By Kareena Teh and Alex Mok:

The fifth wave of COVID-19 in Hong Kong continues to cause unprecedented challenges to the Hong Kong community; many organizations have reverted to their work-from-home policy, increasing the risk of cybercrime incidents. Two recent developments in Hong Kong may exacerbate the risk of resulting loss and reduce the chance and extent of recovery: 

• victims may no longer take comfort from the Police-issued “letter of no consent” (“LNC”) as a temporary freezing measure following a recent successful judicial challenge before the Hong Kong Courts; and
• access to the Hong Kong Courts is substantially affected by the General Adjourned Period (“GAP”) between 7 March 2022 to 11 April 2022, during which the Courts will only hear urgent applications.

Police letter of no consent regime and resulting temporary freezing measures

Typically, when victims have fallen prey to a cybercrime incident and have transmitted funds into a Hong Kong based bank account, they would usually urgently report the incident to the police or their remitting bank, which would in turn alert the receiving bank. Banks with knowledge or suspicion of such fraud would also file suspicious transaction reports with the Joint Financial Intelligence Unit (“JFIU”) with a view to complying with the disclosure requirements under section 25A of the Organised and Serious Crimes Ordinance (Cap. 455, “OSCO”).  The JFIU may issue a LNC to the banks which, as its name suggests, means that the JFIU does not give its consent to the banks dealing with the funds in the relevant account. While the ultimate decision to deal with property remains with the banks, they would generally refrain from doing so.  

Overtime, victims who have come to know about the LNC regime have relied on the LNC as a temporary freezing measure which quickly stops the fraudsters from further dissipating the funds, while taking time to identify the issues, collect the evidence, interview the involved personnel, and decide whether to take civil action to recover the defrauded funds. Where the defrauded funds are less substantial, some victims might have gone ahead with their civil action to recover the funds without firstly obtaining a freezing order, relying on the LNC to hold the defrauded funds in the bank accounts in the meantime.

Recent judgment holding that the no consent regime is unlawful

Recently, by its decision in Tam Sze Leung and others v Commissioner of Police [2021] HKCFI 3118 dated 30 December 2021, the Hong Kong Court of First Instance held that the JFIU’s “No Consent” regime is unlawful on the grounds that (1) it is ultra vires the OSCO, (2) it is not prescribed by the law and (3) it disproportionately interferes with the rights to property. 

It is unclear whether the decision will be subject to an appeal, or whether any interim measures/ legislative or policy changes will be introduced. A number of likely ramifications are nevertheless anticipated. First, the Police are likely to take even more care when deciding when to issue and/or extend a LNC, leading to possible delays in their issuance and/or shorter periods of their application. Second, the banks, receiving LNCs, will likely be even more careful in deciding whether to freeze bank accounts, particularly if they are in receipt of conflicting instructions from their customers to transfer funds out of the targeted bank accounts.

Impact of the Court’s general adjourned period

On 7 March 2022, the Hong Kong Judiciary announced that the Court will generally adjourn all proceedings between 7 March and 11 April 2022. The Court will only have limited functions, one of which is to hear “urgent applications to Duty Judge or Duty Master”. It is expected that the Court will first ascertain whether an application is truly urgent before convening a hearing to hear such application. As a result, victims who fail to take timely applications for freezing/ disclosure orders upon discovery of the cybercrime incidents may find that they may not be able to have their applications heard until after the cessation of the GAP. 

Prevention is better than cure

There is currently no clarity as to whether the No Consent regime will continue to be operative, and if so, how it will be reformed and operate. There is also no indication as to whether the GAP may be extended, and if so, when it will come to an end. 

These new developments therefore serve as a reminder to all organizations to continue their vigilance against cybercrime, avoid delays in taking actions which could increase the risk of loss occurring through onward transfers, and take proactive steps to contain and mitigate cybercrime risks. See our recommended steps in our publication issued in March 2020^[1]. We particularly highlight the importance of having designated incident response plans in place, with external professionals, including lawyers and forensic investigators, who can advise on and take urgent steps to apply for freezing/ disclosure orders, and subsequent recovery actions as appropriate. 

Download (pdf)

Note: This material has been prepared for general information purposes only and is not intended to be relied upon as professional advice for any cases. Should you need further information or legal advice, please contact us.

_________________

[1] COVID-19: Cybercriminals capitalize on global fears | LC Lawyers (eylaw.com.hk)