HKIB ECF-Compliance Core key terms

The process of concealing the criminal origin of funds so they appear legitimate. It typically moves through placement, layering and integration stages, and is a core predicate concern for every Hong Kong authorized institution.

Providing or collecting funds, from legal or illegal sources, with the intention that they be used to carry out terrorist acts or support terrorist organisations. Financing can involve small amounts and lawful income.

The global standards issued by the Financial Action Task Force on combating money laundering, terrorist financing and proliferation financing. They set the forty measures that jurisdictions are assessed against and that shape Hong Kong's AML/CFT regime.

Allocating compliance resources in proportion to assessed money laundering and terrorist financing risk, so that higher-risk customers and activities receive enhanced scrutiny while lower-risk ones may receive simplified measures.

The set of identification and verification steps an institution must complete for a customer before or during a relationship, including establishing identity, beneficial ownership, purpose of the relationship and ongoing monitoring.

Additional and more intrusive checks applied to higher-risk customers, such as politically exposed persons or those in high-risk jurisdictions, including source of wealth and source of funds enquiries and senior management approval.

Reduced identification or verification measures permitted only where an institution has documented that the customer or product presents low money laundering and terrorist financing risk, and where the customer is not exempt from CDD altogether.

The natural person who ultimately owns or controls a customer or the funds involved, generally identified through ownership thresholds such as 25% of shares or voting rights, or control by other means.

A person entrusted with prominent public functions, and their family members and close associates, whose position may expose the institution to heightened corruption and bribery risk and who therefore requires enhanced due diligence.

The description of how a customer's total assets and overall financial position were accumulated, such as business ownership or inheritance. It is distinct from source of funds and is central to enhanced due diligence.

The description of where the money used in a particular transaction or relationship came from, such as salary or a property sale. It explains the specific funds involved, not the customer's overall wealth.

Continuous scrutiny of transactions and relationships against the customer's known profile, so that activity inconsistent with expected behaviour is detected, reviewed and, where necessary, reported.

A report made to the Joint Financial Intelligence Unit when an institution knows or suspects that property represents proceeds of crime or is connected to terrorist financing, supported by the reporter's reasoning.

The Hong Kong unit, jointly operated by the police and customs, that receives and analyses suspicious transaction reports and disseminates intelligence to law enforcement and regulators.

Disclosing to the customer or a third party that a suspicious transaction report has been or may be made, or that an investigation is underway. This is a criminal offence, subject to limited statutory defences.

Comparing customers, beneficial owners and transactions against designated names lists, such as those of the United Nations and the Hong Kong Monetary Authority, to identify and block prohibited dealings.

Matching a person or entity's name, and related identifiers such as date of birth, against watchlists including sanctions lists, politically exposed person lists and adverse media sources, then reviewing any matches.

A screening or monitoring alert that superficially matches a listed name or suspicious pattern but, on review, does not involve the prohibited person or genuine risk. It is cleared with documented rationale.

Systematic surveillance of customer transactions and accounts using rules or models to flag activity that may indicate money laundering, terrorist financing or fraud, which is then investigated and dispositioned.

The documented assessment of a customer's money laundering and terrorist financing risk based on factors such as business type, geography, product use and transaction behaviour, used to set monitoring and due diligence intensity.

An institution's periodic, documented evaluation of how its products, services, customers, delivery channels and geographies expose it to money laundering and terrorist financing risk, informing the design of its controls.

The broader framework of identifying customers, understanding their activity and verifying information before and during a relationship, of which customer due diligence is the operational core.

A relationship in which one bank provides account and payment services to another, creating exposure to the respondent's customers. It requires enhanced due diligence, including understanding the respondent's AML controls.

Requirements that cross-border payment messages carry complete originator and beneficiary information, so that the payment chain can be traced and incomplete or suspicious transfers can be identified and handled.

Establishing the identity of a company or other legal entity through incorporation documents, ownership and control structures, and identifying the natural persons who ultimately benefit from or direct it.

Industry guidance developed by leading banks on financial crime compliance topics such as correspondent banking, private banking and beneficial ownership, used to benchmark controls beyond strict legal requirements.

The board-approved statement of an institution's approach to combating money laundering and terrorist financing, setting out principles, roles, risk appetite and the framework within which detailed procedures operate.

The combination of policies, procedures, systems, training and monitoring that an institution maintains to meet its legal and regulatory obligations, kept current as risks and rules change.

A governance model in which business units own and manage risk, a compliance and risk function oversees and advises, and internal audit provides independent assurance to the board.

The independent second-line unit responsible for identifying compliance risk, advising the business, monitoring adherence to rules and reporting material issues to senior management and the board.

A structured evaluation of how legal, regulatory and conduct requirements could be breached, and the potential impact, used to prioritise the compliance work plan and monitoring activity.

Planned, risk-based testing and review of business processes and controls to confirm they operate as intended and to identify gaps requiring remediation, distinct from day-to-day operational controls.

The independent third-line function that assesses the effectiveness of governance, risk management and controls, including compliance controls, and reports its findings to the audit committee.

The timely and accurate submission of prescribed information to regulators, such as returns, notifications of breaches or changes in senior personnel, with governance to ensure completeness and correctness.

A supervisory review in which the regulator inspects an institution's records, controls and conduct, may issue findings and recommendations, and expects a documented remediation plan with clear ownership and deadlines.

Transactions in securities or other investments by staff for their own account, which are typically subject to pre-clearance, holding period and reporting rules to prevent conflicts of interest and market abuse.

A situation where a person's private interests, or duties to another party, could improperly influence their professional judgement. It must be identified, disclosed and managed or avoided.

An information barrier that separates teams holding confidential or price-sensitive information from those who could misuse it, supported by physical, system and procedural controls and restricted access.

Prohibited conduct in Hong Kong markets such as insider dealing, false trading, price rigging and disclosure of inside information, enforced under the Securities and Futures Ordinance.

The obligation not to reveal confidential regulatory or customer information except where permitted by law or required by the regulator, closely related to but distinct from the tipping-off offence.

The protection of individuals' personal data under Hong Kong's Personal Data (Privacy) Ordinance, including lawful collection, accuracy, retention limits, security and permitted use and transfer.

A protected channel through which staff can raise concerns about wrongdoing or breaches in good faith, with safeguards against retaliation and a clear escalation route to an independent function.

The requirement that staff have the knowledge, skills and ethical awareness needed for their roles, maintained through induction, refresher and role-specific training with records evidencing completion.