Access to banking services for corporate customers

Our Ref: B1/15C
B9/67C
B10/1C

27 April 2023
The Chief Executive
All Authorized Institutions
Dear Sir / Madam,
Access to banking services for corporate customers Maintaining safe and efficient banking system and promoting access to basic banking services for legitimate businesses are key priorities of the Hong Kong Monetary Authority (HKMA). To support this objective, and in line with international standards, the HKMA requires authorized institutions (AIs) to adopt a risk-based approach (RBA) in anti-money laundering and counter-financing of terrorism (AML/CFT) efforts, which will deliver effective outcomes consistent with the principles of treating customers fairly and financial inclusion1 . To assist AIs in applying the RBA, the HKMA provides practical guidance and feedback from time to time in relation to customer on-boarding and ongoing monitoring 2 . These include a thematic review in 2019 undertaken in collaboration with an external consultant on on-boarding of Small and Medium￾sized Enterprises (SME) customers, and best practices for risk-based AML/CFT work were shared with the industry for system review and procedural enhancement by individual AIs as appropriate3 . A dedicated team in the HKMA was also formed in 2017 and have since been closely engaging with the business

HKMA Circular “De-risking and Financial Inclusion” issued on 8 September 2016 (https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and￾circular/2016/20160908e1.pdf) 2 The statutory AML/CFT Guideline, circulars on remote on-boarding, frequently-asked questions developed by the Hong Kong Association of Banks, which can be found at the HKMA website (https://www.hkma.gov.hk/eng/key-functions/banking/anti-money-laundering-and-counter￾financing-of-terrorism/) 3 HKMA Circular “Feedback from Thematic Review of AIs’ Application of AML/CFT Controls in the SME Segment” issued on 14 June 2019 (https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and￾circular/2019/20190614e2.pdf). See also seminar training material (https://www.hkma.gov.hk/media/eng/doc/key-functions/banking￾stability/aml-cft/seminar_20190913_2.pdf)

community and following up on bank account opening and maintenance matters. These efforts have been well received, yet the HKMA occasionally receives feedback from corporates seeking to open bank accounts, which is largely related to execution issues. In this connection, we would like to share some observations and good practices (see Annex) identified through our ongoing engagement with stakeholders. In particular, we would like to draw AIs’ attention to three areas:

• Initial customer contact – Feedback reflects that sometimes the handling of
  account opening applications may not fully represent the intended outcomes of the AIs’ policies and procedures. AIs should therefore provide staff members with relevant training and up-to-date information, taking into account customers’ feedback and complaints. AIs should put in place processes which adequately support applications from specialised industries, such as dedicated teams with appropriate training and knowledge.
• Understanding of market developments – To cope with the fast moving
  technology landscape, AIs should take a forward-looking approach and seek to strengthen their understanding of new and developing sectors as well as related market developments, which will help AIs differentiate individual customers with different risk characteristics. In particular, AIs should endeavour to support virtual asset service providers (VASPs) licensed and regulated by the Securities and Futures Commission (SFC) on their legitimate need for bank accounts in Hong Kong.
• Risk management vs. wholesale de-risking – AIs should avoid a wholesale
  de-risking approach, i.e. precluding customers with common backgrounds (e.g. nationality and new industries) from target customer segments. Rather, AIs should endeavour to understand the risks and adapt operational responses consistent with the RBA, so that potential customers and legitimate businesses will have fair access to basic banking services. AIs should review their account opening procedures and customer due diligence (CDD) measures, as well as provide staff training, to ensure a balanced approach that delivers effective ML/TF risk management while providing inclusive access to banking services. The HKMA also takes this opportunity to strongly encourage AIs to support the Tiered Account Services initiative and, where

appropriate, seek to offer Simple Bank Accounts for meeting the needs of SMEs and start-ups which only require basic banking services4 . The HKMA will continue its close dialogue with the industry, and to share observations and good industry practices where appropriate to further assist AIs in achieving effective outcomes and enhancing customer experience in bank account opening and maintenance. Should you have any questions regarding this circular, please feel free to contact us at aml@hkma.iclnet.hk or financial_inclusion@hkma.iclnet.hk. Yours faithfully, Arthur Yuen Deputy Chief Executive cc: The Chairperson, The Hong Kong Association of Banks The Chairperson, The DTC Association Secretary for Financial Services and the Treasury (Attn: Mr Justin To)

4 HKMA Circular “Introduction of Tiered Account Services” issued on 12 April 2019 (https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and￾circular/2019/20190412e1.pdf).

