HKIB ECF-Compliance Core cheat sheet

ECF = Enhanced Competency Framework: a HKMA-led, industry-agreed benchmark of core competencies for specified banking functions; Compliance is one of the ECF streams, with a Core level (for staff new to the function) and a Professional level (for more experienced practitioners).

The ECF Compliance Core curriculum is organised around four competency areas: (1) regulatory and legal environment, (2) compliance risk management, (3) compliance programme and controls, and (4) ethical conduct and professional behaviour.

Regulatory architecture of Hong Kong banking: the HKMA supervises authorized institutions (AIs) under the Banking Ordinance (Cap. 155); the Securities and Futures Commission regulates securities and futures activities under the SFO (Cap. 571); the Insurance Authority regulates insurance under the Insurance Ordinance (Cap. 41); the MPFA administers retirement schemes.

Core HKMA supervisory guidance to know: the Supervisory Policy Manual (SPM) modules, the guideline on Supervisory Policy Manual CG-1 (corporate governance), and the HKMA's three-tier approach to money laundering/terrorist financing supervision (guidance, supervision, enforcement).

AML/CFT legal basis: Drug Trafficking (Recovery of Proceeds) Ordinance (Cap. 405), Organised and Serious Crimes Ordinance (Cap. 455), United Nations (Anti-Terrorism Measures) Ordinance (Cap. 575), and the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) which introduced the licensing regime for money service operators and DNFBPs.

Risk-based approach: customer due diligence intensity should be proportionate to assessed ML/TF risk; simplified due diligence is permitted only where lower risk is documented, and enhanced due diligence is mandatory for politically exposed persons (PEPs), correspondent relationships and higher-risk jurisdictions.

Three lines of defence model: first line (business units) owns risk; second line (Compliance, Risk) sets frameworks and monitors; third line (Internal Audit) provides independent assurance to the board/audit committee.

Personal accountability: the Manager-In-Charge (MIC) regime requires AIs to designate managers responsible for core functions (including compliance and AML/CFT) and notify the HKMA; the individual is accountable for the effective operation of that function.

Compliance risk definition: the risk of legal or regulatory sanctions, financial loss, or loss to reputation an AI may suffer as a result of failure to comply with laws, regulations, codes of conduct and standards of good practice.

Compliance function core duties: advise the board and senior management on compliance risk; identify, assess and monitor compliance risk; provide compliance training; act as liaison with regulators; prepare and report compliance metrics to governance committees.

Independence requirements: the compliance function should be independent of business lines, have direct reporting lines to the board or a board committee, and its head should have sufficient authority, resources and access to information.

Regulatory reporting obligations: AIs must report breaches and incidents to the HKMA in a timely manner, submit statutory returns on schedule, and disclose material information; late or inaccurate returns are themselves reportable compliance failures.

Conflict of interest management: identify and manage conflicts at the entity, business-unit and individual level; segregation of duties, information barriers (Chinese walls) and personal account dealing rules are standard controls.

Market conduct and investor protection: the SFO and its subsidiary legislation govern conduct of securities business; the HKMA's conduct supervision covers fair treatment of customers, product suitability, disclosure and complaint handling.

Outsourcing and third-party risk: AIs remain responsible for outsourced activities; due diligence, contractual rights (audit, access, termination), ongoing monitoring and contingency planning are required before and after outsourcing.

Regulatory change management: a documented process to track new and amended rules, assess impact on policies, systems and controls, assign owners, and evidence implementation and training completion.

Record keeping and evidence: compliance decisions, advice, approvals and escalations should be documented and retained per legal and regulatory retention requirements so that the AI can demonstrate compliance to the regulator.

Conduct risk vs compliance risk: compliance risk is breach of laws/regulations; conduct risk is the risk that business behaviour produces unfair customer outcomes or damages market integrity, even where no rule is broken.

Complaint handling: AIs should have a documented complaints process with acknowledgement, investigation, response timelines, root-cause analysis and escalation of systemic issues to senior management and the board.

Whistleblowing: an effective internal whistleblowing channel allows staff to raise concerns confidentially and without retaliation; the HKMA expects AIs to have a policy protecting whistleblowers.

