Hong Kong has issued guidance setting out the basis on which CRS Audits will be conducted. The number of audits can be expected to increase in the remaining months of the year, as all CRS participating jurisdictions prepare for the Global Forum CRS peer review process, due to commence next year.
On-site Review
The HKIR guidance outlines the process leading to an on-site review, and the requirement that HKFIs appoint a responsible officer to assist revenue officers during the course of their inspection. A responsible officer should have knowledge of the CRS and the HKFIs internal CRS risk and compliance procedures and controls.
Review Areas
The guidance sets out areas of review that are considered high risk: broadly covering adequacy of controls surrounding due diligence applied to pre-existing and new accounts, application of reasonableness test to self certificates, procedures to determine a change in circumstance to an account holder / controlling person, statutory record keeping, and staff training initiatives.
Criminal Sanctions
The HKIR guidance provides a separate section detailing the range of criminal sanctions available to the Revenue in cases of non-compliance with the CRS. The introductory part of the guidance also contains reference to Revenue taking appropriate measures (including legal actions) in cases of non-compliance. It’s perhaps regrettable that HKIR felt it necessary to take what some might feel is an overly combative approach in its guidance, particularly set against the co-operative approach adopted in Singapore’s equivalent guidance, where SGFIs are encouraged to voluntarily surface compliance concerns and work with IRAS to remedy and reconcile.
HKIR vs. SG IRAS Audit Guidance
Whereas IRAS has taken the initiative to set out, in considerable detail, what is expected of SGFIs in complying with the CRS (including a self review toolkit to help assess and refine internal CRS controls) HKIR has made no attempt to similarly help HKFIs. In the circumstances, HKFIs might find it prudent to consider the Singapore guidance in testing and amending their internal CRS controls and procedures.
Best Practice
With the above in mind, best practice CRS compliance would dictate that a HKFI should, at minimum, seek to institute practices and procedures in the following areas:
1. Client Segmentation
It is imperative that a HKFI demonstrate that their CRS client base is adequately segmented at minimum across the following heads, and that the CRS has been correctly applied to each, including ongoing monitoring:
(a) Pre-existing accounts
(b) Pre-existing high and low value individual accounts
(c) New accounts
(d) Excluded accounts
(e) Undocumented accounts
(f) Dormant Accounts
2. CRS Internal Controls
The HKIR guidance makes explicit reference to examination of internal written CRS compliance controls and training materials. HKFIs will need to review whether CRS specific guidance is in fact contained in their Compliance Manuals. In the absence of such controls, HKFIs will need to consider drafting controls dealing with the following areas in particular:
(a) CRS due diligence procedures, applied to circumstances of actual client base;
(b) Basis on which a change of circumstances can affect an account, CRS account monitoring requirements and internal escalation procedures in order to determine resulting account status where a change of circumstance does occur;
(c) Account closure rules, basis on which HKFI determines an account closure, and resulting reporting procedures.
(d) Procedures to prepare CRS returns, data extraction and reconciliation procedures, and internal pre-submission review process.
3. Competency
HKFIs would need to demonstrate a conducive CRS compliance atmosphere and evidence that the CRS function has been invested in, particularly with respect to the following:
(a) Internal CRS audit and review processes and procedures;
(b) Staff CRS training and competency assessment program;
(c) Legislative change monitoring, and procedures to assess, escalate and apply any relevant changes to their CRS client base.
HKFIs may reasonably feel that they are at a disadvantage to their peers in Singapore in preparing for a HK CRS audit, for instance, to what extent does a HKFI need to demonstrate active measures to detect and deter CRS avoidance arrangements? What steps ought a HKFI take to manage a centralized CRS reporting team, that may be located outside of HK?
HKIR should be encouraged to amend its current guidance to permit HKFIs to better refine their internal controls to meet the requirements of both the CRS and any HKIR audit.
Centenal is a legal technology and professional consulting and company. Please contact Zac Lucas if you wish to discuss any aspect of this update.