Remote on-boarding of individual customers

Our Ref: B10/1C 1 February 2019 The Chief Executive All Authorized Institutions Dear Sir / Madam, Remote on-boarding of individual customers I am writing to provide feedback and articulate the HKMA’s regulatory expectation in respect of remote on-boarding1 of individual customers, based on observations and insights gathered through the HKMA Fintech Supervisory Sandbox and Chatroom as well as use cases of customer remote on-boarding initiatives of authorized institutions (AIs). Globally, technology is changing customer expectations and also presenting opportunities, when applied appropriately, for more effective management of, inter alia, money laundering and terrorist financing (ML/TF) risks. The HKMA supports technology and innovation, and some AIs have already started on-boarding individual customers remotely through electronic channels such as mobile applications or internet, while others are exploring and/or testing options and solutions. When compared with current operating models of on-boarding customers, remote on-boarding may present greater risks to AIs, particularly for impersonation risks. There are also factors which aggravate the risks, such as the speed of electronic transactions, the ease of making multiple fictitious account applications and the use of stolen identities which, when made remotely, may be more challenging to be deterred and detected. AIs are required to conduct customer due diligence (CDD) measures before establishing business relationships with customers as specified in the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the Guideline on Anti￾Money Laundering and Counter-Financing of Terrorism (For Authorized Institutions) (AML/CFT Guideline), which permit on-boarding of customers remotely. AIs should employ technology solutions appropriate to mitigate the risks when identifying and verifying the identity of an individual customer. The HKMA expects that any technology solutions adopted by AIs for remote on-boarding2 should be at least as 1 For the purpose of this circular, the term “remote on-boarding” refers to establishing a business relationship with a customer solely through an electronic channel such as mobile applications or internet. 2 For example, the “eID” being developed as one of the key infrastructure projects for smart city

• 2 - robust as those performed when the customer is in front of the staff of an AI, and cover the following two aspects3 : (i) identity authentication – where the individual customer’s identity is obtained through electronic channels, such as transmission of a document image acquired by mobile application, AIs should take appropriate measures to ensure reliability of the document, data or information obtained for the purpose of verifying the customer’s identity. This includes utilising technology to ascertain the genuineness of the identity document by, for example using holograms detection or detection of security features of identity documents; and (ii) identity matching – AIs should use appropriate technology (e.g. biometric solutions like facial recognition and liveness detection) to link the customer incontrovertibly to the identity provided in (i). Prior to the launch of a remote on-boarding initiative, AIs should conduct ML/TF risk assessments 4 proportionate to the nature, size and complexity of their businesses and thereafter monitor and manage the effectiveness of the technology adopted on an ongoing basis, particularly during early stages of implementation and operation. For the avoidance of doubt, AIs should also comply with all applicable legal and regulatory requirements5 in their conduct of businesses. AIs are also reminded to apply a risk-based approach when conducting CDD measures and the extent of CDD measures should be commensurate with the ML/TF risk associated with a business relationship6 . Should you have any questions regarding this letter, please contact us at aml@hkma.iclnet.hk. Yours faithfully, Carmen Chu Executive Director (Enforcement and AML)

development announced in Policy Address 2017 would be an acceptable technology solution for remote on-boarding. 3 The examples provided are for illustrative purpose and are non-exhaustive. 4 See paragraphs 2.10 and 2.11 of the AML/CFT Guideline. 5 Including but not limited to guidance issued by the HKMA on technology and E-banking risk management 6 Reference can be made to various guidance issued by the HKMA including, for example, AML/CFT Guideline and the circular on “De-risking and Financial Inclusion” of 8 September 2016.