Why does my auditor ask for ID and source-of-funds information?
Audit firms are regulated for anti-money laundering and counter-terrorist financing, and AFRC inspects firms' compliance. Firms therefore verify who owns and controls a client before accepting it, which is separate from the audit tests.
Why it happens The AFRC's inspection work covers practice units' audit quality, quality management and their compliance with anti-money laundering and counter-terrorist financing (AML/CTF) requirements. A firm that does not carry out proper checks risks regulatory action.
What firms usually collect
- Identity documents and addresses for owners, directors and anyone controlling the company.
- Corporate documents showing the ownership structure, including overseas holding companies.
- Information on the nature of the business and the source of funds or wealth, in higher-risk cases.
- Ongoing monitoring updates during the engagement.
Is this part of the audit? It is part of the firm's client acceptance and risk process, not the audit procedures themselves. The auditor also considers money laundering law as part of understanding the business, but the audit is not designed to detect all such activity.
Owners' tips
- Supply documents early, certified where the firm asks.
- For overseas owners, expect extra documents and time.
- Do not take offence; refusal can mean the firm cannot act.
Legal basis
- Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615)
Sources
Applies to 2026 · Last reviewed 29 October 2026
General information for business owners, not legal, tax or professional advice. Rules change, so check the sources or ask a licensed professional before you act.
Related questions
- Do I need consolidated accounts if my Hong Kong company has subsidiaries?A holding company must normally prepare consolidated statements and have them audited. There are exceptions for wholly owned subsidiaries and, with notice, partly owned ones, and for reporting-exempt groups, which may exclude some subsidiaries.
- Does the audit cover the Significant Controllers Register?Not as a stated part of the audit report. The Significant Controllers Register is a separate Companies Ordinance duty of the company. Auditors may still ask who owns and controls the company when assessing related parties and client acceptance.
- Does every Hong Kong limited company need an audit?Yes. Every Hong Kong company must have an auditor for each financial year and its financial statements audited, whatever its size or whether it trades. The only company that escapes is a qualifying private company that has validly become dormant under s.5 and s.447 of the Companies Ordinance.
- Why does Hong Kong require even a small private company to be audited?Hong Kong's Companies Ordinance makes audit a universal requirement for companies, because an independent report on the accounts protects members, creditors, lenders and the tax authority. Small companies get simpler reporting rules, not an audit exemption.
- Do I still need an audit if my company had no revenue or no business activity?Yes, unless the company has formally become dormant. Having no sales does not make a company dormant in law. If it had any expenses, bank charges or other recorded transactions, the audit duty continues for that year.