On 16 July 2021, the U.S. government issued a new advisory highlighting the growing risks associated with doing business in Hong Kong (the Advisory). The Advisory, issued by the U.S. Departments of State, Treasury, Homeland Security, and Commerce, warns U.S. persons of potential reputational, regulatory, financial, and legal exposure following the changes to Hong Kong’s laws and regulations imposed by the Government of the People’s Republic of China (PRC) in June 2020, and the continuous erosion of Hong Kong’s autonomy. The Advisory builds upon the other advisories previously issued by the U.S. government that highlight the range of growing financial crimes and compliance risks associated with doing business in China.1


  • The Biden administration is warning U.S. businesses of the increasing risks of operating in Hong Kong as the PRC continues to apply the National Security Law (NSL) aggressively to residents and foreign persons operating in the Special Administrative Region, including U.S. persons and businesses.2 The NSL created a specialized police force, limited certain legal rights, provided sweeping new powers to the law enforcement, often without judicial oversight, and increased restraints on civil society and the media in Hong Kong.3
  • The Advisory warns of four major risks to any individual or entity operating in Hong Kong: (1) risks to businesses following the imposition of the NSL; (2) data privacy risks; (3) risks regarding transparency and access to critical business information; and (4) risks for businesses with exposure to sanctioned Hong Kong or PRC individuals or entities. The Advisory does not expand prohibitions on U.S. persons operating in China but cautions how the PRC’s actions may create a hostile environment for local and foreign businesses, potentially creating unresolvable conflict of law situations.
  • The Advisory will likely drive further tension and political instability between the United States and China. This Advisory comes at a time of significant tension between the United States and China. In addition to the Advisory, the recent mid-July designation of 14 Chinese companies for alleged human rights abuses and high-tech surveillance in Xinjiang as well as the June Executive Order targeting the Chinese defense or surveillance sectors signal that the Biden administration is willing to continue to take an aggressive approach toward countering the PRC. This approach in turn has triggered a significant Chinese reaction, as China issued a warning of potential retaliatory actions4 and recently put into place an Anti-Foreign Sanctions Law.5 Thus far, China has not taken specific action pursuant to this new legislation. 

The New Advisory and Related Guidance

The Advisory warns that as the PRC increases its control over Hong Kong, businesses continuing to do business there face several types of risks. These risks include:

  • Companies and persons conducting business in Hong Kong, regardless of citizenship, are subject to the laws of Hong Kong, including the NSL. In June 2020, the PRC unilaterally imposed the NSL on all individuals and entities operating in Hong Kong. The NSL authorizes sweeping enforcement actions, including criminal fines and imprisonment, against anyone who participates in activities the PRC deems to be secession, subversion, terrorist activities, or collusion with a foreign country. Foreign nationals, to include one U.S. citizen, have been arrested under the NSL. Furthermore, effective 1 August 2021, a new amendment to the immigration law of Hong Kong would allow local authorities to place exit bans on persons seeking to depart the country, including foreign nationals.
  • The NSL permits the PRC to collect data from businesses and individuals in Hong Kong for actions that may violate “national security.” Such data collection includes extrajudicial authorizations for conducting wiretaps or electronic surveillance and may expand in the future as the PRC is developing legislation affecting data policy, data security, and personal information protection more broadly. U.S. persons and businesses may lose most, if not all, privacy rights when operating in the PRC or Hong Kong. U.S. persons and businesses should also assess if they engage in any activities that the PRC could interpret as creating a threat to China or Hong Kong’s security, such as directly or indirectly supporting political activism in Hong Kong. In addition, in 2020, Beijing expanded significant controls on the Internet into Hong Kong territory to censor, restrict, monitor, and punish noncompliant persons.6
  • There may be PRC-directed or -supported retaliation against companies that comply with U.S. sanctions. In response to sanctions imposed by the United States and EU, the PRC has enacted multiple laws authorizing countermeasures, such as denying visas, deportation, or seizing movable property or real estate. In addition, China’s Ministry of Commerce has issued rules that authorize the State Council to prohibit compliance with foreign legislation and gives Chinese entities the right to bring legal actions against those complying with U.S. sanctions in Chinese courts.
  • Heightened risks exist for businesses dealing with sanctioned persons or engaging in certain activities in Hong Kong. The below chart summarizes current U.S. regulations that may have implications for U.S. and foreign persons and businesses operating in the PRC or Hong Kong.

*Click here to view this table on a mobile device. 

