United States
Hong KongAnti-money laundering requirements for SFC licensees
SFC licensees must apply customer due diligence, keep records, and monitor relationships on a risk-based basis under Hong Kong's anti-money laundering legislation and the SFC's guideline. Knowledge or suspicion that property is criminal proceeds triggers a report to the Joint Financial Intelligence Unit. Telling the customer is the separate offence of tipping off.
Two duties, pulling in opposite directions. You must report your suspicion to the authorities. You must not let the customer find out. Hold those two together and most of this heading answers itself.
- Statutory base
- Hong Kong's anti-money laundering and counter-terrorist financing legislation
- Regulator guidance
- SFC Guideline on Anti-Money Laundering and Counter-Financing of Terrorism
- Approach
- Risk-based: simplified, standard or enhanced due diligence
- Report to
- Joint Financial Intelligence Unit (JFIU)
- Trigger to report
- Knowledge or suspicion, not proof
What does the risk-based approach mean in practice?
It means the firm decides how much diligence a relationship needs, and can justify the decision. Four risk dimensions run through the assessment: the customer, the product or service, the delivery channel, and the jurisdictions involved. A locally resident salaried client trading listed equities face-to-face is not the same proposition as an offshore company introduced remotely and trading complex products.
Where risk is demonstrably low, simplified measures are permitted. Where it is high, enhanced measures are required. The word doing the work is demonstrably. A firm that applies simplified diligence because the client seemed respectable has not conducted a risk assessment, it has formed an impression.
What are the customer due diligence steps?
| Step | What it requires |
|---|---|
| Identify and verify the customer | Using documents, data or information from a reliable and independent source |
| Identify the beneficial owner | And take reasonable measures to verify that person's identity |
| Understand the relationship | Obtain information on the purpose and intended nature of the business relationship |
| Monitor on an ongoing basis | Scrutinise transactions for consistency with what is known about the customer |
| Apply enhanced measures where needed | Politically exposed persons, non-face-to-face onboarding, higher-risk jurisdictions |
Timing is examined as often as content. Due diligence must generally be completed before the business relationship is established. Completing it afterwards is permitted only in narrow circumstances, where the interruption of business would be unavoidable and the firm manages the risk in the meantime. So the safe answer to "can we onboard now and verify next week" is almost always no.
Beneficial ownership. Identifying the account holder is easy; establishing who ultimately owns or controls a layered corporate client is not, and a firm that stops at the first company in the chain has not done what the legislation asks.
When must a suspicious transaction be reported?
As soon as it is reasonable to do so, once the person knows or suspects that property represents the proceeds of an indictable offence or is terrorist property. Suspicion is a low threshold. It is more than idle speculation and far less than proof, and the legislation deliberately sets it low so that the intelligence reaches the authorities early.
The report goes to the Joint Financial Intelligence Unit, jointly run by the Police and Customs. Not to the SFC, and not to the exchange. That distinction is a standard distractor. Reporting in good faith carries statutory protection against liability for breach of confidence, which is what allows a firm to override its duty to the client.
What is tipping off?
Disclosing to the customer, or to anyone else, anything likely to prejudice an investigation. It is a criminal offence in its own right, and it sits awkwardly beside ordinary customer service. A client asks why their withdrawal is taking so long. The honest answer would be tipping off. The permitted answer is a neutral one that does not reveal the report or the investigation.
Nothing in the regime requires the firm to lie. It requires the firm not to disclose.
How does this differ from know your client?
Different purpose, overlapping paperwork. Customer due diligence protects the financial system from criminal money. Know your client under the Code of Conduct exists so the firm can give suitable advice. One account-opening pack usually satisfies both, which is precisely why the paper insists you can separate them. Beneficial ownership is anti-money laundering. Investment horizon is the Code.
A worked question
A licensed corporation is onboarding a company registered offshore. The introducer provides the company's certificate of incorporation and the name of its sole director. What else must the firm do before establishing the relationship?
- Nothing further, since the company's registration documents have been provided
- Identify the beneficial owners and take reasonable measures to verify their identity
- Obtain the SFC's approval to open an account for an offshore company
- Report the account opening to the Joint Financial Intelligence Unit
What to memorise, and what to understand
Memorise the due diligence steps and the reporting destination. Understand the rest. If you grasp that the regime is trying to find out who is really behind the money and to get suspicions into the intelligence system quickly, you can reason your way to most answers without recalling a single provision.
A fair caveat about our coverage here. This area moves. Guidance is updated, sanctions lists change, and the treatment of virtual assets in particular has been revised repeatedly. The structure above is stable and examinable; anything that looks like a current-year detail should be checked against the SFC's own guideline before you rely on it. For revision, pair this with Topic 6 practice questions.
Common questions
Who do you report a suspicious transaction to in Hong Kong?
The Joint Financial Intelligence Unit, run jointly by the Hong Kong Police Force and the Customs and Excise Department. Reports do not go to the SFC or to the exchange, and a report made in good faith carries statutory protection against liability for breach of confidence.
Does a firm need proof before reporting a suspicious transaction?
No. The duty is triggered by knowledge or suspicion. Suspicion is more than idle speculation but far short of proof, and a firm that waits until it can prove an offence has already breached the obligation.
What is tipping off?
Disclosing to the customer or to anyone else anything likely to prejudice an investigation into money laundering or terrorist financing. It is a criminal offence separate from any failure to report, which is why a firm must report a suspicion and then say nothing about it.
When must customer due diligence be completed?
Generally before the business relationship is established. Completing verification afterwards is permitted only in narrow circumstances where interrupting business would be unavoidable and the firm manages the risk in the meantime.
What is enhanced due diligence?
Additional measures applied to higher-risk situations, such as politically exposed persons, non-face-to-face onboarding and customers connected to higher-risk jurisdictions. It typically involves senior management approval, more evidence on source of wealth and funds, and closer ongoing monitoring.
Is anti-money laundering the same as know your client?
No. Customer due diligence protects the financial system from criminal money and is statutory. Know your client sits in the SFC Code of Conduct and exists so the firm can advise suitably. The paperwork overlaps; the purpose and the consequences of breach do not.