Balanced and effective AML/CFT measures in private banking

Our Ref.: B10/1C
B1/15C
7 March 2023
The Chief Executive
All Authorized Institutions
Dear Sir/Madam,
Balanced and effective AML/CFT measures in private banking I am writing to elaborate on the Hong Kong Monetary Authority’s (HKMA) expectations with regard to anti-money laundering and counter-financing of terrorism (AML/CFT) requirements during account opening and ongoing monitoring for private banking customers. The HKMA has been working with the banking sector to implement effective AML/CFT systems and controls, which helps safeguard market integrity and financial stability and protect customers against harm from financial crimes. While AML/CFT measures exist for good reasons, applying them should not impose an undue burden on the general public and legitimate businesses when using banking services. With this in mind, and based on industry and customer feedback, the HKMA would like to provide further practical guidance on key AML/CFT requirements regarding private banking services. The risk-based approach (RBA) is central to the effective implementation of the international standards promulgated by the Financial Action Task Force (FATF). Authorized Institutions (AIs) are moving away from a purely compliance-based approach, towards a focus on effectiveness and outcomes. The HKMA places significant emphasis on the RBA in its supervisory work and provides guidance in various formats to assist AIs in balanced and proportional application of this approach. The three guiding principles of the RBA 1 (i.e. risk differentiation, proportionality, and not a “zero failure” regime) apply equally to private banking businesses. Industry and customer feedback reflects that private banks face challenges in customer onboarding and account maintenance, especially for three key areas: (i) establishment of source of wealth and source of funds; (ii) ongoing monitoring; and (iii) AML Regtech adoption. The HKMA has prepared a set of “Do’s and Don’ts” and good practices with the aim of helping the management as well as staff 1 HKMA Circular “De-risking and Financial Inclusion” issued on 8 September 2016 (https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and￾circular/2016/20160908e1.pdf)

• 2 -
  members of private banks’ AML compliance and customer-facing units to appropriately apply AML/CFT requirements to deliver effective outcomes. AIs should review and update their policies and procedures taking into account this and other guidance, including the presentation on “Source of Wealth Requirements” 2 in the recent AML Seminar 2022 and Appendix 1 “Establishing source of wealth” to the Frequently Asked Questions in relation to AML/CFT published by the Hong Kong Association of Banks3 . The HKMA will continue its close engagement with the industry and provide further guidance on balanced and effective AML/CFT measures as warranted. Meanwhile, the HKMA is also introducing supervisory technology (Suptech) to strengthen its risk-based and data-driven AML supervision. This includes an upcoming revamp of the way it obtains and analyses data collected from banks, to optimise supervisory and compliance resources as well as focusing on collaborative efforts and an ecosystem response to evolving money laundering and financial crime risks, and supporting a safe and efficient platform for the development of private wealth management businesses. Should you have any questions regarding this circular, please contact us at aml@hkma.iclnet.hk. Yours faithfully, Carmen Chu Executive Director (Enforcement and AML) Encl. c.c. The Chairman, The Hong Kong Association of Banks The Chairman, The Private Wealth Management Association 2 https://www.hkma.gov.hk/media/eng/doc/key-functions/banking-stability/aml￾cft/seminar_20221215_3.pdf 3 https://www.hkma.gov.hk/media/eng/doc/key-functions/banking-stability/aml￾cft/AML_FAQ_20221005.pdf

---

Annex - Smart tips for Private Banking

www.hkma.gov.hk/eng/key-functions/banking/anti-money-laundering-and-counter-financing-of-terrorism/ Customer due diligence (CDD) measures are not only for meeting regulatory requirements, but also help drive private banking relationships and understand clients’ needs for providing better services. The “3-C” approach Establishing source of wealth and source of funds does not mean verifying all the information for accuracy. The HKMA’s regulatory expectation is for AIs to take reasonable measures commensurate with the assessed risks. Anti-Money Laundering and Counter-Financing of Terrorism Measures Smart tips for Private Banking Collection Clarification Corroboration What is Source of Wealth? Source of wealth refers to the origin of an individual’s entire body of wealth (i.e. total assets). This information will usually give an indication as to the size of wealth the customer would be expected to have, and a picture of how the individual acquired such wealth. What is Source of Funds? Source of funds refers to the origin of the particular funds or other assets which are the subject of the business relationship between an individual and the Authorized Institution (AI) (e.g. the amounts being invested, deposited, or wired as part of the business relationship). Establish ≠ Verify 1

