It was a busy month for Hong Kong regulators, with in-tandem efforts to enhance financial inclusion, while emphasising the importance of controls.
In particular, the Hong Kong Monetary Authority (HKMA) has stepped up its efforts to balance its strong messages of compliance with the need to ensure Hong Kong remains globally competitive and responsive to an increasingly innovative and digitised financial services market.
This alert describes the key developments.
1. Financial inclusion squarely on the agenda
With its circular on 8 September 2016 on “De-risking and Financial Inclusion” (De-Risking Circular), the HKMA moved from private channels and into the public arena to place financial inclusion squarely on the banking agenda.
The concept of financial inclusion is not new. However, there has been fierce debate in Hong Kong about how best to square what is arguably one of the strongest anti-money laundering and counter-terrorist financing (AML/CTF) regimes globally, with the need for Hong Kong to compete effectively as an international financial centre that responds to the needs of digital age.
Most financial institutions also struggle to nail down exactly what regulators expect of the risk-based approach (RBA) to AML/CTF, particularly when dealing with start-ups and small-to-medium enterprises (SMEs).
So what does the HKMA expect? 6 key principles
"[T]he HKMA expects AIs to adopt a risk-based approach (RBA) and refrain from adopting practices that would result in financial exclusion, particularly in respect of the need for bona fide business to have access to basic banking services"
Hong Kong has one of the most prescriptive regimes globally when it comes to the documents and information to be collected when establishing business relationships and carrying out occasional transactions above specified thresholds. And yet, the industry and regulators are at pains to retain a principles-based approach. This is fundamental to the RBA.
In that vein, the De-risking Circular outlines three guiding principles for the implementation of the RBA in relation to customer due diligence:
Aside from these principles, the HKMA also articulates three customer principles to help ensure customers are treated fairly.
- Transparency – including making available appropriate information (particularly to retail customers) on procedures and requirements.
- Reasonableness – ensuring that processes and requirements are “relevant and pragmatic”, and that AML/CTF is not used as an excuse for closing or rejecting an account when a decision is made for other reasons.
- Efficiency – in short, adequate communication, interim updates where relevant, timely feedback and reasons for rejection when appropriate. Interestingly, the HKMA also encourages AIs to use online applications if practicable.
There are, of course, limits. A financial institution that provides too much information to a customer in relation to whom it has a suspicion could tip them off, which carries potential criminal liability. As a result, too much transparency can be dangerous. See our alert on recent cases relating to suspicion.
The De-Risking Circular cites a number of requirements imposed by banks that are “disproportionate to the likely risk level”. Examples of overreaching requirements include the following:
|Presence at account opening
|Requiring all directors and beneficial owners of an overseas corporate to be present at account opening
|Hong Kong generally only requires the presence of one relevant person for customer due diligence purposes, to avoid the need to undertake enhanced due diligence.
|Mandating that all documents of an overseas corporate are certified by a certifier in Hong Kong
|Regulatory guidance only requires certification on a risk-based approach, although in our experience, all copies should be certified unless there are good reasons not to do so.
As to who can certify, the guidance provides examples of who would be a suitable certifier – these are not restricted to persons in Hong Kong and, in any event, are not exhaustive. It is open to use other certifiers considered appropriate, but the rationale should be documented.
|Source of wealth and business information
|Requesting a start-up to provide the same degree of detail on its track record, business plan and revenue projections as a long-established company
Requiring voluminous or very detailed information on source of wealth sometimes going back decades irrespective of the risks presented by the relationship or type of service offered
|Detailed source of wealth and business information is not always necessary depending on the circumstances.
The scope of required information also varies from customer-to-customer, making a nuanced approach essential. Generally speaking, “good” source of wealth information provides a logical narrative explaining how the customer generated their wealth. Based on our experience, this may well go back decades, particularly if the customer inherited their wealth – it is not sufficient simply to stop at “inheritance”. But a balance must be struck.
The HKMA also provided guidance on source of wealth in its “Understanding Source of Wealth Requirements” paper on 21 January 2016.
|Company documents and local office
|Expecting a Hong Kong business registration certificate for all applicants or evidence of a Hong Kong office for all overseas corporates, irrespective of business model or mode of operation
|The documents requested from a customer must be relevant. There is no mandatory requirement for local business registration or local presence.
|Rejecting account opening based on unreasonably high benchmarks such as expected or actual sales turnover
|This is not an easy issue. Commercial considerations play a legitimate role in customer acceptance.
Despite the reasonably hard line taken by the HKMA in classing these as “disproportionate”, it’s important to recognise that at the very heart of the RBA is that financial institutions must assess what is appropriate to the customer and risk level assessed. Most would also be subject to offshore regulation, which means that the measures adopted in Hong Kong may well be higher than what is strictly required under Hong Kong law.
