Can Hong Kong licensed money lenders use WhatsApp for customer messaging?
What does the Money Lenders Ordinance mean for customer communications?
Which WhatsApp messages can lenders send without marketing consent?
How do PDPO direct-marketing rules apply to loan offers on WhatsApp?
How should loan repayment reminders be structured on WhatsApp?
What governance do compliance teams expect behind WhatsApp lending conversations?
FAQ: Money Lenders Ordinance and WhatsApp messaging
They can — and the market expectation is already set. In Hong Kong, WhatsApp is the default way people talk to businesses, and borrowers expect loan updates where they already are. Opt-in WhatsApp messages see read rates of roughly 68% (WhatsApp benchmark data), a level email rarely approaches. For a licensed money lender, the question is not whether WhatsApp is allowed. It is how to run it so that every message stands up to a compliance review.
Two frameworks shape the answer. The first is the Money Lenders Ordinance (Cap. 163), the licensing statute for non-bank lenders. Unlike banks, which are supervised by the HKMA, licensed money lenders answer to the Registrar of Money Lenders — a role performed by the Registrar of Companies — under licence conditions that reach directly into advertising and customer contact. The second is the Personal Data (Privacy) Ordinance (Cap. 486), overseen by the PCPD, which governs how you use a borrower's personal data — including their phone number — and sets prescriptive rules for direct marketing.
Neither ordinance mentions WhatsApp by name. Both apply to it in full. Here is the short version:
The Money Lenders Ordinance is a licensing regime. Licences are granted by the Licensing Court, the register and licence conditions are administered by the Registrar of Money Lenders, and enforcement sits with the Hong Kong Police Force. What makes it relevant to a messaging stack is that the standard licensing conditions attached to every licence regulate customer-facing conduct directly.
Advertising is the clearest case. Licensing conditions require every advertisement to state the money lender's licence number and to carry the prescribed risk warning — "Warning: You have to repay your loans. Don't pay any intermediaries." A promotional WhatsApp broadcast is advertising in substance, so the safe operating rule is simple: any message that promotes a loan product carries the licence number and the warning, exactly as your print and online advertisements do.
Interest rate limits matter to messaging too. Since 30 December 2022, lending at an effective rate above 48% per annum is a criminal offence, and agreements charging between 36% and 48% are presumed extortionate and open to review by the court. Every rate quoted in a chat is a representation about a regulated number — quoted terms must match the written agreement, and the quote should live in an archive you can produce later.
Licence conditions tightened in 2021 also restrict how lenders handle third-party data such as referees. The practical translation for a messaging team: contact the borrower, and only the borrower, unless you hold clear consent from anyone else involved.
The PDPO draws a line between using personal data to deliver a service and using it to market. Most of a lender's message volume sits safely on the service side: a borrower who has applied for a loan expects updates about that loan. No direct-marketing consent is needed to tell someone their application was approved or their instalment is due.
WhatsApp adds its own layer. Under Meta's Business Messaging Policy, businesses must hold opt-in before messaging a customer, whatever the content. Outside the 24-hour customer service window that opens when a customer writes to you, messages must use pre-approved templates, categorised as utility, marketing or authentication — and priced per message since July 2025. Our Hong Kong pricing guide breaks down what that costs in practice.
| Message type | Example | WhatsApp template category | PDPO marketing consent? |
|---|---|---|---|
| Application status | "Your application #1042 has been approved" | Utilitas | Not required |
| Repayment reminder | "Your instalment of HK$3,200 is due on 15 August" | Utilitas | Not required |
| Statement or receipt | Drawdown confirmation, monthly statement | Utilitas | Not required |
| KYC or document request | "Please upload your address proof to complete review" | Utilitas | Not required |
| Pre-approved loan offer | "You are pre-approved for a HK$100,000 loan" | Pemasaran | Required, plus opt-out in every message |
| Rate promotion or campaign | Seasonal rate offer, referral campaign | Pemasaran | Required, plus licence number and risk warning |
The category is decided by substance, not by the label on the template. A "payment reminder" that closes with a top-up offer is a marketing message in both Meta's classification and the PCPD's analysis — and it drags the whole send into Part 6A territory. Keep service templates clean, and run promotions as promotions.
Part 6A of the PDPO sets out exactly what must happen before a lender uses a customer's personal data for direct marketing. You must inform the customer of the intended use, tell them what kinds of data are involved and what classes of products will be promoted, and obtain their consent — or at least an indication that they do not object. Silence is not consent, and a pre-ticked box does not count.
The obligations continue after the first send. Your first marketing message must tell the customer they can opt out at no charge; every opt-out must be honoured promptly, and the PCPD's direct marketing guidance treats continued sends after an opt-out as a contravention. The penalties have teeth: up to HK$500,000 and three years' imprisonment for marketing in breach of Part 6A, rising to HK$1,000,000 and five years where personal data is provided to a third party for gain.
Operationally, consent capture works best at application time: a standalone marketing checkbox on the application form — separate from your terms and conditions — plus an in-chat confirmation keyword for customers recruited on WhatsApp itself. Log the channel, wording and timestamp of every consent, and sync opt-outs to your broadcast segments automatically, so an excluded customer can never be re-added by hand. Run campaigns through broadcast analytics and exclusion management becomes one dashboard rather than a spreadsheet.
