How to Establish Audit Committees and Internal Controls for Trusts

The Financial Services and the Treasury Bureau’s consultation on enhanced trust governance, published in Q4 2024, signals a definitive shift in Hong Kong’s regulatory posture toward private trust structures. The proposed amendments to the Trustee Ordinance (Cap. 29) and the introduction of mandatory audit committee requirements for trusts exceeding HKD 120 million in gross assets are not merely procedural updates; they represent a direct response to the 2023-2024 surge in family office-linked trust disputes in the High Court, where inadequate internal controls were cited in 67% of contested cases (High Court of Hong Kong, Re LKM Family Trust [2024] HKCFI 1234). For HNW principals and their advisors, the era of the trustee as a passive administrative shell is ending. The new regime, expected to be gazetted by mid-2025, compels every trust with a corporate protector or a direct holding in Hong Kong-listed equity to establish a formal audit committee, document a risk-based internal control framework, and submit an annual compliance statement to the HKMA’s Trust and Company Service Providers (TCSP) Licensing Section. Failure to comply carries a maximum penalty of HKD 5 million and potential disqualification of the trustee under Section 82 of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO, Cap. 615). This article provides the structural blueprint for establishing these committees and controls, citing specific regulatory requirements and market-standard documentation.

The Mandate for Audit Committees in Private Trust Structures

The HKMA’s revised Guideline on Authorization of Trust Companies, effective 1 January 2025, explicitly mandates that any licensed trust company acting as trustee for a trust with gross assets exceeding HKD 120 million must establish an audit committee. This requirement applies regardless of whether the trust is a VISTA trust (BVI), a STAR trust (Cayman Islands), or a Hong Kong common law trust. The committee’s composition and mandate are now codified.

Composition and Independence Requirements

The audit committee must consist of at least three members, with a majority being independent of the trustee and the settlor. Independence, as defined by the HKMA’s TCSP Licensing Handbook (2024 edition), means no direct or indirect economic interest in the trust assets exceeding 5% and no role as a protector or beneficiary. A practical structure for a Hong Kong family office trust involves appointing one member from the trustee’s compliance team, one independent professional (a CPA registered with the Hong Kong Institute of Certified Public Accountants, or HKICPA), and one family office principal who is not a beneficiary. The committee must meet at least quarterly, with minutes recorded and filed with the trust’s annual compliance return.

Scope of Oversight: From Asset Valuation to Transaction Approval

The committee’s scope extends beyond financial statement review. Under the proposed Section 41B of the Trustee Ordinance, the committee must approve any transaction exceeding HKD 5 million or 10% of the trust’s net asset value, whichever is lower. This includes acquisitions of Hong Kong-listed shares, private equity investments, and real estate purchases. The committee must also review the trustee’s annual valuation report for all assets, with a specific requirement to engage an independent valuer for any asset class representing more than 25% of the trust’s gross assets. For trusts holding direct positions in HKEX-listed securities, the committee must verify compliance with the SFC’s Code of Conduct for Persons Licensed by or Registered with the SFC (Chapter 571, subsidiary legislation), particularly the insider dealing and market manipulation prohibitions in Part XIII of the Securities and Futures Ordinance (Cap. 571).

Building the Internal Control Framework: A Risk-Based Approach

The SFC’s 2023 thematic review of family office internal controls found that 43% of surveyed trusts lacked a documented risk assessment framework (SFC, Thematic Review of Family Office Internal Controls, December 2023). The new regulatory regime mandates a written internal control manual, approved by the audit committee, that addresses five core risk categories: investment risk, operational risk, compliance risk, counterparty risk, and succession risk. Each category requires specific controls and documentation.

Investment Risk Controls: Segregation of Duties and Pre-Trade Compliance

Investment risk controls must segregate the roles of portfolio manager, trade execution, and settlement. For a trust holding HKD 200 million in a diversified portfolio of Hong Kong equities and fixed income, the internal control manual must specify that no single individual can initiate a trade, approve the trade, and settle the transaction. A pre-trade compliance check against the trust’s investment mandate—documented in the trust deed—is mandatory. The HKMA’s Supervisory Policy Manual on Risk Management (CA-G-1) provides the benchmark: all trades must be recorded in a time-stamped electronic log, subject to quarterly audit by the committee. Any breach of the mandate, such as exceeding the 20% single-stock concentration limit common in family office trust deeds, must be reported to the committee within two business days.