---

Annex - Key observations and good practices identified in on-boarding of corporate customers

Annex
Key observations and good practices identified in on-boarding of corporate customers

1. Observation: The account opening application of a customer was left
   unattended for different reasons (e.g. when the handling staff was on a long period of leave or had left the bank), leading to lengthy and unnecessary delays to open an account for the applicant. Expected standard:
   AIs should have in place an established guideline and control measures to ensure customers’ applications are processed in a timely and appropriate manner. AIs should also communicate to applicants the expected timeframe for processing their applications and provide applicants with updates if the expected timeframe cannot be met.

2. Observation: Disregarding that an overseas entity declared that it did not
   have a physical office in Hong Kong, an AI insisted on provision of information of Hong Kong office address of the entity. Expected standard:
   AIs should be reasonable in the account opening process and explore pragmatic and flexible approaches with applicants regarding the approach to the provision of information and documents, having regard to the customers’ background and circumstances.

3. Observation: The frontline staff of an AI rejected an account opening
   application of the company upfront upon learning its business nature/model but without undergoing individual risk assessment on the applicant. Expected standard:
   AIs should not reject an account opening application outright simply in view of the industry sector which the applicant is operating in. Rather, AIs should adopt a risk-based approach to differentiate and understand the risks of customers and adopt appropriate and effective measures which are proportionate to the identified risks. AIs should also provide practical guidance and adequate training to their frontline staff to ensure consistent and effective implementation on the ground.

4. Observation: An AI conducted additional CDD measures for a SFC￾licensed VASP.
   Expected standard:
   AIs are reminded that the additional CDD measures for VASPs set out in the 2022 circular only apply when it offers correspondent services (e.g. an account to settle clients’ transactions) to overseas VASPs. In other words, if it is a SFC-licensed VASP, the AI concerned is not required to conduct the additional CDD measures. AIs should provide practical guidance and training to frontline staff so as to ensure a clear understanding on the requirements.

5. Observation: An AI required a SFC-licensed VASP seeking to open a bank
   account to furnish an independent assessment report on the VASP’s systems and controls with respect to AML/CFT. Expected standard:
   Provision of an independent report can be costly and time consuming. The information collected by AIs should be reasonable taking into account the circumstances of VASPs, particularly their status as a legal entity under the supervision of SFC.

6. Good Practice: An AI offers a narrower set of banking services and requires
   correspondingly less extensive CDD measures at account opening. Expected standard:
   AIs are reminded that the extent of CDD measures should be proportionate to the risk level of customers and the functionalities of the service provided in order not to create undue burden on the customers and the AI itself. For example, if a technology firm only opens an account for its own corporate use (e.g. payroll and rental), particularly for those setting up an office in Hong Kong to look for the opportunities here or in the course of applying for a licence under the new regulatory regime for virtual assets and VASPs in Hong Kong, but not yet commence any regulated activities, AIs may consider whether the Simple Bank Account arrangement can meet customer needs, and should give due regard to the “approval-in-principle” issued by the relevant authority to VASP licence applicants in the CDD process instead of taking no actions until the VASP licence is actually granted.

7. Good Practice: An AI conducts customer risk assessments taking into
   account various risk factors and differentiate the risk level of customers, instead of automatically applying enhanced due diligence on customers from jurisdictions in the FATF grey list. Expected standard:
   The FATF statement: “Jurisdictions under Increased Monitoring” (often referred to as the grey list) identifies countries that are actively working with the FATF to address strategic deficiencies in their AML/CFT regimes. The FATF has clarified that it does not call for the application of enhanced due diligence measures to be applied to these jurisdictions and the FATF Standards do not envisage de-risking, or cutting-off entire classes of customers, but calls for the application of a risk-based approach. AIs should continue to take into account the fact that a customer is connected to such a jurisdiction in constructing the risk profile of the customer, and apply CDD measures proportionate to the risks.