HKIB ECF-AML/CFT Core common mistakes
HKIB ECF-AML/CFT Core · Understand the traps and how to avoid them.
Treating the three-tier regime (legislation, rules/guidelines, guidance) as one undifferentiated blob, so on scenario questions the candidate cites the HKMA Guideline as if it were a statutory obligation rather than supervisory expectation.
Candidates memorise names of instruments (AMLO, CFT Ordinance, Drug Trafficking Ordinance, OSCO, UNATMO, Weapons of Mass Destruction Ordinance) without mapping each to its legal status and consequence of breach. Exam items often test which instrument creates the criminal offence versus which sets supervisory expectation.
What to do instead
Build a one-page matrix with columns: instrument, legal status (primary legislation / subsidiary / guideline / circular), who it binds, and what happens on non-compliance. For each scenario in practice, force yourself to name the correct tier before choosing the answer, and note that breaching a statutory requirement can be a criminal offence while failing a guideline expectation attracts supervisory action.
Confusing money laundering with terrorist financing when the same fact pattern is presented, especially where the funds are small, domestically raised, or have a seemingly legitimate origin, and then applying the wrong risk indicators.
Candidates learn both under one syllabus heading and assume the controls are identical. In reality TF can involve small sums, lawful-source funds, and no predicate offence, so indicators like structuring or large cash deposits may be absent, and candidates default to ML typologies.
What to do instead
Learn the contrast explicitly: ML requires proceeds of a predicate offence and typically concerns concealing source; TF requires funds or property for terrorist purposes regardless of source and can be small and lawful in origin. Practise classifying short fact patterns into ML, TF, or both, and identify which control (CDD, sanctions screening, STR) is most directly engaged.
Reciting the STR obligation as 'report suspicious transactions to the JFIU' without stating the correct trigger, the identity of the reporting officer, the tipping-off prohibition, and the internal escalation step that precedes external reporting.
Candidates compress the reporting chain into one sentence and lose marks on process-ordering items. They also mix up the role of the institution's nominated officer (MLRO) with the JFIU, and forget that tipping-off is a separate criminal offence under the AMLO.
What to do instead
Write out the full chain as a numbered sequence: staff identifies suspicion, internal escalation to the MLRO/nominated officer, MLRO decides, suspicious transaction report filed with the JFIU, no disclosure to the customer, records retained. Separately memorise the tipping-off prohibition and the statutory protection for good-faith reporting, and practise questions that ask what happens at each step.
Applying customer due diligence as a single checklist item, failing to distinguish when simplified due diligence is permissible from when enhanced due diligence is mandatory, and misidentifying who counts as a politically exposed person.
Candidates learn CDD components (identification, verification, beneficial ownership, purpose and intended nature, ongoing monitoring) but not the decision rules that select the CDD tier. PEP definitions are also confused with domestic prominent persons and with family members and close associates.
What to do instead
Create a decision table: standard CDD triggers, situations where simplified measures may apply (and the requirement that the risk be demonstrably low and the institution still identify and verify), and mandatory EDD triggers including foreign PEPs, high-risk jurisdictions, and correspondent relationships. For PEPs, learn that the category covers family members and close associates, and that source-of-wealth and senior-management approval are required.
Treating beneficial ownership as 'who owns more than a set percentage' only, and missing control-based ownership, layered corporate structures, and the fallback to senior managing official when no beneficial owner can be identified.
Candidates latch onto a single threshold figure and ignore the control test and the trust/partnership variations. Complex ownership chains in exam scenarios are then resolved by picking the first named individual rather than tracing through the structure.
What to do instead
Learn the two limbs of beneficial ownership: ownership threshold and control by other means. Practise tracing a three-layer structure to the ultimate beneficial owner, and memorise the escalation path when identification fails: exhaust reasonable means, then identify the senior managing official and record the reasons. Note the different treatment for trusts, partnerships, and legal arrangements.
Handling sanctions screening as if it were the same control as PEP screening or adverse-media screening, so the candidate recommends ongoing monitoring where immediate freezing and reporting to the relevant authority are required.
All three are 'screening' activities and are often taught together. The distinguishing feature of sanctions is that they are legal prohibitions with immediate effect, not risk-management judgements, and the response is not a risk rating but a freeze and notification.
What to do instead
Separate the three controls in your notes: sanctions screening (strict, no de minimis, freeze and report to the authority), PEP screening (risk-based, EDD and senior approval), adverse media (risk-based, informs CDD and monitoring). Practise questions where a confirmed match occurs and check you select freezing and reporting rather than enhanced monitoring alone.
Describing a risk-based approach as 'assess the customer once at onboarding', omitting ongoing monitoring, periodic review triggers, and the feedback loop from monitoring into the risk assessment.
Risk-based approach is taught as a concept rather than as a cycle, so candidates produce a static description. Exam items frequently ask what happens when a trigger event occurs, such as a change in ownership, unusual activity, or a new high-risk country nexus.
What to do instead
Draw the cycle: institutional risk assessment, customer risk rating, CDD proportionate to risk, ongoing monitoring calibrated to the rating, trigger-event review, and refresh of the rating. Learn the common trigger events and what action each requires, and be ready to explain how transaction monitoring alerts feed back into the customer risk rating.
Answering record-keeping questions with a vague 'keep records for a reasonable period' instead of the specific statutory retention period and the separate rules for CDD records versus transaction records and for records connected to a report.
Candidates remember that retention exists but not the duration or the distinction between record types, and they conflate the retention clock with the end of the relationship rather than the completion of the transaction or the report.
What to do instead
Memorise the retention rules as a small table: CDD records, transaction records, and records relating to suspicious transaction reports, each with its retention period and the event that starts the clock. Note the requirement to retain records for a period after the end of the business relationship and the expectation that records be retrievable promptly for supervisors and law enforcement.
Ignoring the institutional dimension: answering only at the level of the individual customer and omitting the governance obligations such as the appointment of a responsible officer, staff training, independent audit or compliance review, and the institution-wide risk assessment.
Candidates focus on customer-facing controls because those dominate study material, and underestimate how often exam items test the four pillars of an AML programme and the accountability of senior management.
What to do instead
Memorise the programme pillars: senior management responsibility and culture, policies and procedures including the MLRO function, staff training and awareness, and independent testing or audit. For each, be able to state one concrete artefact a supervisor would expect to see, such as a board-approved policy, a training log, or an audit report with tracked remediation.
Treating correspondent banking, wire transfers, and new product or technology risk as generic 'high risk' and failing to state the specific controls each requires, such as the prohibition on shell banks, the payer and payee information requirements, or the pre-launch risk assessment.
These are specialised topics that appear in a minority of study hours but are disproportionately tested, and candidates generalise from the core CDD material rather than learning the topic-specific rules.
What to do instead
Prepare a short topic sheet for each specialised area. For correspondent banking: prohibition on relationships with shell banks, EDD on the respondent institution, and understanding of its AML programme. For wire transfers: the information that must accompany a transfer and the treatment of incomplete information. For new products and technologies: risk assessment before launch and ongoing review. Test yourself with scenario items that name the product rather than the customer.