Coronavirus Disease (COVID-19) and Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) Measures – An Update

Our Ref.: B1/15C
B10/14C
30 July 2020
The Chief Executive
All Authorized Institutions
Dear Sir/Madam,
Coronavirus disease (COVID-19) and Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) measures – An Update I am writing to share observations and industry practices to assist Authorized Institutions (AIs) in developing sustained efforts to cope with the evolving COVID-19 situation and support operational responses which are consistent with the risk-based approach (RBA). The HKMA has been reaching out to AIs following our letter dated 7 April 2020 1 and, as the situation continues to evolve, it has become clear that measures which were originally intended to be short￾term may have to be kept in place by AIs for relatively longer or, in some cases, reintroduced as new clusters of COVID-19 cases emerge. Key observations and practices are highlighted below and further details are summarised in the Annex. (I) Customer due diligence under social distancing and travel restrictions Social distancing and a significant reduction in travel due to COVID-19 continue to significantly impact the ability of AIs to interact with existing and potential customers. This not only affects the mass retail segment but also corporate and private banking. We have, for example, observed that AIs are increasingly using video conferencing to interact with customers in the course of on-boarding and ongoing customer due diligence reviews. Some AIs utilise the flexibility provided in the Anti-Money Laundering and Counter-Terrorist Financing Ordinance to delay verifying the customer’s identity, while adopting appropriate risk mitigating measures. In addition to remote on-boarding for individual retail customers currently offered by more than 10 AIs, some AIs have also expedited testing of similar initiatives for corporate customers.

1 HKMA Circular “Coronavirus disease (COVID-19) and Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) measures” issued on 7 April 2020 (https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and￾circular/2020/20200407e1.pdf)

• 2 -
  (II) Pressure on AML/CFT resources
  All AIs have some form of business continuity planning in place to maintain sound operations. To address the pressure on resources, AIs have been adopting a number of responses, which collectively have minimised potential impact to AML/CFT processes. These include reprioritising work on the basis of ML/TF risks, reallocation of staff, staggering office hours and equipping staff with work￾from-home capabilities. Some AIs are also expediting their exploration of regulatory technology (RegTech) solutions (e.g. machine learning) to reduce the number of false positives generated from transaction monitoring and screening systems, and thus enhancing efficiency and effectiveness. The HKMA continues to monitor resource allocation as part of AIs’ operational responses to ML/TF risk management and reiterates through this engagement the importance of applying the principles of the RBA, maintaining adequate records of decisions made and that relevant controls or risk appetite need not be compromised in the process. (III) Emerging threats and changes in customers’ behaviour AIs have increased their understanding of and vigilance to emerging COVID-19 related financial crime risks, including through the Fraud and Money Laundering Intelligence Taskforce (FMLIT) 2 and a recently established Fraud Risk Management Taskforce under the Hong Kong Association of Banks, which is welcome. These collective efforts can help enhance the overall effectiveness of cooperation and information sharing between the public and private sectors on typologies and best practices. Consistent with the global trend 3 , some AIs identified changes in customer behaviour, such as digital payments and online transactions, and were working to incorporate their understanding of emerging risks into transaction monitoring rules and scenarios. We are also seeing examples where RegTech is helping to build out a more collaborative, intelligence-led approach to financial crime risk management and that some AIs are applying advanced analytics to help detect networks and common vulnerabilities. The HKMA will continue to work closely with AIs to support ongoing industry efforts, and reiterates that the principles of the RBA provide the flexibility to be both pragmatic and responsive to the evolving COVID-19 situation and the challenges it presents.

2
FMLIT was established in May 2017 led by the Police Force and participated by the HKMA and ten retail banks. 3 “COVID-19-related Money Laundering and Terrorist Financing Risks and Policy Responses” published by the Financial Action Task Force on 4 May 2020 highlights, among others, that online financial services are increasingly abused for moving and concealing illicit funds, while there has also been a global upsurge in corporate and personal fraud. The report can be found at: https://www.fatf￾gafi.org/media/fatf/documents/COVID-19-AML-CFT.pdf

• 3 -
  For any questions about this circular, please approach your usual contacts in the AML & Financial Crime Risk Division or aml@hkma.iclnet.hk. Yours faithfully, Carmen Chu Executive Director (Enforcement and AML) Encl.

---

Annex - AML/CFT control Measures Applied by AIs in Response to Coronavirus Disease (COVID-19)

1
Annex
AML/CFT control measures applied by AIs in response to coronavirus disease (COVID-19) (I) Customer due diligence (CDD) under social distancing and travel restrictions Customer on-boarding

1. Disruptions due to COVID-19 have affected the ability of AIs to use traditional
   methods to interact with customers, as well as the processes of physically verifying a customer’s identity.

2. Remote on-boarding initiatives launched by AIs so far have been offered to individual
   retail customers. A few AIs, including some virtual banks, are expediting their plans to onboard corporate customers remotely leveraging on experience obtained and technology used for on-boarding individual retail customers. These initiatives are being or will be tested through the HKMA Fintech Supervisory Sandbox.

