OSCO Cap. 455 s.25

Effective dates

• 1995-09-08Original commencement

Domain

Key obligations

1. hk-osco-s25-1 · applies to: Any party (including external counsel, breach coach, ransom negotiator) facilitating, dealing with, or having reasonable grounds to believe in dealing with proceeds of crime in HK · OSCO Cap. 455 s.25 / s.25A
   Suspicious Transaction Report (STR) and JFIU consent before any HK-touching ransomware payment — only statutory defence is consent under s.25A
2. hk-osco-s25-2 · applies to: All ransomware-payment scenarios with HK nexus · OSCO Cap. 455 s.25A
   JFIU consent window of 1–7 working days meaningfully constrains threat-actor 72-hour demands

Why it matters

OSCO s.25 is independent of and broader than OFAC. Without STR + JFIU consent (s.25A), there is no statutory defence. Personal exposure under s.25 (objective "reasonable grounds to believe" test) extends to external counsel, breach coach, and ransom negotiator — HK$5,000,000 + 14 years on indictment. JFIU consent window 1–7 working days clashes with threat-actor 72-hour ultimatums. Pre-payment STR is the only safe path.

Action required

• → hk-osco-s25-1 · trigger: Ransom demand with HK nexus (HK entity, HK-located data, HK personnel involved) · Pre-payment; consent typically takes 1–7 working days
  Lodge STR with JFIU and obtain consent before authorising any ransom payment with HK touch-point — never rely on OFAC clearance alone
• → hk-osco-s25-2 · trigger: Engagement of any third-party advisor on a HK ransomware matter · At engagement
  Brief external counsel, breach coach and any ransom negotiator on personal s.25 exposure before they engage on the matter

Sources

• https://www.elegislation.gov.hk/hk/cap455

Linked source items

No events linked yet.

Pending changes (HITL)

No pending changes.