HKIB ECF-AML/CFT Core cheat sheet

Three-stage model: placement (cash into the financial system), layering (obscuring audit trail via transfers, conversions, corporate vehicles), integration (re-entry as apparently legitimate funds). Stages may overlap or occur simultaneously.

Money laundering statutory predicate offences in Hong Kong derive from the Organized and Serious Crimes Ordinance (OSCO, Cap. 455); terrorist financing from the United Nations (Anti-Terrorism Measures) Ordinance (Cap. 575) and the Anti-Terrorism and Proliferation Financing of Weapons of Mass Destruction Ordinance (Cap. 615).

Drug trafficking proceeds are handled under the Drug Trafficking (Recovery of Proceeds) Ordinance (DTROP, Cap. 405). All three ordinances create tipping-off and disclosure obligations alongside the substantive offences.

Suspicious transaction reporting in Hong Kong goes to the Joint Financial Intelligence Unit (JFIU), jointly operated by the Hong Kong Police Force and the Customs and Excise Department; the report is a Suspicious Transaction Report (STR).

Defence against money laundering (DAML) and defence against terrorist financing (DATF) consents: a financial institution that has made a disclosure may continue an activity only if it obtains appropriate consent, or the statutory moratorium period (12 working days for OSCO/DTROP, 5 working days for terrorist-financing legislation) expires without refusal.

Tipping-off: it is an offence to disclose to the subject, or to any third party, that a disclosure has been made or that an investigation is being conducted, where that disclosure is likely to prejudice an investigation. Internal reporting within the institution's designated channels is permitted.

Risk-based approach: customer risk, product/service risk, delivery channel risk, and geographic risk combine into an overall risk rating that drives the intensity of CDD, ongoing monitoring, and frequency of review.

FATF Recommendations form the international baseline; the Hong Kong Monetary Authority, Securities and Futures Commission, and Insurance Authority issue sector-specific AML/CFT guidelines (e.g., the HKMA's Guideline on Anti-Money Laundering and Counter-Financing of Terrorism).

Record-keeping: customer due diligence records and transaction records must generally be retained for at least five years after the end of the business relationship or after the transaction, whichever is later, and must be capable of retrieval without undue delay.

CDD measures: identify the customer and verify identity using reliable, independent source documents; identify the beneficial owner and take reasonable measures to verify; establish purpose and intended nature of the relationship; conduct ongoing due diligence.

Beneficial owner (legal persons): generally a natural person owning or controlling more than 25% of shares or voting rights, or exercising control by other means; if no such person is identified, the identity of the senior managing official is recorded.

Beneficial owner (trusts): the settlor, the trustee, the protector (if any), the beneficiaries or class of beneficiaries, and any natural person exercising ultimate effective control.

Politically exposed person (PEP): an individual entrusted with prominent public functions, plus family members and close associates. Foreign PEPs require senior management approval, source-of-wealth and source-of-funds checks, and enhanced ongoing monitoring.

Enhanced due diligence (EDD) triggers include high-risk jurisdictions, complex or unusually large transactions with no apparent economic purpose, correspondent relationships with respondent institutions in non-compliant jurisdictions, and PEPs.

Simplified due diligence may only be applied where the institution has determined the risk is genuinely low, based on risk assessment; it never removes the need to identify and verify the customer and beneficial owner.

Reliance on third parties for CDD is permitted only where the third party is regulated and supervised for AML/CFT, and the financial institution remains ultimately responsible for the CDD outcome; the information must be obtained immediately.

Ongoing monitoring: transaction monitoring systems, periodic CDD review triggered by risk rating, and scrutiny of transactions against the customer's known profile, business, and risk level.

Shell banks: institutions must not enter into, or continue, correspondent banking relationships with shell banks (institutions with no physical presence in any country).

STR quality: a good report states who (subject details), what (activity and amounts), when (dates), where (accounts, branches, channels), and why the activity is suspicious, with supporting documents referenced.

No de minimis threshold: any knowledge or suspicion of money laundering or terrorist financing must be reported, regardless of the amount involved. Suspicion is subjective but must be reasonable.

Internal reporting: staff report to the institution's Money Laundering Reporting Officer (MLRO) or nominated officer; the MLRO decides whether to file with the JFIU. Failure to report internally can itself be an offence.

Sanctions screening: screening against UN Security Council sanctions lists (implemented in Hong Kong via Cap. 575 and Cap. 615), plus other applicable lists; hits must be investigated and, where a true match, frozen and reported to the relevant authority.

Targeted financial sanctions require freezing without delay and without prior notice; institutions must not deal with funds of designated persons and must report matches.

Senior management responsibility: the board and senior management approve the AML/CFT policy, appoint a compliance officer/MLRO, ensure adequate resources for compliance, and receive regular management information on AML/CFT risk.

Independent audit/testing: an independent function must test the AML/CFT programme, including CDD files, transaction monitoring alerts, STR decisions, and sanctions screening effectiveness.

Staff training: employees must be trained on AML/CFT laws, internal policies, typologies, and their personal reporting obligations, with training refreshed at appropriate intervals and records kept.

Cross-border and wire transfer rules: the originator and beneficiary information must accompany wire transfers; incomplete information may lead to the transfer being treated as suspicious and reported.

Structuring/smurfing: multiple cash deposits or withdrawals just below reporting thresholds, or split across branches, accounts, or days to avoid scrutiny.

Trade-based laundering: over- or under-invoicing, misdescription of goods, multiple invoicing, or shipments to/from high-risk jurisdictions inconsistent with the customer's business.

Shell company and nominee arrangements: complex ownership structures, offshore entities in secrecy jurisdictions, and use of nominees with no clear economic rationale.

Unusual account activity: dormant accounts suddenly active, rapid movement of funds (in and out within a short period), round-sum transfers, and transactions inconsistent with the customer's stated occupation or business.

Third-party funding: accounts funded by unrelated third parties, or customers reluctant to provide information about the source of funds or wealth.

Cash-intensive businesses: restaurants, retail, car washes, and similar businesses whose declared turnover is inconsistent with observed activity; commingling of business and personal funds.

Terrorist financing indicators: small, frequent donations; funds sent to conflict zones; use of charities or non-profit organisations with opaque governance; fundraising with no identifiable legitimate purpose.

Proliferation financing: transactions involving dual-use goods, entities in sanctioned jurisdictions, or complex routing through intermediaries to obscure the end user.