Anti-money laundering and counter-terrorist financing: risk-based approach, CDD, monitoring and STRs
The framework
Hong Kong's AML/CTF regime for insurers and intermediaries rests on the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), the Drug Trafficking (Recovery of Proceeds) Ordinance, the Organized and Serious Crimes Ordinance and the United Nations (Anti-Terrorism Measures) Ordinance, together with the IA's AML/CTF guideline. Suspicious transaction reports go to the Joint Financial Intelligence Unit (JFIU).
Risk-based approach
Assess risk by customer, country, product, delivery channel and transaction. Higher-risk features include large single premiums, lump-sum top-ups, early surrender, third-party payments, complex ownership structures and clients from high-risk jurisdictions. Controls must be proportionate, with senior management oversight, written policies, staff training and independent testing.
Customer due diligence
- Identify the customer and verify identity from reliable, independent sources.
- Identify the beneficial owner (generally 25% or more ownership or control) and verify.
- Establish the purpose and intended nature of the relationship.
- For higher risk, establish source of funds and source of wealth.
- Simplified due diligence is only for genuinely low-risk cases and is never available for politically exposed persons.
- Enhanced due diligence with senior management approval is required for PEPs, with ongoing scrutiny.
Ongoing monitoring
Monitor transactions against the client profile, refresh CDD on trigger events (change of beneficiary, large top-up, assignment, early surrender) and at periodic intervals. A transaction inconsistent with the profile must be examined, not merely recorded.
Reporting
Escalate internally to the MLRO or compliance; if suspicion remains, file an STR with the JFIU promptly. Do not tip off the client or anyone else that a report has been made - tipping off is a criminal offence. Continue normal handling unless instructed otherwise, and avoid terminating the relationship in a way that reveals the report.
Records
Keep CDD and transaction records for at least five years after the end of the relationship or the transaction.
Worked example
A client paying a HK$2 million single premium asks to remit it from a BVI company account that is not the policyholder. The adviser verifies who controls the company, asks for the source of the funds, notes the mismatch with the client's stated profile, escalates to the MLRO and, if the explanation fails, files an STR - while handling the case normally or declining without revealing why.
Traps
- “We reported, so we must close the relationship” - not necessarily; follow instructions and avoid tipping off.
- Thinking simplified due diligence can apply to a PEP.
- Treating a signed declaration as verification.
- Confusing the five-year AML record period with the seven-year conduct record period.