Anti-Money Laundering, Counter-Terrorist Financing and Compliance Controls
This domain tests the AML/CTF framework for licensed corporations: legal basis, customer due diligence, the risk-based approach, suspicious transaction reporting and the controls the SFC expects.
Legal basis
The core statutes are the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), the Drug Trafficking (Recovery of Proceeds) Ordinance (Cap. 405), the Organised and Serious Crimes Ordinance (Cap. 455), the United Nations (Anti-Terrorism Measures) Ordinance (Cap. 575) and the United Nations Sanctions Ordinance (Cap. 537). Licensed corporations must follow the SFC's Guideline on Anti-Money Laundering and Counter-Financing of Terrorism, which applies a risk-based approach.
Customer due diligence
CDD requires identifying the customer and verifying identity from reliable, independent sources; identifying the beneficial owner - generally an individual owning or controlling more than 25% of shares or voting rights - and taking reasonable measures to verify; obtaining information on the purpose and intended nature of the relationship; and ongoing monitoring. Enhanced due diligence applies to politically exposed persons, high-risk jurisdictions and unusual structures; simplified measures only in genuinely low-risk cases. Records must be kept at least five years after the business relationship ends.
Suspicious transaction reporting
Suspicion must be reported to the Joint Financial Intelligence Unit, and tipping off the customer is a criminal offence. Internal escalation should be documented, with the money laundering reporting officer deciding independently of commercial pressure.
Controls
The SFC expects a documented institutional risk assessment, customer risk scoring, sanctions screening, training, independent testing of the AML programme and clear senior management ownership - under the Managers-In-Charge regime an MIC for AML/CFT is normally designated.
Worked example
A BVI company opens an account, declaring a Hong Kong trading business, with a nominee director and an unexplained US$3 million incoming wire from an unrelated third party. Steps: identify ultimate beneficial owners using the register of members and an ownership chart and verify them; treat the structure as higher risk and apply EDD; obtain source of wealth and source of funds evidence; screen all parties against sanctions lists; obtain senior management approval if a PEP is involved; and if the explanation does not hold, file an STR with the JFIU without telling the client.
Traps
- Assuming AML obligations apply only to banks.
- Believing CDD can be fully outsourced - the licensed corporation remains responsible.
- Treating the 25% threshold as a safe harbour for control exercised by other means.
- Confusing an STR with a police report, or tipping off the client.
- Applying simplified measures to a PEP or high-risk jurisdiction.