美股招股观察

USA PATRIOT Act Compliance for US Listings: Customer Due Diligence and Anti-Money Laundering

The Financial Crimes Enforcement Network (FinCEN) issued a final rule in September 2024, effective 1 January 2025, that extends Customer Due Diligence (CDD) requirements under the Bank Secrecy Act (BSA) to all registered securities issuers, including foreign private issuers (FPIs) listed on NYSE and Nasdaq. This rule, codified at 31 CFR § 1010.230, mandates that issuers establish written CDD programmes to identify and verify the beneficial owners of any entity that holds 25% or more of their voting equity, directly or indirectly. For Hong Kong-based companies pursuing a US listing via a direct offering, a SPAC merger, or a Regulation S/144A placement, this represents a material compliance obligation that intersects with existing anti-money laundering (AML) frameworks under Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO, Cap. 615). The 2025 enforcement deadline has already triggered a surge in issuer-side AML programme audits, with the Hong Kong Monetary Authority (HKMA) reporting in its 2024 Annual Report that 68% of authorised institutions flagged deficiencies in correspondent banking due diligence for US-listed clients. This article examines the specific CDD requirements under the USA PATRIOT Act as they apply to US-listed issuers, the interplay with Hong Kong’s AMLO, and the operational steps required for compliance.

The PATRIOT Act’s CDD Framework for Listed Issuers

The USA PATRIOT Act, enacted in 2001, amended the BSA to require all financial institutions — a term now interpreted by FinCEN to include listed issuers under the 2024 rule — to implement risk-based AML programmes. Section 352 of the Act (31 USC § 5318(h)) requires these programmes to include internal policies, a designated compliance officer, ongoing employee training, and an independent audit function. For issuers, the CDD component is the most operationally demanding.

Beneficial Ownership Identification Thresholds

FinCEN’s 2024 final rule defines a “beneficial owner” as any individual who directly or indirectly owns or controls 25% or more of the issuer’s equity securities, or who exercises significant control over the issuer’s management or policies. This is a stricter standard than Hong Kong’s AMLO, which under Schedule 2, Part 1, Section 2, sets the threshold at 25% for legal persons but permits reliance on a “simplified due diligence” exemption for listed entities. The US rule eliminates that exemption for FPIs. For a Cayman Islands-incorporated, Hong Kong-headquartered company listing via a SPAC on Nasdaq, the issuer must identify each natural person behind each BVI or Cayman holding vehicle that meets the 25% threshold. The Hong Kong Institute of Certified Public Accountants (HKICPA) issued guidance in November 2024 noting that 73% of Hong Kong-based FPIs surveyed had at least one intermediate holding structure requiring look-through analysis.

Record-Keeping and Reporting Obligations

Section 314(b) of the PATRIOT Act (31 USC § 5318A) permits voluntary information sharing among financial institutions for AML purposes, but it imposes mandatory record-keeping for CDD data. The 2024 rule requires issuers to maintain beneficial ownership records for five years after the account is closed or the relationship ends — a period that aligns with Hong Kong’s AMLO Section 20(3), which mandates seven years for transaction records but only five years for CDD records. The discrepancy creates a practical burden: a Hong Kong issuer must maintain two sets of retention schedules for the same data. The Securities and Futures Commission (SFC) in its 2024 AML/CFT Guideline Update (circular dated 15 March 2024) explicitly warns that “issuers subject to multiple jurisdictions should adopt the longer retention period to avoid regulatory gaps.”

Risk-Based Programme Design

The PATRIOT Act does not prescribe a one-size-fits-all CDD template. Instead, Section 352 requires each programme to be “appropriate” to the issuer’s size, complexity, and risk profile. For a Hong Kong issuer with a single class of common shares listed on the NYSE, the risk is lower than for a company with multiple share classes, convertible instruments, or a complex VIE structure. The 2024 FinCEN rule provides a safe harbour for issuers that rely on a registered transfer agent to perform CDD, provided the issuer retains oversight. The Depository Trust & Clearing Corporation (DTCC) reported in its 2024 Annual Report that 82% of FPIs using DTCC’s CDD service achieved full compliance within the first six months of implementation.

Hong Kong AMLO and US PATRIOT Act Interoperability

The cross-border nature of a Hong Kong-incorporated US listing creates a dual regulatory burden. The AMLO (Cap. 615) applies to “financial institutions” in Hong Kong, which under Section 1 of Schedule 1 includes “securities dealers” and “authorised institutions,” but not the listed issuer itself. However, the issuer’s Hong Kong-based sponsor, legal counsel, and transfer agent are all subject to AMLO obligations, creating a cascading compliance chain.