Sanctions screening: screening against designated lists (e.g. UN, HKMA, OFAC, EU) at onboarding and on an ongoing basis, with alert investigation, escalation, and reporting of suspicious matches; false positives require documented disposition.

Suspicious transaction reporting: under the OSCO and DTROP, a person who knows or suspects that property is criminal proceeds must disclose to the Joint Financial Intelligence Unit (JFIU); tipping-off the customer is a criminal offence.

Correspondent banking due diligence: assess the respondent's AML/CFT controls, ownership, reputation and the jurisdiction's risk; document the relationship and obtain senior management approval for new relationships.

FATF 40 Recommendations: the international standard for AML/CFT; HK's regime is assessed against them, and the risk-based approach, CDD, record keeping, STRs and beneficial ownership are core elements.

Data privacy: the Personal Data (Data Protection) Ordinance (Cap. 486) governs collection, accuracy, retention, use and security of personal data; six data protection principles apply to customer data used in compliance monitoring.

Governance structure: board sets risk appetite and compliance tone; a board-level committee (e.g. audit or risk committee) oversees compliance; the compliance head reports to the board and has access to the CEO.

Risk appetite and tolerance: the board approves a compliance risk appetite statement with measurable tolerances; breaches of tolerance trigger escalation and remediation plans.

Compliance risk assessment: periodic assessment of inherent risk (products, customers, channels, geography) against control effectiveness to derive residual risk and prioritise monitoring.

Monitoring and testing: compliance performs risk-based monitoring (thematic reviews, surveillance, sample testing) and tracks issues to closure; results feed management information and the risk assessment.

Training and competence: role-based compliance training, induction for new staff, annual refresher, and evidence of completion; ECF Core level is typically the benchmark for staff entering the compliance function.

Regulatory relationships: a single point of contact for the regulator, coordinated responses to information requests, and a documented process for regulatory examinations and follow-up on findings.

Policy lifecycle: policies are drafted, approved by the appropriate committee, communicated, implemented, reviewed at least annually or on regulatory change, and version-controlled.

Remediation management: issues are logged with owner, action, due date and evidence of completion; overdue actions escalate to senior management and the board committee.

Ethics and integrity: the ECF Core syllabus includes professional ethics, conflicts, confidentiality and the expectation that compliance staff act with integrity and independence even under commercial pressure.

HKMA Supervisory Policy Manual (SPM) is the primary source of supervisory expectations; relevant modules include CG-1 (corporate governance), CG-2 (culture), CG-3 (risk management framework), and the AML/CFT guideline.

Banking Ordinance (Cap. 155) gives the HKMA powers to require information, issue guidelines, and take disciplinary action; AIs must comply with its provisions and the HKMA's codes and guidelines.

Securities and Futures Ordinance (Cap. 571) regulates dealing, advising and asset management; an AI conducting regulated activities needs SFC registration or an exemption, and must comply with the SFC Code of Conduct.

Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) sets statutory CDD and record-keeping requirements for financial institutions and creates the licensing regime for money service operators and DNFBPs.

Personal Data (Privacy) Ordinance (Cap. 486) six data protection principles: lawful and fair collection; accuracy; retention; security; openness; and data subject access/correction rights.

Code of Banking Practice: non-statutory but enforceable in practice; covers fairness, transparency, fees and charges disclosure, and complaint handling; the HKMA monitors adherence.

Competition Ordinance (Cap. 619): prohibits anti-competitive agreements and abuse of market power; AIs must avoid information exchange and conduct that restricts competition.

Employment and anti-discrimination law: Employment Ordinance, Disability Discrimination Ordinance, Sex Discrimination Ordinance, Family Status Discrimination Ordinance and Race Discrimination Ordinance apply to compliance staff management and customer treatment.

Three lines of defence: line 1 owns and manages risk; line 2 (Compliance/Risk) provides oversight, frameworks and challenge; line 3 (Internal Audit) provides independent assurance; the board and its committees sit above all three.

Compliance function independence: no business-line reporting line, no revenue targets, direct access to the board, and the compliance head's appointment/removal is approved by the board.

Risk-based approach: allocate resources where inherent risk is highest; document the rationale; review the assessment when products, customers or regulations change.

CDD minimum requirements: identify and verify the customer, identify the beneficial owner, understand the purpose and intended nature of the relationship, and conduct ongoing monitoring.

