Hong Kong - Market Insights

US secondary sanctions risk for Hong Kong institutions

The landscape: where US risk meets Hong Kong reality

Hong Kong institutions face exposure not only to the threat of US primary sanctions, but also the risk of secondary sanctions. Secondary sanctions target conduct that does not have a US nexus. Given their reliance on multinational supply chains and the global financial infrastructure, Hong Kong corporates and financial institutions must understand how these indirect pathways pose a central compliance concern. We will discuss that reality and how to handle that threat.

In summary, US sanctions are generally categorized as primary and secondary. Primary sanctions apply to US persons, US-incorporated entities, and any person within the United States, and prohibit transactions with designated embargoed jurisdictions, or restricted goods or services involving a US nexus, such as US-dollar clearing or US-origin technology. Secondary sanctions, by contrast, allow the US to penalize non‑US persons for certain dealings with sanctioned parties or sectors even without a US nexus, deterring conduct seen as undermining US sanctions policy by threatening consequences such as loss of access to the US financial system or designation. Many consequential measures target conduct and relationships rather than geography, so dealings with restricted sectors, state‑linked actors, or companies with opaque ownership and control can create material risk even where parties, goods, and funds appear to remain outside the US.

In addition to these compliance concerns from the US, Hong Kong’s domestic framework adds operational complexity. A mix of sector‑specific and conduct‑focused regimes governs anti‑money laundering, securities trading, and strategic commodities. These include:

• the Organized and Serious Crimes Ordinance (Cap. 455);
• the Anti‑Money Laundering and Counter‑Terrorist Financing Ordinance (Cap. 615);
• the Securities and Futures Ordinance (Cap. 571); and
• the United Nations Sanctions Ordinance (Cap. 537).

The Import and Export Ordinance (Cap. 60) and its Strategic Commodities Regulations regulate technology and dual‑use goods, while the Weapons of Mass Destruction (Control of Provision of Services) Ordinance (Cap. 526) captures certain service‑related risks. Managing US secondary sanctions exposure within this environment requires cohesive compliance architecture, clear governance, and practical decision‑making across functions.

Recent patterns in secondary-sanctions exposure

In 2025, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned 174 Hong Kong–linked individuals, entities, and vessels, encompassing those that were Hong Kong national, Hong Kong incorporated, Hong Kong flagged, or owned by Hong Kong companies. The following developments illustrate how secondary sanctions and export‑control risk can manifest for Hong Kong institutions even when the underlying conduct occurs outside traditional jurisdictional hooks.

Hong Kong intermediaries implicated in Iran-related shadow-banking networks

On June 6, 2025, OFAC designated more than 30 individuals and entities associated with an Iranian shadow‑banking network that moved billions of dollars through foreign exchange houses and front companies. The action included 17 Hong Kong‑based intermediaries and Hong Kong‑incorporated companies that moved funds on behalf of sanctioned Iranian actors in the oil, petrochemical, and weapons‑procurement sectors. According to OFAC, the fronts made and received payments for sanctioned goods and relied on fictitious invoices and layered third‑country payments to disguise origin and purpose.

For Hong Kong financial institutions, the episode shows that seemingly routine flows involving regional trading companies can sit next to the financial architecture of a sanctioned regime. The action also demonstrates OFAC’s willingness to apply secondary sanctions to non‑US persons who materially assist designated actors regardless of an obvious US nexus. For corporates, it underscores the need for enhanced due diligence where ownership is opaque, multiple currencies are used, or trade documentation appears atypical.

US export control enforcement involving Hong Kong shipments

A very recent enforcement action by the US Department of Commerce’s Bureau of Industry and Security (BIS) illustrates the risk of nontransparency in shipments involving Hong Kong, even though OFAC sanctions are not involved. BIS issued a Final Order imposing a civil penalty of USD 1 million on a US thermal‑imaging manufacturer for 19 violations of the Export Administration Regulations, several of which involved exports to Hong Kong addresses that BIS added to the Entity List in June 2024 due to repeated use as transshipment points for sensitive goods bound for Russia. The issue surfaced in February 2025, when an employee identified the address match and escalated it, leading to a voluntary self‑disclosure.

