Compliance risk is one of the main risks any company, no matter big or small, faces, and Hong Kong jurisdiction, in spite of its business-friendly environment and laissez-faire policies, is not an exception.
Whether you’ve just launched a startup or already manage a big firm, chances are you must comply with all regulatory obligations in order to keep your Business Registration certificate and avoid legal penalties and reputation damage.
What is a Compliance Framework?
A compliance framework is a guide of rules and best practices that any company can use to ensure that it is compliant with the Hong Kong legislation. This guide includes legal requirements, but also industry-specific codes, standards of corporate governance, ESG, and so on.
The compliance framework includes your policies, procedures, reporting and risk management. In addition, the framework covers incident handling procedures – it guarantees that any incidents and breaches are reported and appropriately handled. Information technology also plays an essential role in the company’s compliance framework.
How to Build a Compliance Framework
Know Your Legal Obligations
The first step to building a compliance framework is to identify all regulatory and legislative requirements for your business. Here are some of the requirements Hong Kong registered companies must follow to stay compliant:
- Deliver an annual return in the specified form (NAR1). The annual return contains information about the company’s particulars: office address, shareholders, directors, etc.
- Renew BR annually.
- Apply for and renew all required permits and licenses, depending on the nature of the business (food license, liquor license, etc.).
- Audit financial statements by a Certified Public Accountant (CPA) (a business declared “dormant” does not need to comply with this requirement).
- Maintain a record of every transaction for at least seven years in case of inspection by government offices.
- Inform the Companies Registry of any changes in the structure of the company: change of capital, issue of new shares, change of directors and secretaries and their particulars, office address, etc.
- Deliver documents to the Stamp Office for the assessment of stamp duty and pay the stamp duty if there is transfer of share.
This list is, of course, non-exhaustive, further legal requirements may vary depending on the nature of the business.
These requirements must be recorded and maintained by the responsible team, who should also keep track of all changes in legislation and inform staff accordingly.
Assess Your Current Compliance Framework
After identifying the requirements, the next step is to audit the current state of your compliance framework – what policies are in place and who is in charge of initiating and implementing them.
A compliance framework is not a one-size-fits-all. However, it is a good idea to benchmark your current compliance framework to peers and industry best practices.
Identify Pain Points of your Compliance Framework
It is important to hold up the mirror and ask yourself what’s working perfectly and what can be done better.
Though businesses usually cannot completely prevent deliberate non-compliance – when an employee decides to go rogue and breach the rule knowing the consequences, they, however, can identify the red flags that could signal the possibility of unintentional non-compliance: lack of staff training, mixed messages from the management, or simply lack of time to monitor regulatory changes.
Set Up an Effective Compliance Network
Based on your research and assessment, build a framework that includes policies, communication and risk control for maintaining compliance.
What is a “great” compliance framework for one firm is not necessarily a perfect fit for another. However, here are some basics that any business should follow:
- Gather all the company’s compliance policies in one place. Even if different business units have different sets of policies, it’s recommended to keep them in one place from which they’ll be accessible and managed easier.
- Assign a specific team or a person to handle different compliance matters and tackle problems (staff training, intranet, incident management, etc.).
- Invest in compliance training for employees.
- Actively and regularly monitor regulatory changes.
- Clearly communicate compliance messages to your team to reduce errors and minimise misunderstandings.
- Hold accountable. Define who is accountable for what and put in place appropriate measures for compliance breaches.
If you have any questions about the article or need assistance to put in place an effective compliance framework for your Hong Kong company, please get in touch with us via enquiry form.