Anti-money laundering and counter-terrorist financing obligations
Domain 9 tests the AML/CTF obligations of licensed corporations and registered institutions - risk-based controls, customer due diligence, sanctions and reporting.
Framework
The core statute is the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), supported by the Drug Trafficking (Recovery of Proceeds) Ordinance, the Organized and Serious Crimes Ordinance and the United Nations Sanctions Ordinance. The SFC's Guideline on Anti-Money Laundering and Counter-Terrorist Financing applies to licensed corporations; the HKMA's equivalent applies to registered institutions. Both require a risk-based approach and a documented institutional risk assessment.
Customer due diligence
CDD must be completed before a business relationship is established: identify the customer, verify identity using reliable independent sources, identify the beneficial owner (25% or more of shares or voting rights; for trusts, the settlor, trustee, beneficiaries and protector), and understand the purpose and intended nature of the relationship. Simplified due diligence is permitted only in low-risk situations; failure to complete CDD means no relationship, and consideration of a suspicious transaction report. Ongoing monitoring must be consistent with the client's risk profile.
Enhanced measures
EDD applies to politically exposed persons, high-risk jurisdictions, unusual transactions and correspondent relationships. For a PEP, senior management approval, source-of-wealth checks and enhanced ongoing monitoring are required. Screening against United Nations sanctions lists must be carried out before onboarding and on an ongoing basis; designated persons must not be given any economic resources.
Reporting and records
Suspicious transactions must be reported to the Joint Financial Intelligence Unit as soon as reasonably practicable. Tipping off the client is an offence. Records must be kept for at least five years after the end of the relationship.
Worked example
A new corporate client is owned through a BVI company. The firm must look through to the ultimate beneficial owner, verify identity, and screen the ownership chain against sanctions lists. If the client cannot explain the source of funds, the firm should decline and file a suspicious transaction report.
Traps
Applying EDD to everyone instead of risk-based measures; accepting an introducer's word without verification; forgetting the five-year record rule; disclosing a report to the client.