Hong Kong Did Not Delete the Record, It Defined the Reader

Run a company search in Hong Kong today and the director's address you are given is a correspondence address, and the identification number is partial.

The information itself has not been destroyed. It sits where it always sat, in documents held by the Companies Registry, and a defined class of applicant may still obtain it. What changed between 2021 and 2023 is not the existence of the record but the identity of the person entitled to read it, and those are different problems with different answers.

Three commencements

The Companies Registry sets the sequence out on its own pages. Protected Information means the usual residential addresses and full identification numbers of directors, and the full identification numbers of company secretaries and certain other individuals.

Phase 1 commenced on 23 August 2021: a company could replace, on its own registers open to public inspection, the usual residential addresses of directors with correspondence addresses and full identification numbers with partial ones. Phase 2 commenced on 24 October 2022: on the Companies Register itself, Protected Information was replaced for public inspection by correspondence addresses and partial identification numbers, and Protected Information contained in documents filed after that date ceased to be provided for public inspection. Phase 3 commenced on 27 December 2023: a data subject may apply to the Registry to withhold from public inspection their Protected Information in documents already registered before Phase 2.

The third phase carries a detail worth holding onto. It does not operate automatically. Protected Information in documents filed before 24 October 2022 remains publicly inspectable unless the individual applies. The historic record is therefore uneven in a way that is a function of who has bothered, which is not a pattern any diligence method can assume.

The reader is defined by regulation

The class entitled to the full information is set out in the Companies (Residential Addresses and Identification Numbers) Regulation, Cap. 622N, at sections 8(1) and 12(1). It runs to the data subject and persons the data subject authorises in writing, members of the company, liquidators, trustees in bankruptcy, public officers and public bodies, solicitors and foreign lawyers, practising certified public accountants, and financial institutions and designated non-financial businesses and professions.

That list is the actual mechanism, and it is not secrecy. It is a statutory allocation of standing to read, and standing is a property of the enquirer rather than of the subject. A bank asks and is answered. A liquidator asks and is answered. A commercial party with a live counterparty question and no statutory hook asks and is not.

The operational consequence is precise and unwelcome. The question is no longer whether a fact about a Hong Kong company can be established. It is whether the person who needs it stands in a category that may be told, and if not, whether a party who does stand in one has an independent reason to ask. An enquiry routed to acquire standing it does not otherwise have is not diligence, and this house does not conduct it.

The register that was never a search

Set beside that the significant controllers regime, which is older and is habitually misdescribed as Hong Kong's answer to a public beneficial-ownership register.

The Companies (Amendment) Ordinance 2018 commenced on 1 March 2018 and added Division 2A to Part 12 of the Companies Ordinance. A company incorporated in Hong Kong must obtain and keep a significant controllers register. It is kept by the company, at its registered office or another place in Hong Kong notified to the Registrar. It is not filed with the Registry. It is open to inspection by law enforcement officers on demand.

So beneficial ownership in this jurisdiction has never been something a private party searched. It has always been something a party with the power to demand it obtained by demanding it. Anyone who built a Hong Kong verification method on the assumption that a register would answer the ownership question was working from the wrong model before any of the inspection phases commenced. What filings do and do not hold is the general case; the Hong Kong instance is unusually clean.

A concession taken rather than granted

The same logic governs the current family-office regime, and it is the reason the regime produces no external record at all.

The Inland Revenue (Amendment) (Tax Concessions for Family-owned Investment Holding Vehicles) Ordinance 2023 came into operation on 19 May 2023 and applies from the year of assessment beginning 1 April 2022. A family-owned investment holding vehicle managed by an eligible single family office may be taxed at a concessionary rate on qualifying transactions where the aggregate value of assets specified in Schedule 16C is at least HK$240 million, where the core income generating activities are carried out in Hong Kong with at least two full-time employees there, and where at least HK$2 million of operating expenditure is incurred in Hong Kong. The vehicle elects in writing, and the election, once made, applies to subsequent years without annual repetition.

An election is a position taken with a revenue authority. It is not an authorisation conferred by a regulator, and it therefore generates no list, no notification and no public artefact. A structure of this kind is real, substantial and, from outside, invisible. That is a straightforward contrast with the notification obligation now attaching to a single family office in Singapore, described in Singapore Charges for the Exemption in People, and the contrast is about visibility rather than about merit.

Where an obligation is stated to reach

One further instrument belongs in a piece about data, because its stated scope is not bounded by geography.

The amendments to the Personal Data (Privacy) Ordinance took effect on 8 October 2021. They created a two-tier offence of disclosing personal data without consent, where the discloser intends or is reckless as to whether specified harm would be caused, the second tier applying where such harm is caused. They also conferred on the Privacy Commissioner a power to serve a cessation notice requiring removal of a doxxing message, and the Commissioner's own published material states that such a notice may be served regardless of whether the disclosure is made in Hong Kong or not, and may be served on a non-Hong Kong service provider.

For a principal, that is the structural fact rather than any headline: an obligation whose stated reach is defined by the subject's connection to Hong Kong and not by where the publisher, the platform or the data happens to sit. It bears directly on how a reputational matter with any Hong Kong dimension is sequenced.

Where this piece stops

A reader will expect a discussion of the national security legislation, and specifically of the law promulgated in 2020 and of the Safeguarding National Security Ordinance, which was gazetted and came into operation on 23 March 2024. This desk does not publish assessments of contested political questions, of the merits of any legislature's enactments, or of any government's conduct. That is a standing rule and it is not suspended because a jurisdiction is topical.

What can be said within the rule is narrow and is the only thing said here: those instruments exist, they are published, they contain provisions expressed to apply to conduct outside the territory, and any principal weighing exposure in this jurisdiction should have them read by counsel qualified to read them. Our silence on their merits is a policy and should not be mistaken for a view in either direction.

Nothing above is legal advice on Hong Kong law or on the position in any particular matter, and structures touched on here are designed alongside independent counsel in each relevant territory.

The enquiry that has to be built when the record will not carry it belongs to Corporate Intelligence & Investigations Group and Due Diligence Investigations. Reading a change in disclosure architecture as a planning input, rather than as news, belongs to Geopolitical Risk Analysis.