HKIB ECF-Compliance Core common mistakes
HKIB ECF-Compliance Core · Understand the traps and how to avoid them.
Treating the HKMA's Supervisory Policy Manual (SPM) modules as one interchangeable body of rules, so answers cite a generic 'SPM requirement' instead of the specific module (e.g., CG-1 board governance, OR-1 operational resilience, IC-1 illicit activity, CA-G-1 capital adequacy) that governs the scenario.
Candidates study the ECF syllabus headings and memorise broad principles, then default to generic language under time pressure because they never mapped each SPM module to its trigger scenario. The exam tests application to a named situation, and the module identity is often the discriminating fact.
What to do instead
Build a one-page matrix: SPM module code, subject, key obligations, and the type of scenario that invokes it. Before answering, name the module in your own words, then check whether the option you chose is consistent with that module's actual obligations rather than with general 'good governance' instinct.
Conflating the three lines of defence: assigning ownership of a control failure to Compliance when it belongs to the first-line business unit, or describing Internal Audit as a control owner rather than an independent assurance provider.
Candidates learn the model as a diagram and then answer by seniority or by who would 'care most', rather than by function. The ECF Core syllabus expects precise allocation of responsibility, and distractors are deliberately written to sound responsible.
What to do instead
For every scenario, explicitly state: line 1 owns and operates the control; line 2 (Compliance/Risk) sets frameworks, advises, monitors and challenges but does not own business controls; line 3 (Internal Audit) provides independent assurance to the board/audit committee. Practise by rewriting wrong options into correct three-line statements.
Answering AML/CFT questions from memory of generic 'KYC' practice instead of the specific Hong Kong regime: the AMLO, the AMLO Guidelines issued by the HKMA, the Drug Trafficking (Recovery of Proceeds) Ordinance, the Organized and Serious Crimes Ordinance, the UN Sanctions Ordinance, and the relevant subsidiary legislation.
Most candidates have practical onboarding experience but have not read the statutory instruments and guidelines closely, so they default to FATF-style language and miss Hong Kong-specific thresholds, reporting routes and terminology such as suspicious transaction reports to the Joint Financial Intelligence Unit.
What to do instead
Learn the reporting chain precisely: internal escalation, then a suspicious transaction report to the JFIU, with tipping-off prohibitions under the relevant ordinances. Memorise which ordinance covers which predicate offence and which body issues which guideline. Test yourself by writing the statutory basis next to each AML scenario.
Treating sanctions screening as a pure technology control and missing the governance layer: list ownership, screening parameter changes, alert disposition quality, escalation of true matches, and the obligation to freeze and report to the relevant authority.
Candidates see screening as an operational system and underestimate the compliance oversight expectations. Scenario questions often hinge on who approves a parameter change or what to do after a confirmed match, not on how screening algorithms work.
What to do instead
Study sanctions compliance as a control cycle: list sourcing and update frequency, screening coverage (customers, payments, counterparties, staff), alert triage and documentation, escalation and freezing, reporting to the authority, and independent testing. For each stage, identify the accountable role and the evidence expected.
Confusing suitability and conduct requirements with prudential requirements: applying the Code of Conduct and client suitability obligations to a wholesale or interbank scenario, or applying prudential capital rules to a retail sales complaint.
The Core syllabus spans conduct, prudential, AML and governance topics, and candidates over-generalise the framework they know best. Distractors exploit this by placing a correct-sounding rule in the wrong context.
What to do instead
Classify each question first: is the subject a retail or private-banking client, a professional investor, or an interbank counterparty? Then select the regime that applies to that classification. Keep a short reference of which SPM modules and codes apply to conduct versus prudential versus AML scenarios.
Ignoring the distinction between rules-based and risk-based approaches, and answering 'follow the rule strictly' where the framework expects a documented risk-based judgement, or vice versa.
Candidates equate compliance with literal rule-following and miss that the HKMA's supervisory approach expects proportionate, risk-based controls with documented rationale. Conversely, some over-apply 'risk-based' to areas that remain prescriptive, such as specific reporting deadlines.
What to do instead
For each topic, note whether the obligation is prescriptive (fixed threshold, fixed deadline, mandatory report) or judgement-based (risk assessment, proportionality, documented rationale). In scenario answers, choose the option that matches the type of obligation and that shows a documented, defensible decision.
Missing the personal accountability layer: not distinguishing the role of the board, senior management, the Money Laundering Reporting Officer, the Compliance Officer, and the manager-in-charge, and answering as if 'the bank' is a single actor.
Candidates learn obligations at institutional level and do not map them to named accountable individuals. The ECF Core level expects awareness of the Manager-In-Charge regime and senior management accountability, so questions probe who is answerable for what.
What to do instead
Create a role map: board approves strategy and risk appetite; senior management implements; the MLRO owns the AML/CFT reporting chain; the Compliance Officer owns the compliance framework; the manager-in-charge is accountable for the assigned function. Practise attributing each obligation to a role and to the evidence that role must produce.
Treating compliance risk assessment as a one-off document rather than a living process, so answers omit the feedback loop from monitoring, incident review and regulatory change back into the risk assessment and control plan.
Candidates memorise 'the bank must have a compliance risk assessment' but not how it operates. Scenario questions test whether the candidate knows that new products, regulatory changes, audit findings and breaches must trigger reassessment and remediation tracking.
What to do instead
Learn the compliance programme as a loop: identify obligations, assess inherent risk, apply controls, test and monitor, report to governance, remediate, and update the risk assessment. For each scenario, ask which step is missing and what artefact proves it happened.
Underestimating record-keeping, reporting and notification obligations: missing the need to notify the HKMA of specified events, or failing to recognise statutory retention periods and the requirement for records to be retrievable and auditable.
Candidates focus on the substance of controls and treat documentation as administrative. Exam questions often test whether the candidate knows that a control without records, or an incident without notification, is itself a breach.
What to do instead
Maintain a short list of notification and reporting triggers (incidents, breaches, changes in senior personnel, outsourcing, new activities) with the recipient and timing, plus retention expectations for customer and transaction records. Rehearse by writing, for each scenario, what must be recorded, retained, reported and to whom.
Answering outsourcing and third-party questions by focusing only on the contract, without addressing due diligence, ongoing monitoring, the bank's retained accountability, access and audit rights, and the regulator's expectations on material outsourcing.
Candidates treat outsourcing as a procurement matter. The supervisory expectation is that the bank remains fully responsible for compliance with all obligations regardless of who performs the activity, and distractors suggest the risk transfers with the contract.
What to do instead
For every outsourcing scenario, apply a fixed checklist: risk assessment and materiality, due diligence, contractual clauses on audit and access, service levels and monitoring, exit and contingency planning, data protection and cross-border considerations, and retained regulatory accountability. State explicitly that accountability never transfers.