Implications for the Private Sector

  • The NSL is far-reaching and provides the PRC virtually unrestricted powers to impose significant criminal fines and/or imprisonment on persons deemed to have acted against “national security.” The NSL granted significant powers to law enforcement to define what activity could be deemed contrary to national security and eliminated important judicial safeguards for persons found to be in violation of the NSL. The ambiguity in the NSL and its potential applications heightens risks for persons operating in Hong Kong. Any activity, including social media posts or voicing support for democratic processes in Hong Kong, could be in violation of the NSL.
  • China’s enforcement of the NSL against U.S. persons, including U.S. companies, will likely depend—in part—on the Biden administration’s approach towards China. Factors that will likely trigger Chinese enforcement against U.S. persons may include the United States’ implementation of sanctions contained in recent Executive Orders, the success (or failure) of additional trade talks, the U.S. reaction to additional Chinese efforts to stifle the opposition in Hong Kong, and, most recently, the United States’ public attribution that China was behind the cyberattack on Microsoft.7 The EU, NATO, Japan, and several other countries joined the United States in its condemnation of this cyberattack. Such a joint response may signal a more concerted effort to push back on malign Chinese cyber activity. U.S. companies should evaluate their exposure to Chinese companies and closely monitor the evolving relationship between the Biden administration and PRC. Although not specified in the Advisory, regulatory, financial, legal, and reputational risks facing U.S. and multinational companies will likely increase if the Biden administration continues to ramp up pressure on the PRC.
  • China’s retaliatory measures against foreign persons targeting the PRC are likely to increase. Since 2020, the PRC has adopted several laws providing the legal authority for the Chinese government and private individuals and entities to take countermeasures against what the Anti-Foreign Sanctions Law describes as “discriminatory restrictive measures.” This term was likely left purposefully undefined for the PRC to maintain flexibility in future enforcement measures.
  • As the jurisdictional reach of the PRC’s new Anti-Foreign Sanctions Law is extremely broad, U.S. businesses should understand the scope of their potential exposure in case they are included on the countermeasures list. This new law provides the PRC broad authority to target not only persons that directly or indirectly participate in implementation of “discriminatory restrictive measures” against China, but also in the targeted person’s network. Under this authority, the PRC may employ countermeasures against (1) spouses and immediate relatives; (2) senior managers or actual controllers of organizations; (3) organizations in which individuals included in the countermeasures list serve as senior management; and (4) organizations in which persons included in the countermeasures list are the actual controllers.
  • Companies subject to multiple jurisdictions may face challenging conflict of law issues. In addition to U.S. sanctions and export control regulations, the EU and the United Kingdom have also imposed a range of restrictions on certain activities in China and with certain Chinese companies and individuals. Such restrictions create particularly challenging conflict of law issues, as abiding by such requirements may expose these companies to liability under Chinese law. Persons operating in China may have to address multiple, competing regulatory requirements and must carefully assess the associated legal and reputational risks. In such cases, companies should consider proactively engaging with regulators in relevant jurisdictions, as appropriate, to seek to resolve any conflict concerns. 


1 See, e.g., “Updated Xinjiang Supply Chain Business Advisory,” U.S. Department of the Treasury, available at https://home.treasury.gov/system/files/126/20210713_xinjiang_advisory_0.pdf. 
2 “Hong Kong’s National Security Law, 10 Things You Need to Know,” Amnesty International (July 17, 2020), available at https://www.amnesty.org/en/latest/news/2020/07/hong-kong-national-security-law-10-things-you-need-to-know/.
3 “Hong Kong Security Law: What Is It and Why Is It Worrying,” BBC News (July 17, 2021), available at https://www.bbc.com/news/world-asia-china-52765838
4 Foreign Ministry Spokesperson's Remarks on U.S. Issuance of the So-called “Hong Kong Business Advisory” and Sanctions on Officials of the Liaison Office of the Central People’s Government in Hong Kong, Embassy of the People’s Republic of China in the United States of America (July 17, 2021), available at http://www.china-embassy.org/eng/fyrth/t1892928.htm
5 “Anti-foreign Sanctions Law,” The National People’s Congress of the People’s Republic of China, available at http://www.npc.gov.cn/npc/c30834/202106/d4a714d5813c4ad2ac54a5f0f78a5270.shtml.  
6 “China’s Great Firewall Descends on Hong Kong Internet Users,” The Guardian (July 8, 2020), available at https://www.theguardian.com/world/2020/jul/08/china-great-firewall-descends-hong-kong-internet-users. 
7 “Biden Administration Blames Hackers Tied to China for Microsoft Cyberattack Spree,” Wall Street Journal (July 19, 2021), available at https://www.wsj.com/articles/biden-administration-to-blame-hackers-tied-to-china-for-microsoft-cyberattack-spree-11626692401.