Enhanced due diligence triggers: PEPs, higher-risk jurisdictions, complex or unusual ownership structures, correspondent relationships, and products that favour anonymity.

Suspicious transaction reporting: report to the JFIU promptly; do not tip off the customer; the MLRO/AML function decides whether to file, and the AI must not disclose the filing.

Record retention: CDD and transaction records must be kept for at least five years after the end of the business relationship or the completion of the transaction, as required under Cap. 615.

Regulatory breach escalation: escalate to the compliance head and senior management, assess whether the HKMA must be notified, and document the assessment and remediation.

Conduct of business: fair treatment of customers, suitability of advice, clear disclosure of fees and risks, and handling of complaints are core conduct expectations supervised by the HKMA and SFC.

Market abuse: insider dealing, market manipulation and false trading are criminal offences under the SFO; AIs must have surveillance and escalation controls.

Conflicts of interest: identify, disclose and manage; segregation of duties, information barriers and personal account dealing policies are typical controls.

Outsourcing: AIs remain accountable; require due diligence, contractual audit/access rights, ongoing monitoring, and a contingency plan for critical outsourced functions.

Third-party and vendor risk: assess financial stability, security, concentration and subcontracting; monitor performance and exit strategy.

Regulatory change: track new rules, assess impact, update policies and systems, train staff, and evidence implementation through a change log and testing.

Compliance monitoring plan: risk-based, covers key regulations and business lines, with defined scope, frequency, sampling and reporting to governance.

Training and competence: role-based, documented, refreshed annually, and tracked; ECF Core level is the benchmark for new compliance staff.

Whistleblowing and speak-up: confidential reporting channels, protection from retaliation, and escalation of concerns to the board or its committee.

HKMA supervisory approach: risk-based supervision combining off-site analysis of returns, on-site examinations, thematic reviews and ongoing dialogue with senior management.

Regulatory reporting: statutory returns must be accurate and timely; errors and late submissions should be reported and remediated.

Enforcement tools: the HKMA can issue warnings, require remediation, impose conditions, and take disciplinary action; the SFC can impose fines, suspend or revoke licences.

Manager-In-Charge (MIC) regime: AIs designate managers responsible for core functions and notify the HKMA; MICs are accountable for the effective operation of their function.

Culture and conduct: the HKMA expects a sound culture with tone from the top, accountability, and incentives aligned to good conduct rather than short-term revenue.

Complaint handling: acknowledge, investigate, respond within stated timelines, analyse root causes, and escalate systemic issues to senior management and the board.

Sanctions and screening: screen against applicable lists at onboarding and on an ongoing basis; investigate and document alerts; report matches as required.

Data privacy: comply with the PDPO's six principles; ensure customer data used in compliance monitoring is collected for a lawful purpose and secured.

Business continuity: compliance processes (e.g. screening, reporting) should be covered by business continuity plans and tested periodically.

Compliance head role: leads the compliance function, advises the board and senior management, oversees the compliance programme, and reports compliance risk to governance.

Compliance committee: cross-functional forum that reviews compliance risk, monitoring results, regulatory developments and remediation progress.

Risk assessment: assess inherent risk by product, customer, channel and geography; rate control effectiveness; derive residual risk and prioritise monitoring.

Monitoring and testing: risk-based thematic reviews, surveillance and sample testing; findings tracked to closure and reported to governance.

Regulatory change management: documented process to identify, assess, implement and evidence new requirements, with owners and deadlines.

Policy and procedure management: approved by the appropriate committee, communicated, reviewed at least annually or on change, and version-controlled.

Training and competence: role-based induction and annual refresher, with completion evidence; ECF Core level is the benchmark for new compliance staff.

Remediation: issues logged with owner, action, due date and evidence; overdue actions escalate to senior management and the board committee.

Ethics: compliance staff must act with integrity, independence and confidentiality, and escalate concerns even under commercial pressure.

AML/CFT legal basis: DTROP (Cap. 405), OSCO (Cap. 455), UNATMO (Cap. 575) and AMLO (Cap. 615); the JFIU receives suspicious transaction reports.

CDD: identify and verify the customer, identify the beneficial owner, understand purpose and intended nature, and conduct ongoing monitoring.