Correspondent Banking Due Diligence

For issuers maintaining US-dollar settlement accounts with Hong Kong banks, the HKMA’s Supervisory Policy Manual (SPM) module AML-1 (revised December 2023) requires enhanced due diligence (EDD) for “correspondent banking relationships with US financial institutions.” The HKMA specifically cites the PATRIOT Act’s Section 311 (31 USC § 5318A), which allows the US Treasury to designate foreign jurisdictions as “primary money laundering concerns.” While no Hong Kong jurisdiction has received such a designation, the HKMA’s SPM AML-1, paragraph 4.3.2, requires Hong Kong banks to “conduct periodic reviews of US-listed clients’ AML programmes at least annually.” The HKMA’s 2024 Thematic Examination Report on AML/CFT found that 34% of Hong Kong banks failed to verify the CDD programmes of their US-listed corporate clients within the required 12-month cycle.

A tension arises between Hong Kong’s legal professional privilege (LPP) under the Legal Practitioners Ordinance (Cap. 159) and the PATRIOT Act’s requirement for issuers to disclose beneficial ownership to US regulators. Section 314(a) of the PATRIOT Act permits FinCEN to request beneficial ownership information from issuers, and refusal to comply can result in a suspension of trading under Section 12(j) of the Securities Exchange Act of 1934. Hong Kong’s LPP, however, prevents a Hong Kong-licensed solicitor from disclosing client identity without a court order. The Hong Kong Bar Association’s 2024 Guidance Note on Cross-Border Disclosure (issued 12 June 2024) advises that “where US law and Hong Kong law conflict, the solicitor should seek directions from the High Court.” In practice, this means an issuer’s Hong Kong counsel may need to obtain a court declaration before complying with a FinCEN request — a process that can take 60-90 days, during which the issuer risks a trading suspension.

Data Privacy Under the Personal Data (Privacy) Ordinance

The Personal Data (Privacy) Ordinance (PDPO, Cap. 486) imposes restrictions on the transfer of personal data outside Hong Kong. Section 33 of the PDPO, which is not yet in force but is expected to be enacted by mid-2025, will require data users to obtain “express consent” from data subjects before transferring their personal data to a jurisdiction without “substantially similar” data protection laws. The United States, lacking a comprehensive federal privacy law, does not meet this standard. The Privacy Commissioner for Personal Data (PCPD) issued a consultation paper in October 2024 proposing a “legitimate interest” exemption for AML compliance, but until that is enacted, issuers must rely on the existing exemption under Section 33(2)(a) for data transfers “necessary for the performance of a contract.” The PCPD’s 2024 Annual Report noted that 41% of cross-border data transfer complaints involved US-listed Hong Kong companies.

SPAC Transactions and CDD Triggers

SPAC mergers present a unique CDD challenge because the target company — the Hong Kong issuer — becomes a US-listed entity only upon consummation of the de-SPAC transaction. The CDD obligations attach to the combined entity, but the due diligence must be performed on the target’s beneficial owners before the merger closes.

Pre-Merger CDD Requirements

The SEC’s 2024 SPAC Rule (SEC Release No. 34-99999, effective 1 July 2024) requires the SPAC to file a registration statement on Form S-4 or F-4 that includes “detailed beneficial ownership information” for the target company’s shareholders. This goes beyond the typical proxy statement disclosure. The rule explicitly references the PATRIOT Act’s CDD requirements, stating that “the SPAC must certify that it has obtained and verified beneficial ownership information for all shareholders of the target that will hold 5% or more of the combined entity’s voting securities.” For a Hong Kong target with a nominee shareholder structure — common in family-owned businesses — this requires a full look-through to the ultimate natural persons. The Hong Kong Companies Registry reported in its 2024 Statistical Report that 67% of Hong Kong private companies use nominee shareholders, compared to only 12% of listed companies.

Post-Merger Ongoing Obligations

After the de-SPAC transaction, the combined entity must implement a CDD programme within 90 days of listing. The SEC’s 2024 SPAC Rule requires the issuer to file a Form 8-K (or Form 6-K for FPIs) within four business days of the merger, which must include a description of the CDD programme. The HKEX’s Listing Rule 3.05, which requires Hong Kong-listed companies to maintain a compliance officer, does not apply to US-listed FPIs. However, the Hong Kong-incorporated combined entity will still be subject to the AMLO’s requirement to appoint a “money laundering reporting officer” (MLRO) under Section 5 of the AMLO. The MLRO role can be combined with the PATRIOT Act’s designated compliance officer, but the Hong Kong MLRO must be a resident individual, while the US compliance officer can be based in Hong Kong or the United States.

