Risk categories and seven strategies in Article 19's digital payments handbook

Article 19, a freedom of expression organisation, has published a handbook on digital payments in Traditional Chinese and English. It sets out what banks, money transfer services and payment platforms collect, whom they share it with and how long they keep it, and offers seven strategies for reducing the risk. The examples centre on transactions between Hong Kong and the UK and US, and Article 19 notes that "similar lessons apply elsewhere".

The executive summary starts from the point that every financial transaction leaves a trail, and that money held in US or UK banks can still carry risk. According to the handbook, since the Law of the People's Republic of China on Safeguarding National Security in the Hong Kong Special Administrative Region (the National Security Law) took effect in 2020, the authorities have tracked financial transactions, frozen accounts and cut off funding to put pressure on the people they target and on anyone who sends them money or receives money from them. Article 19 sorts the main risks for transactions in and out of Hong Kong into four kinds: compelled disclosure, asset freezes and account closures, pressure on associates such as relatives and donors, and cross-border reach (this is the handbook's account, and we did not separately look for a response from the Hong Kong government).

Under Know Your Customer (KYC) rules, the checks financial institutions use to verify who a customer is, institutions collect the customer's name, date of birth, government-issued ID, nationality, address and tax identifiers when an account is opened, and also record the account's purpose, the customer's occupation and the source of funds. According to the handbook, financial institutions generally do not receive item-level purchase details, but payment activity can still reveal health-related expenses, charitable and political contributions, travel patterns and purchasing habits. Records are kept for at least five years after the customer relationship ends; Hong Kong's tax and company regulations require seven, and some providers keep them for ten.

In the handbook's walk-through of a wire transfer, the sending bank, any intermediary banks and the receiving bank can all view the full identities of both parties. Financial institutions file suspicious transaction reports with a financial intelligence unit, which in Hong Kong is the Joint Financial Intelligence Unit, run jointly by the Hong Kong Police Force and the Customs and Excise Department. Article 19 writes that this places financial intelligence analysis "directly inside the territory's policing apparatus". Data is also shared with third-party providers such as cybersecurity, marketing and credit reference firms.

Joint holders, authorised signatories, family members and frequent counterparties all go into the account profile, and according to the handbook scrutiny "can flow in both directions", so the people someone transacts with can come under scrutiny too. Significant or unexplained changes in account activity, transactions involving unknown third parties, the use of cryptocurrency, and unusual frequency or amounts can all trigger closer monitoring. Because these systems "evaluate patterns rather than intent", legitimate activity can be flagged as well, and an institution may file a report without notifying the customer.

The seven strategies, in order, are to limit the information shared to the minimum required by law, structure your financial life, know the transaction flow, maintain consistent banking habits, know the company, know your rights, and be prepared. Concrete steps include not opting into voluntary programmes when opening an account and removing unnecessary joint holders and connected accounts. Once something goes wrong with an account, Article 19 recommends documenting everything, not acting alone and seeking legal advice.

Article 19 lists five questions to ask when choosing a provider: whether it requires formal legal process before sharing data, whether it challenges overbroad requests, whether it notifies users when their data is requested, where it stores data, and whether it publishes a transparency report. Providers' public documents differ, with some committing to formal legal process and to challenging overbroad requests, and others reserving room to share data without a court order. An appendix rates each provider on the basis of its public documents, with a note that the column on responses to government requests "reflects each company's public commitment only — compliance cannot be independently verified".

Perspective

The handbook's table of key regulations starts with the Financial Action Task Force (FATF), which sets global standards through its 40 Recommendations, and then lists rules for Hong Kong, the UK and the US, such as Hong Kong's Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the US Currency and Foreign Transactions Reporting Act (also known as the Bank Secrecy Act). Verifying identity, keeping records and reporting suspicious transactions are what these rules require providers to do. Our inference from the table is that the same obligations remain when someone switches to another provider or app. Article 19 also writes that "no company can guarantee protection against lawful government access".

Under Article 26 of Taiwan's Act Governing Electronic Payment Institutions (as amended on 19 January 2023), specialised electronic payment institutions must keep each transaction's stored-value card or account number, item, date, amount and currency, including for incomplete transactions, for at least five years after the transaction is completed or stopped. When the tax authorities or customs request these records together with identity-verification data, the institutions may not refuse. Article 8 of Taiwan's Money Laundering Control Act (as amended on 31 July 2024) requires financial institutions covered by the Act to keep customer identification data for at least five years after the business relationship ends. In Singapore, Notice PSN01 of the Monetary Authority of Singapore (MAS), last revised on 30 June 2025, prohibits licensed payment service providers from opening or maintaining anonymous accounts or accounts in fictitious names (paragraph 7.1) and requires them to keep customer due diligence information and transaction records for at least five years (paragraph 16.3).

Among the transfer methods covered in the handbook, cryptocurrency exchanges still run KYC when converting to government-issued currency, and Article 19 warns that "pseudonymous payments should not be treated as anonymous". Blockchain analytics can link wallet addresses to real-world identities, and once investigators trace funds to an exchange they can use subpoenas or court orders to obtain full account records, IP addresses and transaction histories. Cryptocurrency payments are generally difficult to reverse and lack dispute and government-insurance protections, and users can lose money to scams, compromised private keys or rapid price swings. By the handbook's assessment, avoiding third parties entirely would mean relying on cash alone, which is impractical for most people, while providers that collect less data may also have weaker security.

The monitoring triggers in the handbook include the use of cryptocurrency and significant changes in account activity, so our inference is that a sudden switch to cryptocurrency would meet both. In its advice on keeping separate devices, Article 19 notes that using multiple devices can also be flagged by financial institutions as unusual behaviour. Repeated transfers from splitting a payment can make the relationship between the two parties more visible, and unless there is a legitimate reason to pay separately, Article 19 suggests consolidating into a single transaction to reduce the number of records.

According to the handbook, Hong Kong's Personal Data (Privacy) Ordinance applies to any organisation, whether in Hong Kong or not, that controls the collection, holding, processing or use of personal data in Hong Kong. Legal remedies usually become available only after harm has occurred. Among the points Article 19 describes as hard to verify from outside are the separation of Hong Kong databases from the rest of the company at some multinationals, and how data exchange between financial intelligence units works in practice.

The handbook is released under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 (CC BY-NC-SA 4.0) licence, so it can be translated or adapted for non-commercial use with attribution, and derivative works must carry the same licence. As of 2 November we could not find a Simplified Chinese edition. The handbook is written for readers who already understand the fundamentals of digital security and risk management.

For people who need to send or receive money across borders and face higher risk, Article 19 recommends prioritising providers with no Hong Kong-registered entity. Its reasoning is that Hong Kong authorities can serve demands directly on a registered entity "without going through international legal channels that may provide more robust privacy and notice protections". Article 19 also suggests asking the sending institution which intermediary banks the transfer will pass through, and preparing alternative channels in case an account is frozen. For anyone who believes they are being targeted, Article 19 recommends seeking independent legal advice as early as possible (we have not checked each jurisdiction's rules item by item, and this summary is not legal advice).

According to the handbook, platform "defaults are rarely set in your favour", and privacy settings are often opt-out rather than opt-in. People concerned that their payment records reveal their relationships or views can open the payment apps they use most and, following the handbook's advice, turn off marketing and personalisation options and disable non-essential camera and location permissions. Our inference from the handbook's section on regulations is that changing marketing, personalisation and permission settings reduces what is made public and shared, while the identity and transaction records that providers must keep by law remain. Account security is a separate matter, and the step listed in the handbook is enabling multi-factor authentication, with authenticator apps generally more secure than SMS codes.