Guidance on Banking Services for Individuals with Higher Risk Profiles

Annex Banking Services for Individuals with Higher Risk Profiles To assist Authorized Institutions (AIs) in effectively managing and mitigating risks associated with individuals assessed as presenting higher risks (“higher-risk individuals”), and in adopting relevant measures in line with a risk-based approach, the following guidance is provided on the provision of banking services for higher-risk individuals. For the avoidance of doubt, AIs are required to continue to comply with the relevant legislation and regulations, including but not limited to those relating to anti-money laundering and counter-financing of terrorism (AML/CFT). The relevant measures and examples set out in the ensuing paragraphs are not exhaustive. (A) Access to Basic Banking Services The Hong Kong Monetary Authority (HKMA) expects AIs to adopt a risk-based approach in their AML/CFT efforts, ensuring effective risk management that aligns with the principles of treating customers fairly and financial inclusion. When an individual is assessed as presenting a higher risk, AIs are required to apply appropriate risk-mitigating measures as part of their AML/CFT efforts. If AIs determine that a broader range of banking services is not appropriate for the individual due to the level of risk exposure, they are expected to make reasonable efforts to facilitate customers’ access to basic banking services, thereby supporting their day-to-day banking needs and livelihood. Specifically, AIs should consider offering banking services to higher-risk individuals residing in Hong Kong who have genuine banking needs on a case-by-case basis, subject to appropriate safeguards and limitations. The range of such basic banking services should include deposits, withdrawals, payments, and fund transfers, taking into account the individual’s specific circumstances. AIs should also consider offering other basic banking services that are deemed appropriate and necessary for the customer’s basic livelihood needs.

(B) Application of safeguards and limitations As part of their risk mitigation efforts, AIs should consider applying reasonable safeguards and limitations on banking services offered to customers identified as higher-risk. These may include confining incoming funds to acceptable sources, such as wages and salaries received in the course of employment, government disbursements, and insurance payouts, or prohibiting incoming funds from specified sources. AIs may also determine the permissible payment channels and scope of account usage, such as domestic transactions only, payments to pre￾registered payees, or transactions for ordinary expenses necessary for livelihood needs (e.g. rent, utility bills, loan repayments, and tuition fees). AIs may also implement other measures such as imposing transaction limits for payments, transfers, remittances, or establishing account balance thresholds. AIs may adapt their implementation approach, which should be proportionate and subject to regular review to ensure that they remain appropriate and effective in line with their risk assessments. As a matter of principle, AIs should prioritise managing risks through the application of risk mitigation measures where possible, before deciding to end a banking relationship with a customer. Customers with existing accounts should not be requested to open a new bank account at another AI solely because they have been identified as higher-risk. (C) Pathways for review and transition As a customer’s risk profile may evolve over time, AIs should establish a review mechanism and accede to customers’ requests for a review and update of their risk profile, for example, where new or supplementary information corroborating a change in circumstances becomes available (such as acquittal of earlier charges). AIs should also put in place policies and procedures to review whether customers initially provided with basic banking services subject to safeguards and limitations are eligible for a transition to a broader range of banking services, where appropriate. Where a review indicates a reduced risk profile, AIs should consider upgrading the banking services provided to the customer, subject to any necessary additional customer due diligence (CDD) measures commensurate with the level of risk.

(D) Customer Communication When offering banking services subject to risk-mitigating measures to prospective and existing customers, AIs should clearly communicate the range of services and the terms and conditions governing them, including but not limited to any specific safeguards and limitations, customers’ obligations in using the services, and the consequences of any breaches. AIs should also explain to customers that such services are intended to meet basic banking needs and will be provided in a manner commensurate with the assessed risks. Customers should also be informed of the arrangements and any other information necessary to facilitate subsequent review and transition to a broader range of banking services. In cases where an individual is assessed as posing heightened risks which cannot be adequately mitigated (such as repeated misuse of bank accounts), and an account is not provided, AIs should inform applicants of the result as soon as practicable, along with the reason(s) for the decision, unless an exceptional circumstance applies, for example, where such disclosure be unlawful. AIs should also ensure that adequate training is provided to frontline staff involved in customer onboarding and review to facilitate proper communication with customers.