Security and compliance

Your obligations. Our evidence.

Covenant Desk Lending is software. Every obligation on this page belongs to your money lender’s licence, not to our product. What we publish is which of them our records, controls and exports are built to evidence — and where the line sits.

See the framework Book a review

Cap. 163Money Lenders Ordinance, the instrument your licence sits under
PDPOdata-user obligations mapped before rollout, alongside AML and CFT record duties and CDS-ready exports
Your own databasea separate cluster per client, so no two lenders share storage

How it is protected

Separate storage, and a locked front door.

Every client gets their own database cluster. Your borrower records are not rows in a shared table alongside another lender’s. They live in storage provisioned for you, which is what keeps one client’s data private from every other client rather than relying on a filter in the application to hold the line.

Getting in takes more than a password. Two-factor authentication protects staff accounts, reCAPTCHA screens automated sign-in and form attempts, and an account is limited to one active session at a time, so a shared or stolen credential cannot quietly be used in two places at once.

Inside, access is scoped and recorded. Staff see only the companies and modules their role allows, exact-HKID lookups across companies are permission-scoped, phone numbers are masked, and sensitive lookups, edits and admin changes are written to an audit log against a named user and timestamp.

What this is not. No regulator certifies lending software in Hong Kong, so nothing here is an accreditation. These are the controls the product implements; the obligations they help you meet are set out below, and they remain yours.

The framework

Nine obligations, and what the software does about each.

Each item names the instrument and the body behind it. Where a duty is yours alone, it says so.

01

Money Lenders Ordinance (Cap. 163)

Licences are granted by the Licensing Court, subject to the conditions it imposes. The Registrar of Money Lenders — a role held by the Registrar of Companies through the Companies Registry — processes applications and renewals, maintains the public register and monitors compliance. The Commissioner of Police examines applications and investigates complaints.

In the product: application, approval, agreement and repayment records are structured so the whole file behind any one loan can be produced intact.

02

Statutory interest limits

Since 30 December 2022 the effective interest rate cap under Cap. 163 has been 48% per annum, with 36% per annum as the extortionate threshold above which a court may reopen a transaction under section 25.

In the product: the effective rate is computed on every product configuration and flagged against the thresholds you set. The thresholds are configured by you and applied by your staff.

03

Licensing conditions

Additional and revised licensing conditions imposed on grant or renewal cover a debt servicing ratio cap and repayment-period limit for low-income earners on unsecured personal loans, a risk-warning statement in advertising, and — where a referee is provided — a written consent signed by that referee, attached to the loan agreement.

In the product: income evidence, the DSR calculation and the repayment term sit on the application record, and a referee's signed consent is captured and attached to the loan rather than the referee's details being taken on their own. Condition 13 also requires a lender that learns the consent was not in fact signed by the referee to stop using that referee's information, so the record has to make that reversible. The caps themselves are promulgated by the Registrar; we implement the figures you are subject to, we do not set them.

See the remaining six obligations AML and CFT · Suspicious transaction reporting · Records and audit · Personal data · FPS · Credit Data Smart

04

Anti-money laundering and counter-terrorist financing

Money lenders are not “financial institutions” or designated non-financial businesses under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615). The duty reaches you through your licensing conditions instead, which require compliance with the Registrar’s AML/CFT guideline for licensed money lenders; non-compliance is an offence under section 29 of Cap. 163.

In the product: customer due diligence records, screening results, ongoing monitoring notes and the analysis behind them stay on the customer record. Watchlist screening is decision support; your authorised staff make the determination.

05

Suspicious transaction reporting

Separately from Cap. 615, the Drug Trafficking (Recovery of Proceeds) Ordinance, the Organized and Serious Crimes Ordinance and the United Nations (Anti-Terrorism Measures) Ordinance each impose a direct duty on any person — money lenders included — to report suspicion to the Joint Financial Intelligence Unit.

In the product: an internal escalation trail from the flagging staff member to your Money Laundering Reporting Officer, with the tipping-off restriction reflected in what the borrower-facing app shows. Covenant Desk does not file reports and does not transmit to the JFIU.

06

Records and audit trail

The Registrar’s AML/CFT guideline requires due diligence records, transaction records, correspondence and analysis to be kept throughout the business relationship and for at least five years after it ends, with an audit trail that is clear, complete and retrievable quickly.

In the product: sensitive lookups, profile edits, sync actions and admin changes are logged against a named user and timestamp, and the underlying records export on demand. Retention periods are configured by you; nothing is deleted on our schedule.

07

Personal data

The Personal Data (Privacy) Ordinance applies to you as data user. Borrower data in Covenant Desk is yours.

In the product: implementation maps your consent points, collection statements, staff access scope, retention expectations and data access request handling before rollout. Software can help you meet PDPO obligations; no product is “PDPO certified”, and no such certification exists.

08

Faster Payment System

FPS is payment infrastructure introduced by the Hong Kong Monetary Authority and operated by Hong Kong Interbank Clearing Limited. Its participants are licensed banks and licensed stored value facility operators only, so neither a money lender nor a software vendor can be an FPS participant, and there is no FPS certification for software.

In the product: FPS-standard QR codes are generated and read, FPS proxies are recorded against loan accounts, and credits are reconciled — through your own bank or payment service provider.

09

Credit Data Smart

CDS is the multiple credit reference agency framework launched in 2024. Participation by money lenders is voluntary today. The Government has proposed two further licensing conditions, both proposed to take effect on 1 June 2027 with a transitional period: 30-day submission of borrower credit information for unsecured personal lending, and a lowered threshold for joining. These remain proposals.

In the product: application, approved-terms and repayment records are structured into the fields the proposal describes, so you can export and submit them. Covenant Desk does not operate CDS and does not submit on your behalf: the export is handed to you, never transmitted for you.

Covenant Desk publishes regulatory context, not legal advice. Confirm how these requirements apply to your licence and your loan book with your own legal and compliance advisers.

Controls

What your team can review before production setup.

01

Role-based access

Admin, manager, staff and viewer roles combine with permission triples for module, feature and action-level control.

02

Company scoping

Staff can be scoped to one company or a controlled set of company units, while admins keep the group-level view.

03

Audit logs

Sensitive lookups, assistant queries, profile edits, sync actions and admin changes are recorded for traceability.

04

HKID and phone handling

Exact-HKID search is permission-scoped and audit-logged. Phone numbers are masked where the user context requires it.

05

Borrower consent

Intake and loan request flows preserve selected-lender consent, so a lender receives only the requests the borrower chose to share.

06

AI boundaries

AI output is decision support for human review. Admin-only edits require proposal, confirmation, application and audit logging.

Review the controls against your own licence conditions.

Bring your licensing conditions, your AML procedures and the records your auditor asks for. We will show you where each one lands in the system rather than walking through a feature list.

Book a review Read the CDS guide