EDD triggers: PEPs, higher-risk jurisdictions, complex ownership, correspondent relationships, and anonymity-favouring products.

Record retention: at least five years after the end of the relationship or completion of the transaction under Cap. 615.

Sanctions screening: screen at onboarding and on an ongoing basis against applicable lists; investigate and document alerts; report matches as required.

Tipping-off: disclosing an STR or related information to the customer is a criminal offence under OSCO/DTROP.

Correspondent banking: assess the respondent's AML/CFT controls, ownership, reputation and jurisdiction risk; obtain senior management approval for new relationships.

FATF 40 Recommendations: international AML/CFT standard; HK's regime is assessed against it, and the risk-based approach, CDD, record keeping, STRs and beneficial ownership are core elements.

PEP definition: an individual entrusted with prominent public functions, their family members and close associates; EDD and senior management approval are required.

Conduct risk: the risk that business behaviour produces unfair customer outcomes or harms market integrity, even where no rule is broken.

Market abuse: insider dealing, market manipulation and false trading are criminal offences under the SFO; AIs need surveillance and escalation controls.

Conflicts of interest: identify, disclose and manage; segregation of duties, information barriers and personal account dealing policies are typical controls.

Complaint handling: acknowledge, investigate, respond within stated timelines, analyse root causes, and escalate systemic issues to senior management and the board.

Whistleblowing: confidential channels, protection from retaliation, and escalation to the board or its committee.

Outsourcing: AIs remain accountable; require due diligence, contractual audit/access rights, ongoing monitoring and a contingency plan for critical functions.

Third-party risk: assess financial stability, security, concentration and subcontracting; monitor performance and exit strategy.

Personal Data (Privacy) Ordinance: six data protection principles govern collection, accuracy, retention, security, openness and access/correction rights.

Code of Banking Practice: non-statutory but enforced in practice; covers fairness, transparency, fee disclosure and complaint handling.

Governance: the board sets risk appetite and tone; a board committee oversees compliance; the compliance head reports to the board and has access to the CEO.

Independence: no business-line reporting line, no revenue targets, direct board access, and board approval for the compliance head's appointment or removal.

Three lines of defence: line 1 owns risk; line 2 provides oversight and challenge; line 3 provides independent assurance.

Risk appetite: the board approves a compliance risk appetite statement with measurable tolerances; breaches trigger escalation and remediation.

Compliance risk assessment: assess inherent risk against control effectiveness to derive residual risk and prioritise monitoring.

Monitoring and testing: risk-based thematic reviews, surveillance and sample testing; findings tracked to closure and reported to governance.

Regulatory relationships: single point of contact, coordinated responses to information requests, and documented follow-up on examination findings.

Remediation: issues logged with owner, action, due date and evidence; overdue actions escalate to senior management and the board committee.

Ethics: compliance staff act with integrity, independence and confidentiality, and escalate concerns even under commercial pressure.

HKMA SPM: primary source of supervisory expectations; relevant modules include CG-1 (corporate governance), CG-2 (culture), CG-3 (risk management framework) and the AML/CFT guideline.

Banking Ordinance (Cap. 155): gives the HKMA powers to require information, issue guidelines and take disciplinary action.

SFO (Cap. 571): regulates dealing, advising and asset management; an AI conducting regulated activities needs SFC registration or an exemption and must follow the SFC Code of Conduct.

AMLO (Cap. 615): statutory CDD and record-keeping requirements; creates the licensing regime for money service operators and DNFBPs.

PDPO (Cap. 486): six data protection principles on collection, accuracy, retention, security, openness and access/correction rights.

Code of Banking Practice: non-statutory but enforced in practice; covers fairness, transparency, fee disclosure and complaint handling.

Competition Ordinance (Cap. 619): prohibits anti-competitive agreements and abuse of market power; AIs must avoid information exchange that restricts competition.

Employment and anti-discrimination law: Employment Ordinance and the four discrimination ordinances apply to staff management and customer treatment.

Regulatory breach escalation: escalate to the compliance head and senior management, assess whether the HKMA must be notified, and document the assessment and remediation.

MIC regime: AIs designate managers responsible for core functions (including compliance and AML/CFT) and notify the HKMA; MICs are accountable for the effective operation of their function.

