AML / Financial Crime in Hong Kong

Key dates

13 July 2017 – 18 February 2022

- Period during which Stephen Chiu was MIC of Key Business Line, Operational Control and Review, and Overall Management Oversight at Victory

29 October 2019

- The client opened an account at Victory Securities, declared a financial profile, and expressed intention to sell securities held with another brokerage

Shortly after 29 October 2019

- The client placed two sell orders through Victory and provided statements purportedly issued by other brokerages as proof of his holdings in the relevant shares

1 April 2020 – 18 February 2022 Deadline

- Period during which Stephen Chiu was MIC of Compliance and Anti-Money Laundering and Counter-Terrorist Financing at Victory

1 October 2024

- Stephen Chiu resumed his role as MIC of Overall Management Oversight at Victory

Suggested considerations

• Review and update client onboarding procedures to ensure that inconsistencies between clients’ declared financial profiles and claimed asset holdings are systematically identified, documented, and escalated for enhanced due diligence before any orders are executed.
• Implement controls requiring independent verification (e.g. direct confirmation or reliable third‑party checks) of statements and documents purportedly issued by other brokers when these are used to evidence holdings for sell orders.
• Update AML/CFT policies and procedures under AMLO and the SFC Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations) to explicitly cover handling of suspected forged documents and false information supplied by clients.
• Establish or reinforce a formal process for promptly reporting suspected fraudulent, deceptive, or market abusive conduct by clients to the SFC, and where appropriate to JFIU, including clear internal thresholds, escalation paths, and record‑keeping.
• Conduct a gap analysis of existing red flag indicators to ensure they cover situations where the size or nature of client holdings is incommensurate with the client’s stated income, net worth, occupation, or overall risk profile.

What changed

• (Strictly speaking this is an enforcement case rather than a rule change, but it effectively clarifies regulatory expectations and evidences enforcement priorities.)
• Licensed corporations must treat discrepancies between a client’s declared financial profile and purported asset holdings as material red flags, triggering enhanced KYC,...
• Firms must independently verify documents purportedly issued by other brokers, especially when used as proof of holdings for sell orders, and must not rely on such documents at face value when they...
• Licensed corporations are expected to apply risk-based AML/CFT controls to securities sell orders where there is a risk that the client may not beneficially own the assets, or where forged/false...
• Firms must report suspected fraudulent or deceptive conduct by clients to the SFC (and, where applicable, to JFIU) without delay, even where the misconduct appears confined to a single transaction or...

Key dates

10 July 2026

– SFC publication date confirming the 17th high‑level enforcement cooperation meeting between the SFC and CSRC in Hong Kong and the focus on cross‑boundary enforcement and enhanced information exchange

Suggested considerations

• Review existing cross‑boundary business models, trading flows and client bases to identify areas where misconduct or control failures could trigger coordinated enforcement action by both the SFC and CSRC.
• Update enforcement‑facing compliance risk assessments to reflect heightened cross‑boundary enforcement cooperation, including the possibility of information sharing and parallel investigations by both regulators.
• Enhance incident escalation and regulatory engagement protocols to ensure that potential cross‑boundary issues (e.g. market manipulation, insider dealing, cross‑border fraud) are promptly identified and addressed with both Hong Kong and Mainland regulators where relevant.
• Review and, where necessary, strengthen surveillance and market‑abuse monitoring tools to capture cross‑market patterns (e.g. trading in Hong Kong linked to events or positions in Mainland markets).
• Ensure record‑keeping, trade data, client information and cross‑border communication logs are complete, accurate and retrievable, given the regulators’ focus on improving information exchange.

What changed

• - The SFC and CSRC reinforced their commitment to joint enforcement cooperation specifically targeting cross‑boundary crimes and misconduct that affect both Hong Kong and Mainland Chinese markets.
• Both regulators agreed to deepen discussions and coordination around recent major cross‑boundary enforcement cases, indicating more systematic case‑level collaboration and mutual assistance.
• The authorities explicitly prioritised enhancing mechanisms for information exchange, implying more frequent, timely and possibly more granular sharing of regulatory, supervisory and investigative...
• The meeting confirms that cross‑boundary enforcement and investor protection remain strategic enforcement priorities for both the SFC and CSRC, which will likely influence case selection, resource...
• The emphasis on improving enforcement effectiveness and deterrence signals a likely increase in coordinated investigations, simultaneous actions, and potential parallel sanctions in both...

