Compliance (Enhanced Competency Framework on Compliance – Core Level)
Domain focus
This section covers the Core Level Compliance domain of the HKIB Enhanced Competency Framework. The exam tests whether you can place compliance obligations within Hong Kong’s banking regulatory architecture and apply them using risk-based judgement, escalation and documented reasoning. Expect questions on the compliance function, governance, AML/CFT, sanctions, conduct, personal data, outsourcing and regulatory reporting.
Core rules and concepts
- Three lines of defence. The business line owns and manages risk; Compliance advises, monitors and challenges; Internal Audit gives independent assurance. Compliance must be independent, properly resourced and able to access the Board or a Board committee.
- Regulatory map. Authorized institutions operate under the Banking Ordinance and HKMA supervisory guidance, including Supervisory Policy Manual modules on corporate governance (CG-1), risk management (OR-1) and AML/CFT. Compliance must track rule changes and map them to policies, controls, training and monitoring.
- AML/CFT and sanctions. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance requires risk-based customer due diligence, enhanced due diligence for higher-risk customers, ongoing monitoring, sanctions screening and suspicious transaction reports to the Joint Financial Intelligence Unit. Tipping-off is prohibited.
- Conduct and data. Treat Customers Fairly, suitability, conflicts of interest, gifts and personal account dealing sit alongside the Personal Data (Privacy) Ordinance, including the six data protection principles and data access requests.
- Outsourcing and third parties. Material outsourcing, including cloud arrangements, needs due diligence, contractual controls, exit plans, access to records and notification to the HKMA where required.
Worked example
A relationship manager seeks approval to onboard a foreign politically exposed person using a complex offshore structure. Compliance should not simply reject the customer. It should require enhanced due diligence, establish source of wealth and source of funds, screen the customer and beneficial owners against sanctions and PEP lists, obtain senior management approval, and set enhanced ongoing monitoring. The rationale must be documented. If the evidence suggests suspicion, Compliance should ensure an STR is filed promptly and that no tipping-off occurs.
Traps that cost marks
- Treating Compliance as the first line of defence or as a purely advisory team without monitoring duties.
- Confusing an STR with a criminal report to police; the STR goes to the JFIU.
- Assuming all PEPs are prohibited rather than higher risk and subject to EDD and senior approval.
- Using customer confidentiality as a reason to withhold information from the HKMA.
- Ignoring outsourcing, cloud or cross-border data issues when assessing a new product or vendor.
key_points
- Compliance is independent, risk-based and escalation-focused, not a business approval function.
- Know the three lines of defence and the Board’s role in compliance governance.
- AML/CFT requires CDD, EDD, sanctions screening, ongoing monitoring and STRs to the JFIU.
- Conduct rules include Treat Customers Fairly, suitability and conflicts management.
- Personal data compliance centres on the PDPO’s six data protection principles.
- Outsourcing and third-party risk need due diligence, contracts, exit plans and regulatory notification where required.