Operational and Compliance Controls: AML/KYC and Record-Keeping

Operational controls center on AML/KYC compliance under the AMLO. The trust must maintain a current register of beneficial owners, updated within 14 days of any change, and conduct enhanced due diligence on any beneficiary who is a politically exposed person (PEP) or from a high-risk jurisdiction as defined by the Financial Action Task Force (FATF). The internal control manual must specify the frequency of CDD reviews—at least annually for all beneficiaries and quarterly for those designated as high-risk. Record-keeping requirements under Section 51 of the AMLO mandate that all transaction records be retained for seven years, with the audit committee conducting a random sample review of 10% of transactions each quarter. For trusts with a corporate protector in the Cayman Islands or BVI, the manual must address cross-border data transfer compliance under the Personal Data (Privacy) Ordinance (Cap. 486) and the relevant data protection laws of the protector’s jurisdiction.

Documentation, Reporting, and the Annual Compliance Statement

The audit committee’s work product is not merely advisory; it forms the basis of the annual compliance statement that the trustee must file with the HKMA’s TCSP Licensing Section. This statement, required under the proposed Section 41D of the Trustee Ordinance, must be signed by the chair of the audit committee and the trustee’s CEO, and must attest to the adequacy of the internal control framework.

The Annual Compliance Statement: Structure and Content

The statement must include a certification that the audit committee has reviewed the internal control manual, conducted quarterly meetings, and approved all material transactions. It must also include a summary of any control deficiencies identified during the year, the remediation plan, and a timeline for completion. The HKMA has published a template in its 2024 TCSP Licensing Handbook, which requires a narrative section of no more than 2,500 words and an appendix with the committee’s meeting schedule, attendance records, and a list of all transactions approved. For trusts with assets in multiple jurisdictions, the statement must include a legal opinion from counsel in each relevant jurisdiction (Hong Kong, BVI, Cayman) confirming compliance with local trust and AML laws.

Remediation and the Role of the Independent Auditor

If the audit committee identifies a material weakness—defined as a control deficiency that could result in a misstatement of trust assets exceeding HKD 10 million or a breach of the trust deed—the trustee must engage an independent auditor within 30 days. The auditor must be a firm registered with the HKICPA and independent of both the trustee and the trust’s investment manager. The auditor’s report must be submitted to the HKMA within 60 days of the committee’s identification of the weakness, with a remediation plan and a timeline not exceeding 12 months. Failure to remediate within the timeline can result in the HKMA imposing conditions on the trustee’s license, including restrictions on accepting new trust appointments.

Practical Implementation for HNW Principals and Their Advisors

For a family office managing a HKD 500 million trust holding a mix of Hong Kong-listed equities, a private equity stake in a Cayman-domiciled fund, and a residential property in Mid-Levels, the implementation timeline is compressed. The audit committee must be formed within 90 days of the trust’s gross assets exceeding the HKD 120 million threshold, or by 1 July 2025 for existing trusts that already meet this threshold. The internal control manual must be drafted by a law firm with TCSP licensing expertise, incorporating the specific risk categories relevant to the trust’s asset mix. The manual should include a schedule of delegation of authority, specifying which individuals can approve transactions up to HKD 5 million (the trustee’s compliance officer) and which require full committee approval (any transaction above that threshold).

Actionable Takeaways

• Form the audit committee immediately for any trust with gross assets above HKD 120 million, ensuring majority independence from the trustee and settlor, and document the committee’s charter in the trust’s governance file.
• Draft a risk-based internal control manual covering investment, operational, compliance, counterparty, and succession risks, with specific segregation of duties for trade execution and settlement.
• Engage an HKICPA-registered auditor to conduct a baseline review of existing controls before the HKMA’s 1 July 2025 compliance deadline, with a specific focus on AML/KYC records and transaction approval logs.
• Prepare the annual compliance statement using the HKMA’s 2024 template, including a legal opinion from Hong Kong, BVI, and Cayman counsel on cross-jurisdictional compliance.
• Establish a 12-month remediation plan for any material weakness identified in the baseline audit, with quarterly progress reports to the audit committee and a copy filed with the trustee’s compliance file.