Culture: the HKMA expects tone from the top, accountability, and incentives aligned to good conduct rather than short-term revenue.

Enforcement: the HKMA can issue warnings, require remediation, impose conditions and take disciplinary action; the SFC can fine, suspend or revoke licences.

Regulatory reporting: statutory returns must be accurate and timely; errors and late submissions should be reported and remediated.

Complaint handling: acknowledge, investigate, respond within stated timelines, analyse root causes, and escalate systemic issues.

Sanctions screening: screen at onboarding and on an ongoing basis; investigate and document alerts; report matches as required.

Data privacy: comply with the PDPO's six principles; ensure customer data used in monitoring is collected for a lawful purpose and secured.

Business continuity: compliance processes (screening, reporting) should be covered by business continuity plans and tested periodically.

Training and competence: role-based, documented and refreshed annually; ECF Core level is the benchmark for new compliance staff.

Compliance risk definition: the risk of legal or regulatory sanctions, financial loss or reputational loss from failure to comply with laws, regulations, codes of conduct and standards of good practice.

Compliance function duties: advise the board and senior management, identify and monitor compliance risk, provide training, liaise with regulators, and report compliance metrics to governance.

Independence: the function should be independent of business lines, report to the board or a board committee, and have sufficient authority, resources and information access.

Regulatory reporting: report breaches and incidents to the HKMA in a timely manner, submit statutory returns on schedule, and disclose material information; late or inaccurate returns are themselves compliance failures.

Conflicts of interest: identify and manage at entity, business-unit and individual level; segregation of duties, information barriers and personal account dealing rules are standard controls.

Market conduct: the SFO and subsidiary legislation govern securities conduct; HKMA conduct supervision covers fair treatment, suitability, disclosure and complaint handling.

Outsourcing: AIs remain responsible for outsourced activities; due diligence, contractual audit/access/termination rights, ongoing monitoring and contingency planning are required.

Regulatory change: a documented process to track new rules, assess impact, assign owners, update policies and systems, train staff, and evidence implementation.

Record keeping: compliance decisions, advice, approvals and escalations should be documented and retained per legal and regulatory retention requirements.

ECF structure: HKMA-led, industry-agreed competency benchmark; Compliance is one stream with Core and Professional levels.

Core curriculum areas: regulatory and legal environment, compliance risk management, compliance programme and controls, and ethical conduct and professional behaviour.

Regulatory architecture: HKMA supervises AIs under the Banking Ordinance; SFC regulates securities and futures under the SFO; IA regulates insurance; MPFA administers retirement schemes.

HKMA supervisory guidance: the SPM modules, CG-1 corporate governance, and the three-tier AML/CFT approach (guidance, supervision, enforcement).

AML/CFT legal basis: DTROP (Cap. 405), OSCO (Cap. 455), UNATMO (Cap. 575) and AMLO (Cap. 615).

Risk-based approach: CDD intensity proportionate to assessed ML/TF risk; simplified due diligence only where lower risk is documented; EDD mandatory for PEPs, correspondent relationships and higher-risk jurisdictions.

Three lines of defence: line 1 owns risk; line 2 sets frameworks and monitors; line 3 provides independent assurance to the board/audit committee.

MIC regime: AIs designate managers responsible for core functions (including compliance and AML/CFT) and notify the HKMA; the individual is accountable for the function.

Personal accountability: compliance staff must act with integrity, independence and confidentiality, and escalate concerns even under commercial pressure.

Risk-based approach: allocate resources where inherent risk is highest; document the rationale; review the assessment when products, customers or regulations change.

CDD minimum requirements: identify and verify the customer, identify the beneficial owner, understand the purpose and intended nature of the relationship, and conduct ongoing monitoring.

EDD triggers: PEPs, higher-risk jurisdictions, complex or unusual ownership structures, correspondent relationships, and products that favour anonymity.

Suspicious transaction reporting: report to the JFIU promptly; do not tip off the customer; the MLRO/AML function decides whether to file and the AI must not disclose the filing.

Record retention: CDD and transaction records must be kept at least five years after the end of the business relationship or completion of the transaction under Cap. 615.

Sanctions screening: screen against applicable lists at onboarding and on an ongoing basis; investigate and document alerts; report matches as required.