Financial institutions are also entitled to set customer acceptance policies that address commercial needs and broader risk considerations. While it may sometimes seem otherwise, we are not yet at a point where banks and other financial institutions are public utilities.
2. Misconceptions clarified – HKMA FAQs issued
The HKMA swiftly followed the De-risking Circular with “Frequently Asked Questions on Customer Due Diligence” on 29 September 2016 (Account Opening FAQs). For seasoned practitioners, there was nothing earth-shattering here. At the same time, clearly misconceptions remain in the market, so this was timely.
The key messages included the following:
- Local business address and certificate are not mandatory – Not every company needs to have a Hong Kong business address or business registration certificate. Various locations can be used (hot-desks used by start-ups are cited as one example) and there may be legitimate reasons for not having a local presence or business registration.
- Provide options for address proof – Customers should be given options in relation to proof of address. Existing guidance provides numerous options. Narrow requirements that operate as a potential barrier to account opening are not appropriate.
- Be flexible (to the right degree) with start-ups and SMEs – These are not special categories of customers with specific requirements. The Hong Kong regime provides flexibility which should be used to differentiate due diligence requirements appropriately. Those requirements should reflect each customer’s operations, profile, risk level assessed and any other relevant considerations.
- Source of wealth should be appropriate – This information is not necessary in all cases – often, basic information to understand the purpose and intended nature of the business relationship is sufficient. It should also be appropriate: see our comments in paragraph 1 above.
- Be pragmatic on presence at account opening – Hong Kong does not mandate physical presence at account opening, but the Anti-Money Laundering and Counter-Terrorist Financing (Financial Institutions) Ordinance (Cap. 615) (AMLO) does impose enhanced due diligence standards when that does not happen. For a company, it is sufficient for one person who is acting on behalf of that company to be present for account opening. However, the usual standards in relation to identifying and verifying the identity and authority of all “persons purporting to act” on behalf of the company still apply.
The Account Opening FAQs also make clear that neither offshore certification nor the offshore residency of companies or their connected parties should be a fundamental barrier to account opening.
The HKMA also recently provided clarity on permanent identity cards in its “Complaints Watch” briefing on 8 July 2016. In summary, it confirmed that the three asterisks (***) on the card were not determinative of permanent residency and that their absence should not be used to require other identity documents. It stated that banks should ensure that staff are conversant with account opening requirements and the “proper way” for verifying customers’ identity to avoid inconvenience and over-collection.
3. Harnessing technology – further developments on the way
As flagged in the De-risking Circular, further measures are in progress to make account opening (and therefore financial inclusion) easier. These include:
- guidance on the use of technology as part of customer due diligence, in which King & Wood Mallesons has been actively involved; and
- know-your-customer (KYC) utilities, which aggregate customer information, documents and, in some cases, provide preliminary assessments on red flags and risk levels.
The HKMA also recently launched its “Fintech Supervisory Sandbox” initiative, which may pave the way for innovative solutions in the banking industry. See our alert on the Fintech Supervisory Sandbox.
4. SFC comes down hard on monitoring
The SFC has also been busy on AML/CTF investigations and risk management. Most recently, it issued a press release on 21 September 2016 following investigations into licensed brokerages.
The key pitfalls identified by the SFC included the following:
|Failure to scrutinise
- Third party deposits
|Ineffective transaction monitoring
- Transactions in customer accounts
|Inadequate relationship monitoring
- Failing to take measures to continuously monitor business relationships with higher risk customers
- Potentially suspicious transactions
- With sufficient documentation of assessment with respect to JFIU reporting
|Failure to monitor and supervise
- Ongoing implementation of AML/CTF policies and procedures
So is the SFC tougher on AML/CTF?
The tone of the SFC’s press release was clearly different to what appears to be a softening stance by the HKMA.
It is tempting to conclude that perhaps the SFC is taking a tougher line on licensed corporations and that the banks will receive an easier run. However, this is not the case. For example, the HKMA issued a detailed Guidance Paper on Transaction Screening, Transaction Monitoring and Suspicious Transaction Monitoring as far back as December 2013. It is currently giving a number of banks a tough run on enforcement, with some investigations lasting well over a year and involving costly remediation.
Admittedly, we are yet to see any significant enforcement outcomes. The last public HKMA enforcement on AML/CTF occurred over a year ago, in relation to State Bank of India. There has been nothing since from either the SFC or the HKMA, making it difficult to identify any real differences in approach. We expect some to be announced soon.
There is no doubt that the focus on policy, procedure, resources, infrastructure and training will remain at all regulatory levels.
However, the key trend we are seeing from the HKMA is an acknowledgment that Hong Kong must remain competitive in the global financial services market. And that means providing an environment for start-ups and SMEs in which they can function commercially…with a bank account.
There is a lot still to happen in 2016 – watch this space.