Repayment reminders sent before and around a due date are service messages — no marketing consent required — and they are also the highest-value automation in a lending operation, because a borrower nudged at the right moment usually pays without any collections effort. The discipline is in the sequence: each rung has a defined timing, tone and content, and each send is logged.
| Stage | Timing | Tone | What to include |
|---|---|---|---|
| Advance notice | 7 days before due date | Friendly | Amount, due date, payment link, invitation to reply |
| Due reminder | 1 day before or on the day | Neutral | Amount, deadline time, instant payment options |
| Missed payment | 1–3 days after | Direct, respectful | Overdue amount, grace period, terms already in the agreement |
| Support offer | Around 7 days after | Supportive | Restructuring options, hotline, handover to a human agent |
| Formal escalation | 14+ days after | Formal | Notice of next steps; move to registered letter and phone |
Two template patterns cover most of the ladder. Advance notice: "Hi Chan Tai-man, your instalment of HK$3,200 for loan L-2041 is due on 15 August. Pay instantly via the link below, or reply here with any questions." Missed payment: "We have not received your instalment of HK$3,200 due on 15 August. A grace period applies until 22 August under your agreement. Reply 1 to pay now, or 2 to speak with an agent."
Three conduct rules keep the ladder compliant. Message the borrower and no one else — disclosing a debt to family, employers or referees invites a complaint under the PDPO's use-limitation principle and sits badly with licence conditions on third-party data. Send inside business hours. And keep the tone factual: state amounts, dates and options, never pressure or embarrassment. Collections conduct is one of the most common sources of complaints against lenders, and message archives are how you demonstrate yours was professional.
A regulator, an auditor or a court will not ask whether your WhatsApp replies were fast. They will ask who sent a message, under what authority, with what consent on file, and whether the record is complete. That translates into six capabilities: a consent registry with timestamps; a complete conversation archive; version history for every approved template; role-based access so agents see only their queues; automated opt-out handling; and a retention policy that matches your legal exposure rather than your storage budget.
This is the layer imBee is built for. imBee unifies WhatsApp and other channels in one governed workspace designed for institutions answering to the Registrar of Money Lenders and the PCPD: role-based permissions, full audit logs, template approval workflows, automated opt-out synchronisation across broadcasts, and imBee AI drafting replies within your approved guidelines rather than improvising. imBee is an Official Meta Technology Partner serving 10,000+ enterprises across 60+ industries, certified to ISO/IEC 27001. The same governance stack runs regulated messaging for banks across APAC and financial services teams in Hong Kong and Singapore.
If WhatsApp is where your borrowers already are, the fastest way to see this working against your own loan journey is a short walkthrough. Book a demo and bring your compliance lead — the second half of the conversation is usually theirs.
The Money Lenders Ordinance (Cap. 163) is Hong Kong's licensing statute for non-bank lenders. Licences are granted by the Licensing Court, administered by the Registrar of Money Lenders at the Companies Registry, and enforced by the Police. It caps effective interest at 48% per annum and attaches conduct and advertising conditions to every licence.
Yes, provided the message follows both regimes: PDPO Part 6A consent before any direct marketing, an opt-out honoured in every message, and the advertising licence conditions — your licence number plus the prescribed warning, "Warning: You have to repay your loans. Don't pay any intermediaries." Without consent on file, promotional sends should not go out.
Since 30 December 2022, the statutory cap is an effective rate of 48% per annum — lending above it is a criminal offence. Agreements charging between 36% and 48% are presumed extortionate and reviewable by the court. Any rate quoted in a WhatsApp conversation should match the written agreement exactly.
No. Reminders about an existing loan are service messages, not direct marketing, so PDPO Part 6A consent is not needed. You still need WhatsApp opt-in under Meta's policy, and the reminder must stay clean — adding a top-up offer or promotion converts it into marketing and triggers the consent requirement.
The free WhatsApp Business App suits sole traders: one number, a handful of devices, no audit trail. The WhatsApp Business API — also called the WhatsApp Business Platform — supports teams, approved templates, role-based access and complete archives, the governance a licensed lender needs. See our comparison of the two.
No — this is one of the fastest routes to a PDPO complaint. Disclosing a debt to third parties breaches the use-limitation principle, and licence conditions restrict how referee data is used at all. Collections messages go to the borrower only; escalation beyond that belongs in formal legal channels.
Keep the consent registry — who agreed to what, when, through which channel — every opt-out, the full message history including deliveries and reads, template versions with approval dates, and staff access logs. Retain them per your legal advice on limitation periods; archives are your primary evidence that conduct was proper.
Yes. imBee, an Official Meta Technology Partner serving 10,000+ enterprises across 60+ industries, runs governed WhatsApp messaging for institutions answering to the Registrar of Money Lenders and the PCPD — consent-aware broadcasts, audit logs, template approvals and imBee AI drafting within your guidelines. Book a demo.
Mulai uji coba gratis 30 hari Anda hari ini. Tingkatkan produktivitas tim Anda lebih dari 30% dan bawa bisnis Anda ke tingkat kesuksesan yang lebih tinggi.