Key dates

19 February 2025

- SFC issues its ASPIRe roadmap, with “Access” identified as one of five pillars and VA regulatory expansion flagged as a strategic priority

27 June 2025

- Consultation papers published on legislative proposals to regulate VA dealing and VA custodian service providers, setting the broader perimeter for VA intermediaries

24 December 2025

- Consultation conclusions issued on legislative proposals to regulate VA dealing and VA custodian service providers, confirming direction for those regimes

24 December 2025

- FSTB and SFC launch further consultation on VA advisory and VA management regimes, which has now concluded

2026 (TBD – bill introduction)

- FSTB and SFC aim to introduce a bill into the Legislative Council to establish VA advisory and VA management regimes under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615)

Suggested considerations

• Conduct a gap analysis comparing current or planned virtual asset advisory and management activities against Type 4 and Type 9 requirements under the Securities and Futures Ordinance to identify where equivalent capabilities, controls and governance will be required under the new VA regimes.
• Map all group entities and business lines that provide VA-related advice, research, recommendations or portfolio management to clients in or from Hong Kong, and determine which entities will need licensing or authorisation under the forthcoming AMLO-based regimes.
• Initiate early engagement with the SFC (e.g. via pre-application meetings or WINGS enquiries) to clarify how existing licences, business models and cross-border arrangements will be treated under the new VA advisory and management regimes.
• Review and, where necessary, enhance AML/CTF frameworks, including customer due diligence, transaction monitoring, sanctions screening and ongoing review procedures, to ensure they are robust enough for VA-specific risks anticipated under AMLO-based regulation.
• Update internal policies and procedures on suitability, product due diligence, risk disclosure, conflicts of interest and best execution to explicitly cover VA advisory and VA management services in line with standards applied to traditional securities and funds.

What changed

• - The Hong Kong Government and SFC have confirmed that dedicated regulatory regimes for VA advisory services and VA management services will be created under the Anti-Money Laundering and...
• The regulatory scope and standards of the VA advisory regime will be aligned with Type 4 “advising on securities” regulated activity under the Securities and Futures Ordinance, applying a “same...
• The regulatory scope and standards of the VA management regime will be aligned with Type 9 “asset management” regulated activity under the Securities and Futures Ordinance, implying broadly...
• The consultation received broad market support across 51 responding stakeholders, and the SFC has treated this as a mandate to proceed to finalisation of the detailed legislative proposals and...
• The new VA advisory and management regimes will sit alongside existing and proposed VA regimes for: VA trading platforms, stablecoin issuers, VA dealing and VA custody, forming an end-to-end...

Key dates

August 2018

July 2021; Period of Kylin's violations

Late 2020

SFC limited review prompted Kylin's remedial measures

31 December 2023

Kylin ceased regulated activities

9 October 2024

SFC circular on private fund deficiencies (immediate reference for remediation)

22 January 2025

SFC revoked Kylin's Type 9 license (following application)

Suggested considerations

• Conduct gap analysis: Review private fund operations against five failure areas (conflicts, reconciliations/valuations/audits, KYC/suitability, AML/CTF records, investor representations) using FMCC and 9 Oct 2024 circular.
• Enhance systems/controls: Implement monthly asset reconciliations, independent audits, automated KYC/suitability tools, and conflict registers; ensure AML/CTF records are audit-ready.
• Senior management oversight: ROs/MICs to document personal accountability; train on self-reporting breaches (Code of Conduct para 12.5).
• Investor communications: Cease any claims of suitability exemptions for professional investors; update disclosures.
• Remediation evidence: Like Kylin, document post-review fixes to mitigate sanctions.

What changed

• This is an enforcement action, not a new rule change, but it reinforces and exemplifies existing obligations under the Securities and Futures Ordinance (SFO), Fund Manager Code of Conduct (FMCC), and...
• Mandatory conflict management and disclosure: Firms must identify, manage, and disclose conflicts, e.g., loans from the manager or directors to funds.
• Asset reconciliation and valuation: Monthly reconciliations, regular valuations, and independent audits of fund financials are required.
• KYC/suitability assessments: Adequate systems/controls for client due diligence and suitability, even for professional investors (no blanket exemptions).
• AML/CTF compliance: Records must demonstrate ongoing adherence; misrepresentations to investors on exemptions are prohibited.