Regulatory Alerts2026-08-20
Added
Mitigating risks in receiving deposits through simplified eDDA arrangements
Licensed corporations, SFC-licensed virtual asset service providers, and associated entities must assess and mitigate risks associated with simplified Electronic Direct Debit Authorisation (eDDA) arrangements used for receiving client deposits. Firms are required to verify that eDDA setup requests are authorized by the bank account owner, either through payer bank confirmation or by requiring a one-off small-value fund transfer to verify account ownership. Additionally, firms must ensure identification information is properly verified, decline requests where red flags of fraud or unauthorized access are detected, and implement supplementary measures such as transaction limits or step-up authentication commensurate with their risk profile.