Correspondent banking: assess the respondent's AML/CFT controls, ownership, reputation and jurisdiction risk; obtain senior management approval for new relationships.

FATF 40 Recommendations: the international AML/CFT standard; HK's regime is assessed against it, and the risk-based approach, CDD, record keeping, STRs and beneficial ownership are core elements.

PEP definition: an individual entrusted with prominent public functions, their family members and close associates; EDD and senior management approval are required.

Conduct risk vs compliance risk: compliance risk is breach of laws/regulations; conduct risk is the risk that business behaviour produces unfair customer outcomes or harms market integrity, even where no rule is broken.

Market abuse: insider dealing, market manipulation and false trading are criminal offences under the SFO; AIs need surveillance and escalation controls.

Conflicts of interest: identify, disclose and manage; segregation of duties, information barriers and personal account dealing policies are typical controls.

Complaint handling: acknowledge, investigate, respond within stated timelines, analyse root causes, and escalate systemic issues to senior management and the board.

Whistleblowing: confidential channels, protection from retaliation, and escalation to the board or its committee.

Outsourcing: AIs remain accountable; require due diligence, contractual audit/access rights, ongoing monitoring and a contingency plan for critical functions.

Third-party risk: assess financial stability, security, concentration and subcontracting; monitor performance and exit strategy.

PDPO: six data protection principles govern collection, accuracy, retention, security, openness and access/correction rights.

Code of Banking Practice: non-statutory but enforced in practice; covers fairness, transparency, fee disclosure and complaint handling.

Governance: the board sets risk appetite and tone; a board committee oversees compliance; the compliance head reports to the board and has access to the CEO.

Independence: no business-line reporting line, no revenue targets, direct board access, and board approval for the compliance head's appointment or removal.

Three lines of defence: line 1 owns risk; line 2 provides oversight and challenge; line 3 provides independent assurance.

Risk appetite: the board approves a compliance risk appetite statement with measurable tolerances; breaches trigger escalation and remediation.

Compliance risk assessment: assess inherent risk against control effectiveness to derive residual risk and prioritise monitoring.

Monitoring and testing: risk-based thematic reviews, surveillance and sample testing; findings tracked to closure and reported to governance.

Regulatory relationships: single point of contact, coordinated responses to information requests, and documented follow-up on examination findings.

Remediation: issues logged with owner, action, due date and evidence; overdue actions escalate to senior management and the board committee.

Ethics: compliance staff act with integrity, independence and confidentiality, and escalate concerns even under commercial pressure.

HKMA SPM: primary source of supervisory expectations; relevant modules include CG-1 (corporate governance), CG-2 (culture), CG-3 (risk management framework) and the AML/CFT guideline.

Banking Ordinance (Cap. 155): gives the HKMA powers to require information, issue guidelines and take disciplinary action.

SFO (Cap. 571): regulates dealing, advising and asset management; an AI conducting regulated activities needs SFC registration or an exemption and must follow the SFC Code of Conduct.

AMLO (Cap. 615): statutory CDD and record-keeping requirements; creates the licensing regime for money service operators and DNFBPs.

PDPO (Cap. 486): six data protection principles on collection, accuracy, retention, security, openness and access/correction rights.

Code of Banking Practice: non-statutory but enforced in practice; covers fairness, transparency, fee disclosure and complaint handling.

Competition Ordinance (Cap. 619): prohibits anti-competitive agreements and abuse of market power.

Employment and anti-discrimination law: Employment Ordinance and the four discrimination ordinances apply to staff management and customer treatment.

Regulatory breach escalation: escalate to the compliance head and senior management, assess whether the HKMA must be notified, and document the assessment and remediation.

MIC regime: AIs designate managers responsible for core functions (including compliance and AML/CFT) and notify the HKMA; MICs are accountable for the effective operation of their function.

Culture: the HKMA expects tone from the top, accountability, and incentives aligned to good conduct rather than short-term revenue.

Enforcement: the HKMA can issue warnings, require remediation, impose conditions and take disciplinary action; the SFC can fine, suspend or revoke licences.

Regulatory reporting: statutory returns must be accurate and timely; errors and late submissions should be reported and remediated.

Complaint handling: acknowledge, investigate, respond within stated timelines, analyse root causes, and escalate systemic issues.

