Start with the firm and the customer relationship
A file marked “KYC complete” can still leave the beneficial owner unclear, a screening hit unexplained or a review overdue. For a Hong Kong licensed firm, the first step is to identify which entity owns the customer relationship and which requirements apply to it.
The Securities and Futures Commission (SFC) supervises licensed corporations, including licensed asset managers and securities brokers. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), particularly Schedule 2, sets customer due diligence (CDD) and record-keeping requirements. The SFC’s AML/CFT Guideline explains the relevant statutory and regulatory requirements and standards.
This guide focuses on customer and investor KYC for SFC-licensed corporations. The SFC guideline also covers SFC-licensed virtual asset service providers, with additional virtual-asset requirements in Chapter 12. Banks start with the Hong Kong Monetary Authority (HKMA) framework for authorised institutions. Paragraph 1.6 identifies SFC provisions that registered institutions must also consider for securities-sector business.
A Hong Kong manager and an offshore fund need separate regulatory assessments. Identify the customer under paragraph 4.1.6 and the actual business arrangement before deciding whose CDD belongs in the manager’s file. An administrator holding investor documents does not, by itself, settle that question.
If you already have an approved policy and need help working the cases, our Hong Kong KYC services cover onboarding, remediation and periodic reviews.
Read the SFC guideline as a regulatory standard
The paragraph references below use the SFC guideline edition dated 1 June 2023. The 24 May 2023 circular explains changes to PEP definitions, trust beneficial ownership and recognised digital identification systems, as well as the new virtual-assets chapter. Most amendments took effect on 1 June 2023; paragraphs 12.11.10 and 12.11.13 took effect on 1 January 2024.
Check the SFC’s AML/CFT circulars alongside the guideline before relying on a saved copy. Sanctions and other applicable requirements can change without a new edition of your KYC checklist.
Paragraph 1.8 says that both “must” and “should” indicate a mandatory requirement in the guideline. Treating every “should” as optional would misread the document. Paragraph 1.4 explains that compliance is enforced through AMLO and the Securities and Futures Ordinance.
The file-management suggestions in this article are AgentKYZ’s recommendations. They are not an SFC-issued checklist or an endorsement of our service.
Build customer due diligence around evidence
Chapter 4 covers customer identification and verification, beneficial owners, people acting on a customer’s behalf, and the purpose and intended nature of the relationship. Apply the relevant timing rules before establishing the relationship; delayed verification is subject to specific conditions.
For operational review, we recommend an indexed file showing:
- The customer’s identity and the reliable, independent documents, data or information used to verify it.
- The identity and authority of anyone acting on the customer’s behalf.
- Ownership and control, including the relevant beneficial owners and supporting evidence.
- The purpose of the relationship, expected activity and documented customer risk assessment.
- Screening results, any enhanced measures and the approvals or unresolved issues affecting acceptance.
Record the basis for simplified due diligence where it is permitted. A “professional investor” classification addresses a different regulatory question and should not become an undocumented exemption from AML checks.
An unresolved CDD failure cannot simply remain in the backlog indefinitely. Paragraph 4.17.1 requires a firm unable to complete CDD in accordance with the specified timing provisions to avoid establishing the relationship, or to terminate an existing relationship as soon as reasonably practicable. The firm must also assess whether the failure gives grounds for knowledge or suspicion and report where required. Escalate those cases to the responsible compliance team promptly.
Trace beneficial ownership beyond the percentage test
For corporate customers, paragraph 4.3.6 includes an individual who owns or controls more than 25% of issued share capital, controls more than 25% of voting rights, or exercises ultimate control over management. It also covers a corporation acting on behalf of another person. A shareholder register alone may not show who controls a layered structure.
Paragraph 4.3.9 requires identification and reasonable measures to verify the relevant natural persons. If no natural person falls within the applicable beneficial-owner definition, the guideline requires identification and reasonable verification of the relevant senior managing officials. Document how you reached that conclusion; “no shareholder above 25%” does not resolve the control test.
Trusts use a different analysis. Paragraphs 4.3.10 and 4.3.11 address the settlor, trustee, protector or enforcer where applicable, beneficiaries or classes of beneficiaries, and anyone exercising ultimate control. The 2023 amendments removed the previous 25% threshold in the trust beneficial-owner definition. Do not carry the corporate percentage test into a trust checklist.
In practice, link each step in the ownership chart to a source document. Where the evidence stops, record the gap and the person responsible for resolving it.
