HKIB ECF-Compliance Core flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

ECF Compliance Core level

The entry-level benchmark in the HKMA-led Enhanced Competency Framework for compliance staff, covering the regulatory environment, compliance risk management, controls and professional ethics.

Three lines of defence

A governance model where business units own risk, Compliance and Risk provide independent oversight and challenge, and Internal Audit gives independent assurance to the board.

Compliance risk

The risk of legal or regulatory sanctions, financial loss or reputational damage arising from a failure to comply with laws, regulations, codes of conduct or standards of good practice.

Conduct risk

The risk that a firm's behaviour or business practices produce unfair customer outcomes or harm market integrity, even where no specific rule has been breached.

Manager-In-Charge regime

An HKMA requirement for authorized institutions to designate managers accountable for core functions, including compliance and AML/CFT, and to notify the HKMA of those appointments.

Supervisory Policy Manual

The HKMA's collection of guidance modules setting out supervisory expectations for authorized institutions on governance, risk management, AML/CFT and related topics.

Banking Ordinance Cap. 155

The principal statute governing the authorization and supervision of banks in Hong Kong, giving the HKMA powers to require information, issue guidelines and take disciplinary action.

Securities and Futures Ordinance

The statute regulating securities, futures and asset management activities in Hong Kong; firms conducting regulated activities need SFC registration or an exemption and must follow the SFC Code of Conduct.

AMLO Cap. 615

Hong Kong's Anti-Money Laundering and Counter-Terrorist Financing Ordinance, which sets statutory customer due diligence and record-keeping duties and licenses money service operators and DNFBPs.

Joint Financial Intelligence Unit

The Hong Kong body that receives and analyses suspicious transaction reports from financial institutions and passes intelligence to law enforcement agencies.

Suspicious transaction report

A disclosure to the JFIU when a person knows or suspects that property represents criminal proceeds; tipping off the customer about the report is a criminal offence.

Customer due diligence

The process of identifying and verifying a customer, identifying the beneficial owner, understanding the purpose of the relationship and conducting ongoing monitoring.

Enhanced due diligence

Additional scrutiny required for higher-risk situations such as politically exposed persons, correspondent relationships, complex ownership structures and higher-risk jurisdictions.

Politically exposed person

An individual entrusted with prominent public functions, together with family members and close associates, who requires enhanced due diligence and senior management approval.

Record retention five years

Under Cap. 615, customer due diligence and transaction records must be kept for at least five years after the business relationship ends or the transaction completes.

FATF 40 Recommendations

The international AML/CFT standard covering risk-based approach, customer due diligence, record keeping, suspicious transaction reporting and beneficial ownership, against which Hong Kong is assessed.

Sanctions screening

Checking customers and transactions against designated lists at onboarding and on an ongoing basis, investigating alerts and reporting confirmed matches as required.

Correspondent banking due diligence

Assessing a respondent bank's AML/CFT controls, ownership, reputation and jurisdiction risk, documenting the relationship and obtaining senior management approval before opening it.

PDPO six principles

The Personal Data (Privacy) Ordinance principles covering lawful and fair collection, accuracy, retention, security, openness and data subject access and correction rights.

Code of Banking Practice

A non-statutory Hong Kong code, monitored by the HKMA, covering fairness, transparency, fee disclosure and complaint handling in retail banking.

Compliance function independence

The requirement that compliance report to the board or a board committee, avoid business-line reporting lines and revenue targets, and have authority, resources and information access.

Compliance risk assessment

A periodic exercise rating inherent risk by product, customer, channel and geography against control effectiveness to derive residual risk and prioritise monitoring.

Compliance monitoring plan

A risk-based schedule of thematic reviews, surveillance and sample testing covering key regulations and business lines, with defined scope, frequency and reporting to governance.

Regulatory change management

A documented process to identify new rules, assess their impact, assign owners, update policies and systems, train staff and evidence implementation.

Outsourcing accountability

The principle that an authorized institution remains responsible for outsourced activities, requiring due diligence, audit and access rights, ongoing monitoring and contingency planning.

Conflict of interest controls

Measures such as segregation of duties, information barriers and personal account dealing rules used to identify, disclose and manage conflicts at entity and individual level.

Whistleblowing channel

A confidential reporting mechanism allowing staff to raise concerns without retaliation, with escalation to the board or its committee where appropriate.

Complaint handling process

A documented process covering acknowledgement, investigation, response timelines, root-cause analysis and escalation of systemic issues to senior management and the board.

Market abuse

Insider dealing, market manipulation and false trading, which are criminal offences under the Securities and Futures Ordinance and require surveillance and escalation controls.

Risk-based approach

Allocating compliance and AML/CFT resources and intensity of due diligence in proportion to assessed risk, with the rationale documented and reviewed when circumstances change.

Regulatory breach escalation

The process of reporting a compliance failure to the compliance head and senior management, assessing whether the HKMA must be notified, and documenting remediation.

Compliance training and competence

Role-based induction and annual refresher training with completion evidence, using the ECF Core level as the benchmark for staff entering the compliance function.