The case underscores the significance of address‑based Entity List entries and the heightened sensitivity of shipments routed through Hong Kong. BIS’s decision to list addresses rather than named entities signals a shift toward targeting physical locations associated with diversion, meaning that any Hong Kong business operating from or shipping to such addresses can trigger license requirements even if it is not designated. The case also highlights BIS’s focus on dual‑use items and logistics chains linked to Mainland China. Hong Kong importers, distributors, and service providers should maintain screening systems that detect address‑only listings and verify licensing obligations, end‑use conditions, and US‑origin content before accepting or forwarding controlled goods.

US legislative and geostrategic frameworks intensifying’s Hong Kong’s exposure

Hong Kong’s secondary‑sanctions exposure is shaped not only by case‑specific enforcement patterns but also by broader geopolitical frameworks that elevate the city’s systemic risk profile. Two developments — the statutory mechanics of the Hong Kong Autonomy Act (HKAA) and a major analytical report released by the US-China Economic and Security Review Commission (USCC) — offer an important macro‑context for why US authorities increasingly view Hong Kong as a high‑risk jurisdiction within US sanctions and export‑control architecture.

Under the HKAA, foreign financial institutions (FFIs) face mandatory secondary sanctions if they knowingly conduct significant transactions with individuals identified in the Section 5(a) Report as contributing to the erosion of Hong Kong’s autonomy. FFIs named in the subsequent Section 5(b) Report are subject to a phased sanctions regime requiring the imposition of at least five sanctions within one year and all 10 within two years. Though Treasury applies a totality‑of‑circumstances analysis — including transaction size, frequency, and nexus to a listed person — the statute creates strict, non‑discretionary exposure for non‑US institutions. Limited safe harbors, such as 30‑day wind‑downs or corrective measures, do not mitigate the core reality: any qualifying transaction risks triggering mandatory penalties and potential SDN linkage, significantly expanding the enforcement perimeter for Hong Kong‑based financial intermediaries.

On November 14, 2025, the USCC published a report characterizing Hong Kong as a central node in China’s industrial‑scale sanctions‑evasion ecosystem. The Commission concluded that Hong Kong’s financial openness, ease of corporate formation, and logistics networks have increasingly enabled the movement of sanctioned goods, dual‑use items, and illicit financial flows tied to Iran, Russia, and North Korea. The report highlights the city’s growing role as a transshipment hub, including the use of shell companies, altered customs codes, and address‑based clusters of diversion activity — some of which have been added to the Entity List. Although the accuracy of the report has been harshly criticized by Beijing and Hong Kong, the report has been used to justify further restrictions and enforcement efforts by US authorities.

Designing a defensible compliance framework for secondary sanctions

For Hong Kong financial institutions and corporates, an effective response is a structured, repeatable framework that moves teams from identification to escalation, decision, and governance. The purpose is not to eliminate risk but to reach consistent, defensible outcomes that stand up to auditor, counterparty, and regulatory review.

Identification: mapping risk across counterparties, transactions and sectors

Identification requires a clear view of counterparties, transaction mechanics, and sector exposure. In Hong Kong, counterparties often sit behind joint‑ventures or layered structures. For example, consider a trading house owned 40% by one affiliate of an entity that is included on the Specially Designated and Blocked Nationals (SDN) list administered by the OFAC, the key US regulatory agency responsible for sanctions. If that trading house were also 15% owned by another SDN-blocked entity, the trading house would be blocked under OFAC’s 50 Percent Rule because blocked ownership aggregates to 55%, even without a single majority owner.

Moreover, institutions should look beyond share percentages to board‑appointment rights, veto powers, and contractual levers that create de facto control. Under OFAC regulations, while entities that are less than 50% owned by blocked persons are not automatically considered blocked entities, OFAC has taken the position that such entities “may be the subject of future designation or enforcement action by OFAC.” Moreover, OFAC has also issued a recent Sanctions Advisory on “sham transactions” where “blocked persons have used opaque legal structures (including trusts), proxies, straw owners, and front businesses, among other mechanisms, to conceal their continuing interest in a variety of types of property, such as investment vehicles, bank accounts, real estate holdings, private jets, yachts, and companies.” The Advisory notes that: “Because OFAC implements functional definitions of ‘interest’ and ‘property interest’ that look beyond legal formalities to underlying practical and economic realities, sham transactions do not terminate a blocked interest in property.” (See OFAC’s Sanctions Advisory “Guidance on Sham Transactions” March 31, 2026.)