3. A number of AIs are using video conferencing as an interim measure to interact with
   customers during on-boarding and when undertaking ongoing CDD reviews. To mitigate any assessed risks, AIs using this approach have generally confined the service to a specific group of customers meeting certain criteria such as having business connections with other business segments, and applied additional control measures (e.g. the initial source of funds must come from same-name accounts maintained with other banks and no third party payment will be conducted before a face-to-face meeting is conducted). The following examples are COVID-19 related interim measures applied by individual AIs specific to their own policies and procedures, which take into account not only the local legal and regulatory requirements, but also any group requirements and risk appetite. When making reference to these examples, AIs should carefully consider their specific circumstances and existing systems and controls. Relevant and adequate records, including any risk assessment performed, risk mitigating measures undertaken, and internal discussion and approval, should be maintained.

2
4. Under the current exceptional circumstances, some AIs utilise the option of “delayed
verification” as set out under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance for establishing new relationships where appropriate risk management policies and procedures are adopted. For example, some AIs accept scanned copies of identity documents from prospective overseas customers when establishing the business relationship as an interim measure, with physical identity documents being verified once this is possible. These AIs apply a range of measures to manage the risks involved when adopting this approach, such as limiting these interim measures to customers who were met by the bank staff prior to the COVID-19 situation; strengthening the monitoring of account activities; and limiting account functionality. Ongoing customer due diligence
5. A number of AIs reflected that they had experienced delays in, or been unable to
complete ongoing CDD reviews because customers were unavailable (e.g. unable to travel, quarantined or ill or unable to obtain required documents due to logistical challenges). Some AIs have made good use of the risk-based approach, for example, prioritising the review of higher-risk customers and seeking relevant approval for any exceptions made, generally for non-high risk customers. These AIs also maintained an adequate record of the relevant assessment and had a plan for clearing any backlogs as soon as possible.

6. Most retail banks have implemented some aspect of adverse news screening to
   support ongoing monitoring of customer relationships. One AI has temporarily lowered the priority of screening for lower-risk business segments to maintain adequate resources to manage higher-risk relationships or more critical functions; the AI concerned assessed the risks and based its decision on a risk-based approach as well as maintaining adequate records and staying agile to respond to any changes to its risk assessment. (II) Pressure on AML/CFT resources
7. Most AIs are adopting work-from-home or split-team arrangements (e.g. split teams
   at different office locations on alternating schedules) as part of business continuity plans so as to maintain effective AML/CFT controls across their operations while minimising the infection risk. We have also seen efforts to reprioritise work on the basis of ML/TF risks to help relieve the pressure on resources.

3
Transaction monitoring and screening systems
8. The labour-intensive work of clearing alerts generated by transaction monitoring and
screening systems has posed additional challenges to AIs during COVID-19, in particular, those relying on overseas service centres in heavily affected jurisdictions with lockdown measures imposed.
9. Some AIs moved quickly to meet this challenge by reprioritising alerts into different
levels, to ensure a greater focus on the highest-risk alerts. Management reports are in place to closely monitor the situation together with a plan to clear the backlog cases as soon as the situation permits. Reallocation of staff, staggering office hours and suitably equipping staff to work from home have also helped to manage alert volumes in this period.
10. A number of AIs have also expedited the exploration of regulatory technology
(RegTech) solutions (e.g. machine learning) to tackle the challenge of high false-positive rates, free up highly trained and experienced professionals to focus on genuine higher-risk cases and enhance the overall effectiveness and efficiency of transaction monitoring and screening systems.
11. Overall, AIs’ responses have been categorised by the understanding that relevant
controls or risk appetite should not be compromised when addressing operating issues. (III) Emerging threats and changes in customers’ behaviour
12. The HKMA drew AIs’ attention to the report “COVID-19-related Money Laundering
and Terrorist Financing Risks and Policy Responses” published by the Financial Action Task Force on 4 May 2020 and AIs are aware of the increasing fraudulent activities and scam typologies associated with COVID-19.
13. Some AIs have observed an increase in digital payments and online transactions
compared to normal levels as well as a rising trend of fraud cases. To continue to exercise vigilance in response to the changing risk areas for criminal activities, we noted that some AIs have provided specific guidance / reminders to staff to raise their awareness of fraud, scams and cyber security in relation to COVID-19. One AI has introduced additional mitigating measures based on risks, such as obtaining further information from customers or confirmation from correspondent banks before

4 processing transactions for accounts with specific features.
14. We are also seeing examples where the use of RegTech is helping to build out a more
collaborative, intelligence-led approach to financial crime risk management and some AIs are applying advanced analytics to detect new threats, such as criminal networks and common vulnerabilities. For example, to understand a customer’s global network, an international AI has launched a global analytics platform that identifies potential financial crime by analysing customer, transactional and publicly available data.
15. In response to the prevalent and emerging financial crime threats arising from
COVID-19, industry-led initiatives have been established for the purposes of sharing good practices relating to prevention, detection and mitigation measures across the industry. Many AIs have reminded customers to stay alert of and not to fall victim to COVID-19 related scams or fraud, while some AIs have shared specific risk indicators and typologies with the industry in order to assist peer AIs to proactively identify accounts being used to receive fraudulent payments linked to COVID-19 and to undertake risk mitigating measures in a timely manner.