Sanctions screening: screen at onboarding and on an ongoing basis; investigate and document alerts; report matches as required.

Data privacy: comply with the PDPO's six principles; ensure customer data used in monitoring is collected for a lawful purpose and secured.

Business continuity: compliance processes (screening, reporting) should be covered by business continuity plans and tested periodically.

Training and competence: role-based, documented and refreshed annually; ECF Core level is the benchmark for new compliance staff.

Compliance risk definition: the risk of legal or regulatory sanctions, financial loss or reputational loss from failure to comply with laws, regulations, codes of conduct and standards of good practice.

Compliance function duties: advise the board and senior management, identify and monitor compliance risk, provide training, liaise with regulators, and report compliance metrics to governance.

Independence: the function should be independent of business lines, report to the board or a board committee, and have sufficient authority, resources and information access.

Regulatory reporting: report breaches and incidents to the HKMA in a timely manner, submit statutory returns on schedule, and disclose material information; late or inaccurate returns are themselves compliance failures.

Conflicts of interest: identify and manage at entity, business-unit and individual level; segregation of duties, information barriers and personal account dealing rules are standard controls.

Market conduct: the SFO and subsidiary legislation govern securities conduct; HKMA conduct supervision covers fair treatment, suitability, disclosure and complaint handling.

Outsourcing: AIs remain responsible for outsourced activities; due diligence, contractual audit/access/termination rights, ongoing monitoring and contingency planning are required.

Regulatory change: a documented process to track new rules, assess impact, assign owners, update policies and systems, train staff, and evidence implementation.

Record keeping: compliance decisions, advice, approvals and escalations should be documented and retained per legal and regulatory retention requirements.

ECF structure: HKMA-led, industry-agreed competency benchmark; Compliance is one stream with Core and Professional levels.

Core curriculum areas: regulatory and legal environment, compliance risk management, compliance programme and controls, and ethical conduct and professional behaviour.

Regulatory architecture: HKMA supervises AIs under the Banking Ordinance; SFC regulates securities and futures under the SFO; IA regulates insurance; MPFA administers retirement schemes.

HKMA supervisory guidance: the SPM modules, CG-1 corporate governance, and the three-tier AML/CFT approach (guidance, supervision, enforcement).

AML/CFT legal basis: DTROP (Cap. 405), OSCO (Cap. 455), UNATMO (Cap. 575) and AMLO (Cap. 615).

Risk-based approach: CDD intensity proportionate to assessed ML/TF risk; simplified due diligence only where lower risk is documented; EDD mandatory for PEPs, correspondent relationships and higher-risk jurisdictions.

Three lines of defence: line 1 owns risk; line 2 sets frameworks and monitors; line 3 provides independent assurance to the board/audit committee.

MIC regime: AIs designate managers responsible for core functions (including compliance and AML/CFT) and notify the HKMA; the individual is accountable for the function.

Personal accountability: compliance staff must act with integrity, independence and confidentiality, and escalate concerns even under commercial pressure.

Risk-based approach: allocate resources where inherent risk is highest; document the rationale; review the assessment when products, customers or regulations change.

CDD minimum requirements: identify and verify the customer, identify the beneficial owner, understand the purpose and intended nature of the relationship, and conduct ongoing monitoring.

EDD triggers: PEPs, higher-risk jurisdictions, complex or unusual ownership structures, correspondent relationships, and products that favour anonymity.

Suspicious transaction reporting: report to the JFIU promptly; do not tip off the customer; the MLRO/AML function decides whether to file and the AI must not disclose the filing.

Record retention: CDD and transaction records must be kept at least five years after the end of the business relationship or completion of the transaction under Cap. 615.

Sanctions screening: screen against applicable lists at onboarding and on an ongoing basis; investigate and document alerts; report matches as required.

Correspondent banking: assess the respondent's AML/CFT controls, ownership, reputation and jurisdiction risk; obtain senior management approval for new relationships.

FATF 40 Recommendations: the international AML/CFT standard; HK's regime is assessed against it, and the risk-based approach, CDD, record keeping, STRs and beneficial ownership are core elements.

PEP definition: an individual entrusted with prominent public functions, their family members and close associates; EDD and senior management approval are required.