www.hkma.gov.hk/eng/key-functions/banking/anti-money-laundering-and-counter-financing-of-terrorism/  Customer X is a co-founder and executive chairman of a listed company and has been assigned a low risk rating by Bank A when opening a PB investment account.  Customer X indicated that his wealth has been generated mostly through the listed company.  In establishing Customer X’s source of wealth, rather than requesting the customer to provide documentary proofs of his declaration, Bank A conducted an internet search and made reference to available information in the public domain (e.g. annual report and online news
article), as well as calculating the value of the
company and the customer’s personal wealth based on performance of the share prices on the internet, and corroborated information obtained from Customer X and public sources. Good Practice 1  Customer Y is a personal investment company ultimately owned by 3 beneficial owners (BOs).  Customer Y’s PB investment account has been assigned a high risk rating according to the policy of Bank B.  In corroborating Customer Y’s source of wealth, Bank B verified the positions held by the BOs through online searches and pubic information (e.g. company website), properly documented the BOs’ journey to wealth, and estimated their annual income and investment return using a prudent approach, with the basis documented, to arrive at the net worth. Proceeds from sales of shares and properties are supported by market research and land searches. Good Practice 2 7 ✓ Obtain a broad picture of the customer’s total wealth and how such wealth was acquired ✓ Focus on asking questions that can help assess legitimacy or reasonableness of customer's wealth and the source of funds ✓ Check against publicly available information (e.g. property registers, land registers or news articles) to corroborate some key information provided by the customer ✓ Ask for verification or validation documents from customers only when there is doubt on the veracity of specific information provided by the customer ✘ Collect excessive information from the customer (e.g. bank statements or employment records dating back decades) ✘ Verify every piece of source of wealth information provided by the customer ✘ Make unreasonable repeated requests for additional information prolonging account opening ✘ Apply the same checklist to every customer mechanically without taking into account individual circumstances and information already collected Do Don’t 2

www.hkma.gov.hk/eng/key-functions/banking/anti-money-laundering-and-counter-financing-of-terrorism/ Ongoing monitoring is a dynamic process. The way private banking relationships are managed, with personalised services provided by dedicated relationship managers, makes many innovative ways to conduct ongoing monitoring possible. Ongoing monitoring is more than ticking the box or filling a checklist periodically. ✓ Make the best use of day-to-day communication to keep customer profiles up-to-date ✓ Set the timeframes of periodic CDD reviews for different customers according to their risk profiles ✓ Focus on areas where there are updates during periodic CDD review ✓ Monitor customer transactions through relationship management, and clarify with the customers where appropriate ✓ Remain vigilant to suspicious indicators and red flags when monitoring customers' account activities especially those involving third-party transfers ✘ Re-do CDD during periodic reviews (e.g. disregard information provided by the customer previously and ask for the same information all over again) ✘ Overly rely on rule-based transaction monitoring and seek clarification from the customer a long time after the transaction was conducted ✘ Inquire into every single transaction carried out by customers without taking into account the customer’s background and any risk indicators involved in the transaction Do Don’t 3  Bank D provided standardised CDD review forms for its staff to conduct periodic reviews. However, the forms were long (~15 pages) and required staff to collect lots of information from customers all over again.  To improve efficiency and customer experience, Bank D subsequently updated its process to rely more on information obtained during ongoing customer communication (e.g. call reports) and focus on areas where there are updates. This helps significantly reduce the amount of information to be collected and time taken for periodic reviews. Good Practice 4  Under Bank C’s customer risk assessment framework, a majority (~90%) of the corporate customers were automatically assigned a high risk rating without proper assessment.  As enhanced monitoring on a large population of high risk customers was unsustainable, Bank C engaged external consultants to help revamp its customer risk assessment framework including the risk category and CDD review cycle.  Under the revised framework, the number of high risk corporate customers was reduced significantly with only around 30% subject to annual CDD review, and have helped relieve pressure on Bank C’s AML compliance significantly to focus on effectiveness and intended outcomes. Good Practice 3

www.hkma.gov.hk/eng/key-functions/banking/anti-money-laundering-and-counter-financing-of-terrorism/ All banks, including private banks, are encouraged to explore AML Regtech. The HKMA supports the use of technologies for AML/CFT. ✓ Explore opportunities to use Regtech to offer better customer experience (e.g. using reliable digital identification systems such as iAM Smart) ✓ Provide different delivery channels for customer engagement (e.g. video conferencing) ✓ Understand the systems and processes deployed and support with skilled expertise ✓ Ensure accurate, complete and relevant data through regular assurance testing on data quality and lineage ✓ Implement effective management oversight on AML Regtech adoption ✘ Ignore problems of legacy architecture ✘ Deploy off-the-shelf systems provided by external vendors or head office without fully taking into account local circumstances ✘ Devote insufficient resources to Regtech projects Do Don’t  Bank F uses a centralised, automated platform with artificial intelligence to consolidate its CDD processes, including corroborating source of wealth and identifying hidden source of wealth based on various sources; and automatically generate name screening and adverse news search results.  With the adoption of this auditable artificial intelligence, false positive cases decreased significantly. Good Practice 6 4  Bank E has launched an initiative to leverage a digitalised platform with Regtech tools. When a prospective customer uploads his identity document, the system automatically assists staff to authenticate the document, including running through a comprehensive list of security features. This helps improve efficiency and automate processes, freeing staff for higher-value activities.  A list of control checkpoints is used to ensure all the data points are captured.  The digitalised platform facilitates interaction with the prospective customer via high quality video conferencing. To mitigate impersonation risk, Bank E also applies appropriate risk mitigating controls.  Better organised data and more analytical tools help Bank E’s staff to understand and target higher ML risk areas. Good Practice 5