Management Summary
- Purpose / Background: The HKMA has issued this circular to update regulatory expectations for remote individual customer on-boarding, necessitated by rapid technological advancements and the increasing prevalence of sophisticated fraud, including deepfake-driven impersonation and large-scale mule account networks.
- One-line conclusion: AIs and SVF licensees must conduct a comprehensive review of their remote on-boarding systems and adopt a proactive, intelligence-led risk-based approach to mitigate evolving AML/CFT threats.
- Key Changes:
- Updates and consolidates requirements from previous circulars (2019 and 2021).
- Shifts focus toward proactive, ongoing system recalibration to address AI-driven threats (e.g., deepfakes).
- Emphasizes the integration of threat intelligence shared by the HKMA and the Hong Kong Police Force into operational controls.
- Reinforces two core principles: (i) rigorous identity document authentication and (ii) incontrovertible identity matching.
- Encourages the adoption of "tiered" account functionality based on dynamic ML/TF risk assessment and customer behavior.
- Key Dates / Deadlines: Effective immediately (3 September 2026).
- Applicability / Impact scope: All Authorized Institutions (AIs) and Stored Value Facility (SVF) licensees in Hong Kong.
- Recommended management actions:
- Conduct an immediate comprehensive review of current remote on-boarding solutions.
- Incorporate the latest fraud and scam intelligence from the HKMA/HKPF into system designs.
- Implement continuous updates and recalibration programs for on-boarding technology.
- Evaluate the feasibility of implementing a tiered account structure to scale transaction limits based on risk.
- Ensure active senior management oversight of remote on-boarding performance and AML/CFT effectiveness.
Detailed Summary
1) Document overview
This circular updates the HKMA's requirements for remote customer on-boarding to align with the current ML/TF risk landscape. It supersedes the 2019 and 2021 circulars on the same subject while maintaining the validity of prior circulars concerning corporate on-boarding (2020) and thematic AML/CFT reviews (2020).
2) Main requirements
AIs and SVF licensees must ensure their remote on-boarding processes adhere to two fundamental principles:
- Identity Authentication: AIs must use technology to verify the genuineness of identity documents and ensure the reliability of data/information collected electronically.
- Identity Matching: Institutions must use appropriate technology to link the customer to their provided identity "incontrovertibly."
- Risk-Based Approach: Institutions are expected to design products using a tiered model, where account features, functionality, and limits are scaled dynamically based on the customer’s risk profile and ongoing behavioral patterns.
3) Key changes
- Focus on Evolving Threats: The policy now explicitly addresses risks posed by AI-driven automation, specifically deepfake technology and large-scale impersonation.
- Intelligence-Led Controls: Institutions are now formally expected to leverage intelligence provided by the HKMA and the Hong Kong Police Force to ensure their systems remain effective against current modus operandi.
4) Important dates & transition
- Effective Date: 3 September 2026.
- Transition: Ongoing; institutions are expected to integrate these requirements into their current AML/CFT program immediately.
5) Impact and risks
- Operational/IT: Requires continuous investment in upgrading verification technology to counter "sophisticated tactics" like deepfakes.
- Compliance: Increased expectation for proactive system recalibration rather than static compliance.
- Strategic: Potential shift toward dynamic/tiered account management to balance user experience with heightened risk controls.
6) Compliance action checklist
- [ ] Review current remote on-boarding technology against the two core principles (Authentication & Matching).
- [ ] Update internal AML/CFT manuals to include intelligence-sharing protocols with HKMA/HKPF.
- [ ] Assess system capabilities for "tiered" account functionality.
- [ ] Brief senior management on the results of the comprehensive system review.
7) Appendices/attachments summary
N/A (No appendices provided in the source text).