Anti-money laundering: reconciling the HKMA and SFC's

SFC and HKMA’s approach to AML/CTF so far

In 2012, the HKMA and SFC issued identical guidelines on Anti-Money Laundering and Counter-Terrorism Financing (Guidelines)1. Under the Guidelines, both regulators require financial institutions (FIs) to apply a risk-based approach (RBA) when accepting business from customers, and because the HKMA and SFC Guidelines were identical, there was a tendency for FIs to apply the same client on-boarding standards for activities regulated by the HKMA and the SFC.

RBA has over the years been defined by the regulators to mean strict adherence to the Guidelines, as can be seen from the enforcement actions taken by the SFC2 and the HKMA3. In their press releases, both regulators emphasised that enforcement action would be taken to deter any failing on the part of FIs, suggesting a zero tolerance for AML/CTF breaches.

Given the clear message from the regulators, FIs were compelled to sever ties with and decline business from customers who did not meet all of the requirements of the Guidelines, a practice that has been termed “de-risking”. This has taken a toll on the financial markets, but more recently, a spike in the number of complaints to the HKMA of financial exclusion has made de-risking the talk of the town, including the Legislative Council4. In light of this, the HKMA revisited its interpretation of RBA on 08 September 2016.

HKMA’s change in tack - Circular of 08 September 2016

On 08 September 2016, the HKMA issued a Circular entitled “De-risking and Financial Inclusion” asking institutions under its supervision (Authorised Institutions, or “AIs”) to stop de-risking, and clarifying that the HKMA does not expect a “zero failure” regime that eliminates all risks. Instead, AIs need only ensure they have effective AML/CFT controls with no “material failings” in their systems5.

The HKMA Circular also cites examples of disproportionate and over-zealous client due diligence measures, presumably taken from the complaints received by the HKMA. However, these examples should not be read in isolation. When analysed in the context of the Guidelines, the examples may be justified in some situations, especially in relation to customers who are overseas corporates from higher-risk locations or from jurisdictions which are not members of the Financial Action Task Force (FATF). For a list of the HKMA’s examples mapped against the provisions of the Guidelines, click here.

SFC maintains its tack - Announcement of 21 September 2016

In contrast to the banking services that the HKMA regulates, which are deemed essential and should be accessible to a wider number of customers, access to investment services provided by FIs regulated by the SFC have and will continue to receive a very different treatment.

On 21 September 2016 the SFC avowed its hard line against inadequate AML internal controls, warning the industry to enhance their AML internal controls immediately. The SFC warns that licensees have had ample time to develop internal controls since the Anti-Money Laundering and Counter-Terrorist Financing (Financial Institutions) Ordinance (AMLO) and the corresponding SFC Guideline came into force in 2012, and cite the following examples of poor AML/CTF controls identified to date:

• failure to scrutinise cash and third party deposits into customer accounts
• ineffective monitoring of transactions in customer accounts
• failure to take adequate measures to continuously monitor business relationships with customers which present a higher risk of money laundering
• inadequate enquiries made to assess potentially suspicious transactions to determine whether or not it is necessary to make a report to the Joint Financial Intelligence Unit, and lack of documentation of the assessment results, and
• failure to monitor and supervise the ongoing implementation of AML/CTF policies and procedures.

Takeaways: manage the risks, don’t avoid them

Some key points to bear in mind:

• Do what is right, not what is expected. FIs should continue to be in strict compliance with the AMLO and Guidelines issued by the SFC and HKMA.

• Adopt a risk-based approach, avoid de-risking. FIs should not avoid risk by generically rejecting entire classes of customers. The FCA in the UK earlier this year criticised this approach and gave helpful guidance that it expects banks to recognise that risks associated with different business relationships within a single broad category can vary, and that banks should manage those risks appropriately. We would expect the SFC to take a similar view.

• Exercise judgement and use common sense. Best practice is to exercise judgement and document the thought process rather than blindly follow a checklist. The relevant back office team should receive adequate training so they understand the rationale behind the AML legislation and Guidelines issued by SFC/HKMA.

• Document the process. If a client is assessed as being low-risk, the RM should document the reasons and conclusion. In the event the FI does become an accessory to money laundering, it will be able to demonstrate to the SFC it had a well-documented process and good reason to take certain decisions.

• Better coordination between front and back office. Front office staff should avoid over-promising how quickly customers can be on-boarded because the reality is that back office staff need time to conduct adequate customer due diligence.

• For dual-regulated FIs. FIs who are dual regulated may wish to consider adopting a two tier approach to assessing AML/CFT risk:
  • When dealing with non-SFC regulated activities, FIs are encouraged to take into account their business relationship with the client. Consequently, dual regulated FIs may find it appropriate to conduct less stringent customer due diligence on customers who do not require SFC regulated services, although reasons for applying less stringent standards should always be documented.

*   FIs are however reminded that when an existing customer requests for further services which are SFC regulated, this changes the nature of their business relationship with the client and could trigger an increase in a customer’s risk level, FIs are reminded that their systems should be sufficiently robust to detect such change in risk-level and to apply appropriate customer due diligence measures accordingly.

---

1The SFC’s Guideline can be found here, and the HKMA’s can be accessed here. The SFC and HKMA both made revisions to their Guideline in 2015.

2See for example Sassoon Securities Limited (March 2000) and Guotai Junan Securities (Hong Kong) Limited (May 2016). Although the SFC’s enforcement actions were with reference to the SFC Client Identity Rule Policy, it is noted that this policy closely relates to client identity requirements under the AMLO and the Guidelines. Sassoon and Guotai were sanctioned for failing to provide information about the ultimate beneficiary of a listed security transaction to the SFC within two days of its request, because knowing the client and the source of funds is at the heart of AML controls.

3See for example where the HKMA ordered the State Bank of India, Hong Kong Branch to pay HK$7.5m for breach of the AMLO and HKMA Guideline. This was for their failure to:

• obtain the prescribed information set out in the Guidelines when conducting customer due diligence in respect of 28 corporate customers such as copies of business registration, certified copies of documents similar to a company report or certificate of incumbency
• take measures to verify the identities of the beneficial owners in SBI’s account opening process by failing to obtain the prescribed information set out in the Guidelines in respect of 22 accounts and identify the ultimate beneficial owners of direct customers in respect of 17 accounts
• set up effective on-going monitoring to identify unusual transactions, or conduct periodic reviews of a customer’s money laundering risk
• screen customers periodically or before establishing a business relationship, and
• adopt the Guidelines in a manner reflecting SBI’s own business practices.

4De-risking is also in itself a risky approach and the Financial Action Task Force in its 2014/15 annual report discouraged it. The decision to de-risk, or rather to avoid risk, by restricting business relationships with an entire category of customers should be distinguished from the more preferable practice of mitigating risks in a way that is proportionate to the nature and complexity of risks imposed by specific customers within that category.

5The HKMA urges AIs in its circular to adopt a “risk-based approach” (taking enhanced measures when customers are assessed to have higher risks, and simplified measures when risks are lower) instead of adopting a “one-size-fits-all” approach. It also said that AIs should work on their risk identification to “lessen the side effects of de-risking”.