Apply enhanced due diligence and PEP controls
Paragraph 4.9 addresses high-risk situations. Paragraph 4.11 sets requirements for politically exposed persons (PEPs), with distinctions between non-Hong Kong PEPs, Hong Kong PEPs and international organisation PEPs. The relevant controls include senior management approval, establishing source of wealth and source of funds, and enhanced monitoring as applicable.
Since the 2023 changes, the non-Hong Kong PEP definition concerns prominent public functions outside Hong Kong, rather than outside the People’s Republic of China. A mainland public function can therefore fall within the non-Hong Kong category. Former PEP status also needs the prescribed risk assessment; it should not automatically clear a screening result.
Source of wealth concerns how a person accumulated their wealth. Source of funds concerns the money used in the relationship or transaction. A transfer receipt may establish where a payment came from while leaving the origin of the wealth unexplained. Keep the customer’s account of their wealth separate from the evidence used to assess it, and document inconsistencies for the approver.
Screening also needs to support applicable sanctions and terrorist-financing controls under Chapter 6. A reviewer should record why a potential match was cleared or escalated. An adverse-media result is information for assessment, not proof of wrongdoing.
Set periodic reviews and respond to trigger events
Paragraph 5.2 requires regular and/or trigger-event reviews of existing CDD records, supported by clear policies on review frequency and triggers. High-risk customers need at least an annual review under paragraph 5.3, with more frequent reviews where necessary.
For other customers, set a risk-based schedule under the applicable requirements and your policy. A change in ownership, doubts about existing evidence or new adverse information may require attention before the next scheduled review. Footnote 82 explains that keeping information current does not mean re-verifying an identity already verified, unless doubts arise about the earlier information.
A periodic KYC refresh also leaves ongoing transaction monitoring to address. Paragraph 5.1 requires scrutiny of transactions against the firm’s knowledge of the customer, business, risk profile and source of funds. Chapter 11 separately addresses third-party deposits and payments, a relevant control area for securities firms.
For a remediation tracker, record the risk rating, last review, next due date, trigger, evidence gaps and case owner. Give urgent risk escalations their own route rather than waiting for the normal document-follow-up cycle.
Separate KYC outsourcing from third-party reliance
Paragraph 4.15.2 distinguishes outsourcing or agency relationships from reliance on an intermediary. In an outsourcing arrangement, the provider applies CDD on the firm’s behalf, under its procedures and control. In a reliance arrangement, the intermediary usually has its own customer relationship and applies its own procedures.
Reliance is subject to AMLO Schedule 2 section 18 and the conditions in paragraph 4.15. These include an eligible intermediary, written confirmation of its role, immediate receipt of the relevant CDD data or information, and access to supporting documents without delay. Ultimate responsibility remains with the firm. Reliance on an intermediary does not extend to continuous monitoring of the customer relationship.
Before appointing a provider, have compliance or counsel confirm the arrangement and its conditions. Agree the policy version, evidence requirements, access to records and escalation responsibilities. Test retrieval of actual files, including the documents and reasoning behind a “complete” status.
Our managed KYC service in Hong Kong performs the agreed operational work under your approved policy. Shadow KYC is a separately scoped review of files already held by an administrator or another provider. Neither transfers the firm’s regulatory responsibility, and file testing alone does not replace an independent audit of the wider AML/CFT programme.
Keep records for the right period and escalate suspicion
Paragraphs 8.3 and 8.4 require the specified CDD records to be kept throughout the customer relationship and for at least five years after it ends. Paragraphs 8.5 and 8.6 require transaction records for at least five years after the transaction completes. Paragraph 8.8 permits a regulator to require longer retention in specified circumstances.
Closing a remediation task does not start either retention clock. Preserve the underlying documents, risk assessments and relevant analysis so authorised reviewers can reconstruct the work. Access and retrieval arrangements matter when records sit with a service provider.
Chapter 7 covers suspicious transaction reporting to the Joint Financial Intelligence Unit (JFIU), internal escalation and controls against tipping off. Suspected money laundering or terrorist financing needs prompt attention through the designated reporting process. Routine customer follow-up must not disclose information that could prejudice an investigation.
For Hong Kong managers of Cayman funds, assess the fund’s obligations alongside the manager’s. Our CIMA AML Rule guide explains the separate Cayman framework. To scope work on your Hong Kong cases, bring the entity type, case count and target date to our Hong Kong KYC services team.