Effective Execution of Risk-based Approach for Customer Due Diligence

Our Ref.: B10/1C B1/15C 8 February 2024 The Chief Executive All Authorized Institutions Dear Sir/Madam, Effective Execution of Risk-based Approach for Customer Due Diligence I am writing to share recent observations from our ongoing supervisory engagement with Authorized Institutions (AIs) regarding execution of the risk-based approach (RBA) for customer due diligence (CDD). Since implementation of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) in 2012, the HKMA has provided considerable guidance, feedback and training material on balanced and effective anti-money laundering and counter-financing of terrorism (AML/CFT) measures1 . This circular reiterates the key principles of RBA and the importance of effective execution, especially for areas where customer feedback or complaints are received from time to time. While CDD measures of most AIs for customer on-boarding and reviews are appropriate and in line with the identified money laundering and terrorist financing (ML/TF) risks, we continue to see cases where there is room for improvement in both the design and execution of CDD. For example, information requests to customers should be risk sensitive, not excessive and should not duplicate information already held by or known to the AIs concerned, or are publicly available. It is not consistent with the RBA to ask customers to provide details or proof of salary, employment or investments dating back years. This issue often arises regarding source of wealth and source of funds information, including but not limited to where politically exposed persons (PEPs) are involved, who do not all carry the same ML/TF risks. To promote AIs’ efforts in striking the right balance and achieving effective execution, we are taking this opportunity to remind AIs of the guiding principles of RBA in relation to CDD (i.e. risk differentiation, proportionality, and not a “zero failure” regime) as set out in the circular “De-risking and Financial Inclusion”2 . Based on industry and customer feedback, the HKMA also shared some smart tips for private banking in March 20233 , covering principles which are relevant to all AIs, especially in the context of establishing the source of wealth and source of funds for PEPs. 1 See AML/CFT web page on the HKMA website 2 HKMA Circular “De-risking and Financial Inclusion” issued on 8 September 2016 3 HKMA Guidance “Smart tips for private banking” issued on 7 March 2023

• 2 - Where AIs have been able to implement AML/CFT control processes which are risk￾sensitive, the design of the controls takes into account the treat-customers-fairly principles, balances the provision of good customer experience with managing ML/TF risks and generally provides sufficient support to frontline staff to execute CDD procedures efficiently, reasonably and in a transparent manner. Effective staff training generally includes case examples, taking into account analysis of past complaints and customer feedback, so as to provide guidance on sound judgment and the development of necessary soft skills. AIs should review existing HKMA guidance to ensure their CDD policies and procedures accurately reflect the legal and regulatory requirements and that execution of the RBA is aligned with the balanced regulatory framework and customer-centric practices. AIs are also reminded that CDD measures which are disproportionate to ML/TF risks are not consistent with the legal and regulatory requirements and should not be communicated to customers as such. We will continue to maintain close engagement with the industry and provide further guidance where appropriate. Specifically, following the latest amendment to the AMLO, the HKMA is preparing new practical guidance on PEP-related AML/CFT controls, focusing on how to apply RBA on former PEPs. We are working with an external consultant to make sure the guidance is consistent with international standards and best practices in this area. Should you have any questions regarding this circular, please feel free to contact us at aml@hkma.iclnet.hk. Yours faithfully, Carmen Chu Executive Director (Enforcement and AML)