Hong Kong lending compliance guide · Free control checklist
Lending compliance and regulatory reporting
Compliance in a Hong Kong lending book is not a module you switch on. It is the accumulated evidence that the operating process did what the licence, the ordinance and the lender’s own policy said it would — produced as a by-product of doing the work, not assembled the week before a review.
Core definitions
Put similar concepts in the right place
Each component solves a different problem. Complete lending operations depend on clear data and workflow hand-offs.
| Item | What it does in practice |
|---|---|
| 01Licensing conditions | The conditions attached to a money lender’s licence shape the operating process. They are the starting point for what the system has to evidence, not an afterthought. |
| 02Borrower data obligations | Collection limited to purpose, recorded consent, controlled access, retention and correction — the PDPO principles applied to a lending file. |
| 03AML duties | Customer due diligence, screening, ongoing monitoring and escalation, with the reason each match was cleared retained on the record. |
| 04Reportable records | Application, approved terms and repayment data structured so the lender can produce what a reporting rule requires without reconstructing it. |
Workflow
Turning obligations into controls a system can evidence
- 01
Work back from the obligation
Start from the licensing condition, ordinance duty or reporting rule, and name the operating step that satisfies it. A control with no obligation behind it is overhead.
- 02
Put the control in the workflow
The check happens where the work happens. A control that lives in a separate compliance checklist gets completed after the fact, which is when it stops being evidence.
- 03
Capture consent and purpose at collection
Record what the borrower agreed to, in which version and through which channel, at the moment of collection.
- 04
Record the reason, not just the outcome
Cleared screening matches, policy exceptions and approval overrides carry a stated reason and a named person.
- 05
Keep the evidence with the file
Documents, decisions, notices and screening results stay attached to the borrower and loan they belong to.
- 06
Structure reportable fields as you go
Hold application, approved-terms and repayment data in the shape a reporting rule needs, rather than deriving it under deadline.
- 07
Review the controls, on a schedule
Track exceptions, overrides and ageing so management sees where the process is drifting before a reviewer does.
Printable worksheet
Free: 15-point lending compliance control checklist
Check each item. Fewer than eleven checks suggests evidence is assembled rather than produced. This is an operational self-assessment, not legal or compliance advice — confirm individual duties against current official guidance and professional advice.
Practical evaluation
Three things compliance software cannot do
It cannot certify you
No vendor can make a lender compliant or attest that it is. Software produces evidence; the assessment belongs to the lender, its advisers and its regulator.
It cannot rescue evidence created late
A record assembled after the fact reads as one. Controls that run inside the workflow produce evidence with the right timestamps because they happened when the work did.
It cannot decide what your obligations are
Licensing conditions and duties differ by lender and change over time. The system encodes the process you have determined you owe, and confirming that determination is professional work.
Frequently asked questions
Quick answers
What does lending compliance software actually do?
It puts the checks a lender owes inside the operating workflow, so consent, due diligence, screening, approval authority, notices and reportable fields are recorded as staff work rather than reconstructed for a review.
Does Covenant Desk make a lender compliant?
No. Covenant Desk is not a regulator, law firm or compliance certifier and does not certify that a lender is compliant. It provides controls and evidence; the obligation and the assessment remain the lender’s.
How does this relate to Credit Data Smart?
The Credit Data Smart rules proposed to take effect on 1 June 2027 would require licensed money lenders to submit specified credit data. Covenant Desk structures application, approved-terms and repayment records so a lender can produce that submission; the lender remains responsible for making it.
Where do AML duties fit?
Customer due diligence, screening and ongoing monitoring run inside the same borrower record as origination and servicing, so the reason a match was cleared sits with the file rather than in a separate spreadsheet.
Primary sources
Official sources and editorial note
This guide reflects official material available on the review date. Requirements can change; each institution should check the latest licence conditions and obtain legal or compliance advice. This page is not legal advice. Read our editorial and corrections policy.
- Companies Registry: money lender licensing conditions and guidance
- Companies Registry: AML/CFT guideline for licensed money lenders
- Money Lenders Ordinance (Cap. 163)
- Office of the Privacy Commissioner for Personal Data: Code of Practice on Consumer Credit Data
- Financial Services and the Treasury Bureau: consultation conclusions on enhanced regulation of money lenders
Next step
Make the evidence a by-product of the work, not a project before a review.
Try Covenant Desk to see consent capture, due diligence, approval authority, retained notices and reportable record structure inside one lending workflow.
Covenant Desk is lending operations software. It does not provide loans, issue credit reports or replace the lender’s final credit decision.