Institutions conducting due diligence should also surface shadow counterparties — freight forwarders, logistics subcontractors, and service companies — that materially participate but may be absent from core documentation. On the transaction side, trace currency paths and correspondent banks, assess shipment routes and transshipment hubs, and review contract terms that obscure end‑use. Prioritize higher‑risk sectors such as advanced electronics, aerospace, maritime, energy, insurance, and virtual assets, and apply enhanced diligence to dual‑use items moving through third‑country “integrators.”

Escalation: when and how to conduct counsel-led inquiries

Escalation is warranted where ownership or control is unclear — for example, a Hong Kong trader ultimately held through BVI and Malaysian layers with nominee shareholders — or where counterparties lack transparency, such as a Shenzhen supplier using an unstaffed Hong Kong “registered office.” It is also appropriate when routing suggests risk, including re‑exports from Hong Kong to the UAE or Central Asia before onward shipment to Russia, or where sector red flags appear, such as Hong Kong orders for drone‑compatible sensors described only as “industrial modules.” A counsel‑led scoping memo should frame facts, issues, and stakeholders, followed by legal holds and targeted data collection of emails, chats, trade documents, shipping records, payment instructions etc. Furthermore, structured interviews should be conducted to clarify outstanding issues and external confirmations — including Companies Registry extracts, carrier bills, and checks with freight forwarders — should be obtained. For sensitive goods, engineering input should be sought to verify the intended end-use and the technical performance characteristics of the items.

Decision: a structured, defensible outcome

After investigation, institutions should translate findings into a clear outcome. One path is to proceed with mitigation by obtaining enhanced representations such as commitments against re‑export or Russian end‑use, securing end‑use certificates, adding audit rights, imposing shipment controls such as using a named forwarder and fixed routing, and applying calibrated monitoring. Another option is to restructure by substituting a vetted distributor, altering routes through lower‑risk hubs or shifting from US dollar settlements to currencies like euros or Hong Kong dollars. A third option is to pause or exit when visibility is insufficient or when risk exceeds appetite, for example when Ultimate Beneficial Owner (UBO) gaps cannot be resolved or when an address appears on the Entity List. Decision‑makers should also consider communication needs with counterparties, banks, insurers, and, where appropriate, authorities. Every outcome should be paired with remediation such as onboarding refinements, model tuning, and targeted training.

Governance: anchoring the framework in institutional practice

Governance embeds the framework so that it operates by default. Boards should articulate risk appetite and thresholds for exceptions. Roles across the three lines of defense must be defined, with service‑level expectations for escalation. Model risk management should cover screening‑tool validation, tuning, back‑testing, and documentation of overrides. Above all, governance relies on evidence‑ready records: standardized decision memos, escalation logs, and audit trails that demonstrate consistency and accountability.

Trendlines and pressure points

Across the market, several trends shape how institutions approach secondary sanctions. First, ownership and control analysis have deepened as institutions confront layered structures and limited transparency in regional networks. Adequate Know Your Customer (KYC) now requires mapping voting rights, board influence, and informal control, especially where trading intermediaries or investment vehicles are involved. Second, payment and trade‑finance routing have become persistent pressure points. Banks scrutinize correspondent chains, payment corridors, and transshipment hubs, which has raised escalation volumes and the demand for legal interpretation. Third, sectors involving advanced electronics, industrial components, and other dual‑use goods face higher expectations for end‑use and end‑user verification because downstream visibility is often limited. Finally, governance expectations have risen. Boards seek clearer risk‑appetite statements, structured decision frameworks, and documented override rationales in anticipation of counterparty and regulatory scrutiny.

Conclusion

Secondary‑sanctions exposure in Hong Kong is now a structural reality. Recent enforcement actions show how Hong Kong intermediaries and logistics chains can trigger US sanctions even without a US nexus, while the HKAA’s mandatory secondary‑sanctions regime and the USCC’s depiction of Hong Kong as a systemic evasion hub underscore that these risks are embedded in Washington’s strategic outlook. Institutions that apply rigorous ownership analysis, disciplined escalation, and evidence‑ready governance will be better positioned to navigate this environment and maintain access to global markets. Ultimately, defensible, documented decision‑making remains the most effective safeguard against regulatory, transactional, and reputational risk.