Thematic Review of Sanctions Screening Systems

55th Floor, Two International Finance Centre, 香 港 中 環 金 融 街 8 號 國 際 金 融 中 心 2 期 55 樓 8 Finance Street, Central, Hong Kong 網 址：www.hkma.gov.hk Website: www.hkma.gov.hk Our Ref.: B10/1C B1/15C B10/21C 16 March 2026 The Chief Executive All Authorized Institutions and Stored Value Facility Licensees Dear Sir/Madam, Thematic Review of Sanctions Screening Systems I am writing to share the Hong Kong Monetary Authority’s (HKMA) observations from a recent thematic review to assess the effectiveness of the sanctions screening systems of Authorized Institutions (AIs) in meeting their statutory obligations under the Hong Kong sanctions regime. The review covered the extent to which system setting and performance, as well as ongoing tuning and testing, comply with the regulatory requirements and expectations set out in Chapter 6 of the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism and the associated guidance. While the thematic review covered only AIs, the observations are also useful to Stored Value Facility (SVF) licensees. The review found that AIs’ sanction screening systems generally meet those expectations and are operating within industry benchmarks. A number of good practices and areas for improvement were observed.

1. Governance and Oversight AIs generally demonstrated a clear understanding of their inherent sanctions risks and their obligations under the sanctions regime in Hong Kong and, where applicable, in other jurisdictions in relation to their international operations. It is a good practice for AIs to closely monitor geopolitical developments and associated sanctions risks, taking into account the nature of their customers, the geographic regions in which their customers operate, the nature of products and services offered and the counterparties involved in transactions. It is particularly important for AIs which engage in correspondent banking or similar relationships to understand how this changes their risk exposure and ensure they have the necessary visibility of their customers’ activities.

• 2 - The majority of AIs reviewed reported system performance data to senior management regularly in order to determine appropriate actions and allocation of resources.

2. System Testing and Validation The HKMA’s circular on “Feedback from Recent Thematic Review of AIs’ Sanctions Screening Systems” dated 18 April 2018 sets out the requirement on AIs to implement regular testing of sanctions screening systems in order to demonstrate explainable, effective and efficient sanctions controls which are commensurate with the assessed risk. Since the issuance of the circular, the HKMA has undertaken reviews of AIs’ testing of sanctions screening systems to ensure that they are able to meet their sanctions obligations. All AIs reviewed had implemented sanctions screening system testing. Most had engaged independent parties to carry out the testing, while some AIs possessed the necessary expertise to conduct the testing internally or with Group support. Some AIs saw benefit in using independent testing in view of the documentation and audit evidence such testing provided regarding the performance of their systems against the latest industry benchmarks and best practices. Given the benefits of appointing an external professional firm to carry out the independent assessment, the HKMA recommends that AIs should consider doing so to provide assurance on the robustness of their sanctions screening systems. Regardless of whether testing is done internally or by an external service provider, AIs should be satisfied regarding the independence and expertise of the party undertaking the testing. In most cases, AIs were able to demonstrate how testing had strengthened system maintenance and optimization, as well as providing robust reporting and quality assurance to senior management regarding changes made, and their appropriateness based on the risk exposure. Observations were provided to some AIs on the need to implement remedial actions recommended as a result of testing promptly, particularly regarding system configurations and algorithms. In all cases, post-test performance data were being promptly reported to senior management in line with regulatory expectations. The frequency of testing should align with risk, taking into account historical testing performance data (i.e. system performance over time) and should be approved by senior management. AIs reviewed typically conducted system testing at least annually. Some AIs conducted more frequent testing where deemed necessary, for example following material system updates, where deficiencies or system performance issues had been identified, or when there had been changes in the risk profile (e.g. a new product launch).
3. Sanctions List Management

• 3 - All AIs reviewed subscribed to commercial databases that provide prompt updates on designations, or relied on their head offices to do so, reflecting the increasingly complex nature of sanctions list management. In practice, we found that this meant that United Nations Security Council designations which are transposed into law under the Hong Kong sanctions regime are included in AIs’ sanctions lists without delay. AIs are reminded of the importance of timely, complete and accurate list updates. AIs reviewed had established mechanisms to conduct frequent checks, in order to ensure the latest updates in designations had been included in their internal database.

4. Adoption of Artificial Intelligence Many AIs have adopted various technologies, including artificial intelligence, to optimise sanctions screening processes. Some AIs have implemented automated closure of false positive alerts, and were able to demonstrate explainable and transparent logic frameworks that align with regulatory guidance, together with appropriate risk mitigating controls such as sample quality assurance checks. AIs and SVF licensees should review their existing sanctions risk controls through a gap analysis and consider adopting the practices outlined above to enhance their sanctions risk management framework. They may be asked to make the results of sanctions screening system testing available to the HKMA upon request. The results should demonstrate system effectiveness and efficiency in meeting legal and regulatory requirements aligned with risks. If AIs and SVF licensees have any questions on this circular, they may approach their usual supervisory contact at the HKMA’s AML and Financial Crime Risk Division. Yours faithfully, Raymond Chan Executive Director (Enforcement and AML)