De-risking and Financial Inclusion

Our Ref.: B10/1C B1/15C 8 September 2016 The Chief Executive All Authorized Institutions Dear Sir/Madam, De-risking and Financial Inclusion I am writing to draw your attention to concerns about financial inclusion that have arisen from recent actions of some AIs engaged in the process of “de-risking1 ”. 2. The progressive tightening of international standards in combating money laundering (ML) and terrorist financing (TF) in the past few years has led to extensive enhancement of AIs’ anti-money laundering and counter-terrorist financing (AML/CFT) controls, including customer due diligence (CDD) processes for existing and new customers. Apart from the local requirements, some AIs, for a variety of reasons, need to also comply with requirements or standards mandated by their head offices or overseas authorities. While it is important to ensure that AML/CFT controls are sufficiently robust and comply with all the relevant regulatory requirements, the HKMA expects AIs to adopt a risk-based approach (RBA) and refrain from adopting practices that would result in financial exclusion, particularly in respect of the need for bona fide businesses to have access to basic banking services. Guiding principles of RBA 3. An effective RBA in the implementation of AML/CFT controls means that AIs should identify, assess and understand the ML/TF risks to which

1 The phenomenon of banks declining or discontinuing business relationships with customers or categories of customers to avoid, rather than manage, the risk involved.

• 2 - they are exposed and take appropriate measures commensurate with those risks in order to mitigate them effectively. I would like to set out below the guiding principles for the implementation of the RBA in relation to CDD: - (a) Risk differentiation – The risk assessment processes should be able to differentiate the risks of individual customers within a particular segment or grouping through the application of a range of factors, including country risk, business risk, product/service risk and delivery/distribution channel risk2 . It is inappropriate for AIs to adopt a one-size-fits-all approach. (b) Proportionality – Based on the likely risk level of a customer, AIs should apply proportionate risk mitigating and CDD measures. It is inappropriate for AIs to impose requirements disproportionate to the risk level of the customer, as this would result in undue burden on the customer and the AI concerned. (c) Not a “Zero Failure” regime – RBA does not require or expect a “zero failure” outcome. While AIs should take all reasonable measures to identify ML/TF risks at the account opening stage and, for existing customers, on an ongoing basis, it is unrealistic to expect that no ML/TF activities would ever occur through the banking system. AIs are not required to implement overly stringent CDD processes with a view to eliminating, ex-ante, all risks. Otherwise, such an approach would result in a large number of bona fide businesses and individuals not being able to open or maintain accounts. CDD is only one part of an effective AML/CFT regime. AIs are also required to implement a system that can monitor and detect suspicious transactions in order to report them to the relevant authorities and take the necessary mitigating measures, such as enhanced CDD. The HKMA’s supervisory stance is aimed at the effective implementation of AML/CFT systems by AIs and to ensure that there are no material failings in those systems, rather than aiming for nil ML/TF activities in the banking system.

4. We note from cases that have been drawn to our attention that recently some AIs may have applied stringent CDD measures that are disproportionate to the likely risk level of the customers, resulting in many unsuccessful account opening applications and/or unpleasant customer

2 The risk profiles of individual customers within an entire segment of customers will not all display homogenous characteristics in every aspect and therefore AIs should not assume customers in the whole segment all present the same or unacceptable risks.

• 3 - experiences. Some requirements that are often quoted in the feedback conveyed to the HKMA are provided at Annex. Interface with customers

5. In applying appropriate and effective CDD measures, AIs should be mindful not to take steps that would undermine financial inclusion. Moreover, it is also important for AIs to ensure that customers are being treated fairly, in the following aspects: - (a) Transparency – Information and documentation requirements for CDD purposes should be clearly set out and easily accessible to new and existing customers. All retail banks are required to enhance the transparency of account opening processes by uploading basic information about the relevant procedures and information and documentation requirements on their websites. AIs should explain to customers the rationale for the information requested and endeavor to assist customers in taking steps or providing alternatives that can help satisfy the CDD processes and introduce review mechanisms for unsuccessful applicants. (b) Reasonableness – CDD processes and documentation requirements of AIs should be relevant and pragmatic with respect to the customers’ background and circumstances. Furthermore, AIs should not use AML/CFT as the ground for closing or rejecting an account when it is actually for other considerations. (c) Efficiency – AIs should have appropriate arrangements in place to facilitate customers’ initiation of the account opening process. AIs are encouraged to introduce online applications if practicable. AIs should also maintain adequate communication with customers throughout the account opening process by, for example, providing interim updates about the progress of their applications (such as whether any documents remain outstanding), timely feedback of the results of their applications, and where an application is rejected, the reason for rejection as appropriate. Actions to be taken
6. AIs’ senior management should review their existing processes and practices to ensure that they are consistent with the principles outlined above. Where there are inconsistencies, the HKMA should be informed of the plans and timeline by which remediation measures will be taken. Where any requirements

• 4 - or standards mandated by an AI’s head office or overseas authority might conflict with the application of these principles, these should be reported to the HKMA with a view to resolving the issue. AIs should also provide adequate training to their front line staff to ensure clear understanding and consistent implementation.

7. This circular should also be brought to the attention of the board of directors in the case of a locally incorporated AI and the head of the regional/head office in charge of the governance and compliance functions in the case of a non-locally incorporated AI. The boards of locally incorporated AIs and senior management of regional/head offices of branches of foreign banks in Hong Kong should take a proactive role in ensuring that CDD processes comply with the principles of RBA and customer interface requirements as elucidated in this circular.
8. The HKMA will work with the banking industry on how identification of ML/TF risks and the implementation of AML/CFT requirements can be made more consistent and effective so as to lessen the side effects of de￾risking. We are also working with the industry association and international standard setting bodies to reduce some of the burden associated with compliance with AML/CFT requirements through innovation and technology, including but not limited to the use of know-your-customer utilities.
9. Enquiries on this circular may be addressed to Mr Stewart McGlynn (smcglynn@hkma.gov.hk) (on implementation of RBA) and Ms Sarah Kwok (sarah_sn_kwok@hkma.gov.hk) (on customer interface requirements) respectively. Yours faithfully, Norman Chan Chief Executive Encl.

Annex CDD requirements applied by AIs often quoted in the feedback conveyed to the HKMA that are disproportionate to the likely risk level of the customers include: - (i) requiring all directors and beneficial owners of an overseas corporate to be present at account opening; (ii) mandating that all documents of an overseas corporate are certified by a certifier in Hong Kong; (iii) requesting a start-up to provide the same degree of detail on its track record, business plan and revenue projections as a long-established company; (iv) expecting a Hong Kong business registration certificate for all applicants or evidence of a Hong Kong office for all overseas corporates, irrespective of business model or mode of operation; (v) requiring voluminous or very detailed information on source of wealth sometimes going back decades irrespective of the risks presented by the relationship or type of service offered (e.g. MPF account, basic banking services with small balances) which is difficult or impossible for the customer to provide; and (vi) rejecting account opening based on unreasonably high benchmarks such as expected or actual sales turnover.