Conduct risk vs compliance risk: compliance risk is breach of laws/regulations; conduct risk is the risk that business behaviour produces unfair customer outcomes or harms market integrity, even where no rule is broken.

Market abuse: insider dealing, market manipulation and false trading are criminal offences under the SFO; AIs need surveillance and escalation controls.

Conflicts of interest: identify, disclose and manage; segregation of duties, information barriers and personal account dealing policies are typical controls.

Complaint handling: acknowledge, investigate, respond within stated timelines, analyse root causes, and escalate systemic issues to senior management and the board.

Whistleblowing: confidential channels, protection from retaliation, and escalation to the board or its committee.

Outsourcing: AIs remain accountable; require due diligence, contractual audit/access rights, ongoing monitoring and a contingency plan for critical functions.

Third-party risk: assess financial stability, security, concentration and subcontracting; monitor performance and exit strategy.

PDPO: six data protection principles govern collection, accuracy, retention, security, openness and access/correction rights.

Code of Banking Practice: non-statutory but enforced in practice; covers fairness, transparency, fee disclosure and complaint handling.

Governance: the board sets risk appetite and tone; a board committee oversees compliance; the compliance head reports to the board and has access to the CEO.

Independence: no business-line reporting line, no revenue targets, direct board access, and board approval for the compliance head's appointment or removal.

Three lines of defence: line 1 owns risk; line 2 provides oversight and challenge; line 3 provides independent assurance.

Risk appetite: the board approves a compliance risk appetite statement with measurable tolerances; breaches trigger escalation and remediation.

Compliance risk assessment: assess inherent risk against control effectiveness to derive residual risk and prioritise monitoring.

Monitoring and testing: risk-based thematic reviews, surveillance and sample testing; findings tracked to closure and reported to governance.

Regulatory relationships: single point of contact, coordinated responses to information requests, and documented follow-up on examination findings.

Remediation: issues logged with owner, action, due date and evidence; overdue actions escalate to senior management and the board committee.

Ethics: compliance staff act with integrity, independence and confidentiality, and escalate concerns even under commercial pressure.

HKMA SPM: primary source of supervisory expectations; relevant modules include CG-1 (corporate governance), CG-2 (culture), CG-3 (risk management framework) and the AML/CFT guideline.

Banking Ordinance (Cap. 155): gives the HKMA powers to require information, issue guidelines and take disciplinary action.

SFO (Cap. 571): regulates dealing, advising and asset management; an AI conducting regulated activities needs SFC registration or an exemption and must follow the SFC Code of Conduct.

AMLO (Cap. 615): statutory CDD and record-keeping requirements; creates the licensing regime for money service operators and DNFBPs.

PDPO (Cap. 486): six data protection principles on collection, accuracy, retention, security, openness and access/correction rights.

Code of Banking Practice: non-statutory but enforced in practice; covers fairness, transparency, fee disclosure and complaint handling.

Competition Ordinance (Cap. 619): prohibits anti-competitive agreements and abuse of market power.

Employment and anti-discrimination law: Employment Ordinance and the four discrimination ordinances apply to staff management and customer treatment.

Regulatory breach escalation: escalate to the compliance head and senior management, assess whether the HKMA must be notified, and document the assessment and remediation.

MIC regime: AIs designate managers responsible for core functions (including compliance and AML/CFT) and notify the HKMA; MICs are accountable for the effective operation of their function.

Culture: the HKMA expects tone from the top, accountability, and incentives aligned to good conduct rather than short-term revenue.

Enforcement: the HKMA can issue warnings, require remediation, impose conditions and take disciplinary action; the SFC can fine, suspend or revoke licences.

Regulatory reporting: statutory returns must be accurate and timely; errors and late submissions should be reported and remediated.

Complaint handling: acknowledge, investigate, respond within stated timelines, analyse root causes, and escalate systemic issues.

Sanctions screening: screen at onboarding and on an ongoing basis; investigate and document alerts; report matches as required.

Data privacy: comply with the PDPO's six principles; ensure customer data used in monitoring is collected for a lawful purpose and secured.

Business continuity: compliance processes (screening, reporting) should be covered by business continuity plans and tested periodically.

Training and competence: role-based, documented and refreshed annually; ECF Core level is the benchmark for new compliance staff.