No more “no consent” letters? Implications for cybercrime victims and banks following the Tam Sze Leung case

On December 30, 2021, the Hong Kong Court of First Instance (CFI) handed down judgment in Tam Sze Leung & Anor v Commissioner of Police [2021] HKCFI 3118 (Tam Sze Leung). The CFI held that the longstanding practice of the use of “Letters of No Consent” (LNCs) by the police to informally “freeze” suspicious bank accounts (the No Consent Regime) is unlawful.

The No Consent Regime

Before Tam Sze Leung, it was common for cybercrime victims to rely on the No Consent Regime to have their relevant accounts “frozen” while seeking other recourse, such as an injunction order, which would formally freeze the accounts and enable recovery of the funds. The basis of the No Consent Regime lies in the Organized and Serious Crimes Ordinance (Cap.455) (OSCO). Pursuant to section 25 of the OSCO, it is an offence for a person to deal with property that is known or believed with reasonable grounds to represent proceeds of an indictable offence (section 25). Section 25A of the OSCO further requires that a person knowing or suspecting any property to be the proceeds of an indictable offence to make disclosure of such knowledge or suspicion to an authorized officer. It is a defense for a person to deal with the property if disclosure is made before any dealing and such dealing is made with consent of the authorized officer.

For financial institutions, disclosure is made by filing a Suspicious Transaction Report (STR) to the Joint Financial Intelligence Unit (JFIU) jointly operated by the Hong Kong Police Force and the Hong Kong Customs & Excise Department. The JFIU then considers whether to issue a letter of “consent” authorizing the bank to deal with the funds concerned. In practice, however, the Commissioner of Police would very often simply refuse to grant consent by issuing LNCs to the banks. As a result, banks would not have the prerequisite consent from the JFIU to allow further withdrawals from the relevant account(s). The No Consent Regime has operated as a de facto “freezing” regime before any formal injunctive relief or restraint orders are obtained.

Tam Sze Leung – Challenge to the No Consent Regime

Such practice attracted the CFI’s scrutiny in the case of Tam Sze Leung. In Tam Sze Leung, twelve accounts held by the applicants in separate banks were frozen without prior notice. Despite having written to the banks and the police via their solicitors, the applicants were not provided with any reasons for the issuance of the LNCs, apart from being informed that the applicants were “currently under investigation…for a case of ‘Dealing with property known or believed to represent proceeds of indictable offence” with the name and contact of the handling police officer provided. Evidence later revealed that it was the JFIU who proactively alerted the banks to the fact that investigations concerning suspicious money laundering activities were being conducted and urged the banks to file STRs, with one of the emails specifically directing a bank to suspend operation of the account concerned. The CFI also found that the banks had no reason to file STRs prior to the police request. LNCs were subsequently issued against all twelve accounts and remained in place for over 300 days until the grant of restraint orders against the applicants and the relevant accounts.

The applicants then commenced a judicial review to challenge the No Consent Regime. In summary, the CFI held that the regime is unlawful for being (1) ultra vires; (2) not prescribed by law; and (3) amounting to disproportionate interference with property rights as enshrined under the Basic Law.

Tam Sze Leung vs Interush

In reaching its decision, the CFI spent a considerable amount of time discussing whether similar issues were decided in Interush Ltd v Commissioner of Police [2019] HKCA 70 (Interush), where the Court of Appeal rejected an application by way of judicial review for a declaration that sections 25 and 25A of the OSCO are unconstitutional, again arising in the context of LNCs as issued by the Commissioner of Police. Noting that the underlying facts and the issues formulated were different in Interush and Tam Sze Leung, the CFI considered that it was not necessary to follow and reach the same conclusion as Interush in all aspects:

1. On the question of ultra vires, having considered the legislative history and language of the relevant OSCO provisions, the CFI ruled that to use the express provision relating to consent in section 25A(2)(a) for the purpose of securing an informal, unregulated freezing of assets is to use that power for a purpose other than that for which it was conferred. Nothing in the language or purpose of section 25A(2)(a) necessitates the implication of such power the Commissioner asserted he had under the provision in relation to the issuance of LNCs (at §§78, 91 and 92). In particular, the Judge commented that the No Consent Regime (as operated) enables the Commissioner in effect to freeze property indefinitely, without having to satisfy any Court that the freezing is appropriate, and without having to meet expressly stated procedural safeguards (§79).
2. It was held that the No Consent Regime as operated is not prescribed by law. There is not sufficient clarity as to the scope of the power and the manner of its exercise. Further the law does not provide adequate effective safeguards against abuse (at §117). With respect to safeguards against abuse, the Judge doubted whether judicial review and civil proceedings against the banks would be sufficient to afford appropriate judicial safeguards (at §113 and §116).
3. The CFI held that the No Consent Regime disproportionally intrudes on the constitutional property rights enshrined in the Basic Law notwithstanding the legitimate aim of deterring criminal activity by restricting access to proceeds of crime. In particular, there is no “temporal limitation” (at §159) on the operation of the No Consent Regime, and reviews were only conducted internally at loose timeframes without any embedded proportionality assessment taking into account the period elapsed.

In essence, whilst the CFI accepted the undisputed need to supply the Commissioner with adequate powers to combat crime at an early stage, this cannot be achieved by leaving the public under-protected in terms of fundamental property rights (at §5) and putting an unacceptably harsh burden on individuals (at §159).

Takeaways for cybercrime victims

Prior to Tam Sze Leung, victims of cyber fraud might have sought injunctive relief from the courts of Hong Kong only when the amounts concerned were substantial, given the legal costs involved in commencing civil proceedings. Upon discovering the fraud, victims are normally advised to immediately make a report to the police as the first step. They may then take comfort from the LNCs issued to the banks that the funds will not be dissipated before an injunction order is obtained or civil proceedings are commenced against the fraudsters.

Therefore, the decision of Tam Sze Leung may exert additional pressure on the victims of cyber frauds to obtain an injunction order without delay. However, some victims may not have the financial resources to commence civil proceedings, or the sums involved may be relatively modest.

Implications for banks

Whilst the position for cybercrime victims is relatively straightforward, banks are left in a more nuanced position following Tam Sze Leung. The case certainly prompts the question of reform of the police use of LNCs. However, while waiting for a new market practice to emerge and develop, banks must exercise their independent judgment on the basis of evidence available to them in deciding whether to freeze accounts due to a suspected connection with fraud in accordance with the terms and conditions of the recipient’s account.

Future outlook

Bearing in mind that Tam Sze Leung is a first instance judgment, it is anticipated that this decision may be challenged, either through an appeal by the Commissioner or by other stakeholders, particularly in light of the significance of the No Consent Regime. Until a higher court decision is available, victims of fraudulent activities will have to give serious consideration to seeking injunctive relief once they become aware of the fraud.