remains to be seen how the Police will respond. The decision clearly prohibits the proactive issuance of LNCs by the Police (in conjunction with urging banks to file STRs) but does not appear to prevent the Police from continuing to issue LNCs in response to STRs filed by banks or individuals, although this may need to be clarified by the Courts.
It remains to be seen how the constitutional problems identified in Tam Sze Leung will be addressed and whether any new legislation will ensue to amend or replace the current No Consent Regime.
Implications for banks
In the meantime, financial institutions are still required to comply with S.25 and S.25A OSCO and must decide, based on the information available to them, whether or not to freeze accounts, but may be exposed to litigation risks from customers who may challenge the informal freezing of their accounts by the institutions without a formal freezing order under S.15 OSCO.
Implications for cybercrime victims
It is expected that the Police will adapt their operation of the No Consent Regime to bring it in line with the judgment in Tam Sze Leung.
While victims can and should still report such frauds to the Police as soon as possible, victims can no longer rely on the Police issuing LNCs to the banks. Further, while it is still open for the Police/JFIU to report suspicious transactions arising from investigations to banks it will be up to the banks to act on such reports in accordance with OSCO. Consequently, cybercrime victims may face greater pressure to obtain own injunction or freezing orders without delay.
The article was originally published on Hong Kong Lawyer
For a further case analysis update, please check the article published on 31 May 2023 “Court of Appeal affirms the Police’s “informal freezing” powers”