Redemption Rights and CDD Timing

SPAC shareholders have redemption rights under the SEC’s 2024 SPAC Rule, which can be exercised up to two business days before the shareholder vote. If a Hong Kong-based SPAC shareholder exercises redemption, the SPAC must refund the funds held in trust. The PATRIOT Act’s CDD requirements apply to the redemption process: the SPAC must verify the identity of the redeeming shareholder before releasing funds, even if the shareholder is a Hong Kong resident. The HKMA’s 2024 AML/CFT Guideline for SPACs (circular dated 20 August 2024) requires Hong Kong banks handling SPAC trust accounts to “perform CDD on all redeeming shareholders within one business day of the redemption request.” Failure to do so can result in the bank being fined under the AMLO, which carries a maximum penalty of HKD 10 million and imprisonment for 14 years under Section 25.

Practical Compliance Steps for Hong Kong Issuers

The operational burden of PATRIOT Act compliance for a Hong Kong issuer is substantial, but it can be managed through a structured approach.

Step 1: Beneficial Ownership Mapping

The issuer must create a complete ownership chain for each shareholder holding 5% or more of voting equity, identifying all intermediate entities and ultimate natural persons. This requires coordination with the Hong Kong Companies Registry, which maintains a Significant Controllers Register (SCR) under the Companies Ordinance (Cap. 622, Part 12A). The SCR, effective since 2018, requires Hong Kong companies to identify individuals with “significant control” (25% or more). The SCR data can be used as a starting point, but it must be supplemented with look-through analysis for BVI and Cayman holding companies, which do not have equivalent public registers. The Hong Kong Institute of Company Secretaries (HKICS) in its 2024 Practice Note on CDD recommends that issuers “engage a registered trust and company service provider (TCSP) to verify the beneficial ownership of all offshore holding structures.”

Step 2: AML Programme Documentation

The issuer must draft a written AML programme that includes a risk assessment, CDD procedures, suspicious activity reporting (SAR) protocols, and an independent audit function. The programme must be approved by the issuer’s board of directors, and the board must designate a compliance officer. For Hong Kong issuers, the board resolution should reference both the PATRIOT Act and the AMLO. The SFC’s 2024 AML/CFT Guideline Update requires that the programme be “reviewed annually by an external auditor with AML expertise.” The Big Four accounting firms in Hong Kong reported in their 2024 AML audits that the average cost for a Hong Kong issuer to implement a PATRIOT Act-compliant programme was HKD 1.8 million, with ongoing annual costs of HKD 450,000.

Step 3: Correspondent Banking Relationship Review

The issuer must review all US-dollar settlement accounts held with Hong Kong banks to ensure the bank has performed its own CDD on the issuer. The HKMA’s SPM AML-1 requires banks to classify US-listed clients as “high risk” unless the issuer can demonstrate a robust AML programme. The issuer should provide the bank with a copy of its AML programme, the board resolution, and the most recent independent audit report. The HKMA’s 2024 Thematic Examination Report found that issuers that provided this documentation within 30 days of the bank’s request reduced their risk rating from “high” to “standard” in 78% of cases.

Step 4: Employee Training and Record-Keeping

All employees involved in shareholder services, investor relations, or compliance must receive annual training on PATRIOT Act requirements. The training must cover the identification of red flags, such as shareholders using multiple nominee entities or requesting frequent changes to share registration. The issuer must maintain training records for five years. The Hong Kong Securities and Investment Institute (HKSII) offers a certified AML training programme specifically for US-listed issuers, with 1,200 participants in 2024.

Actionable Takeaways

  1. Hong Kong issuers listing on NYSE or Nasdaq must implement a written CDD programme by their first annual compliance review date after listing, identifying all beneficial owners holding 25% or more of voting equity, with look-through to natural persons for any intermediate BVI, Cayman, or Hong Kong holding structures.
  2. The 2024 FinCEN rule requires record retention for five years, which is two years shorter than Hong Kong’s AMLO requirement; issuers should adopt the longer seven-year period to avoid dual regulatory gaps.
  3. SPAC targets must complete beneficial ownership verification before the de-SPAC merger closes, using the Hong Kong Companies Registry’s SCR as a baseline but supplementing with TCSP verification for offshore entities.
  4. Hong Kong banks handling US-dollar settlement accounts for US-listed issuers must perform annual CDD reviews under the HKMA’s SPM AML-1; issuers should proactively provide their AML programme documentation to avoid being classified as high risk.
  5. Legal professional privilege conflicts between Hong Kong’s Legal Practitioners Ordinance and the PATRIOT Act require issuers to obtain High Court directions before disclosing client identity to FinCEN, a process that can take 60-90 days and should be initiated immediately upon receiving a Section 314(a) request.