Hong Kong SFC AML Requirements for Asset Managers

Our Hong Kong regulations page covers the AMLO framework across banks, insurers and licensed corporations and how the platform maps to it. This article goes one level down for one audience: fund managers, discretionary portfolio managers and the administrators and transfer agents that onboard investors for them. It follows the order in which the SFC's own Guideline is written, cites the paragraph numbers, and ends with a checklist.

Two points of orientation first. The HKMA and the SFC each publish a guideline on the same statutory base, so a Type 9 firm follows the SFC version, not the HKMA one. And the SFC Guideline is not advisory: paragraph 1.8 states that "must" and "should" both indicate a mandatory requirement, paragraph 1.10 makes it admissible in court and requires the SFC to have regard to it when deciding whether Schedule 2 has been contravened, and paragraph 1.11 says a failure to comply may reflect on fitness and properness and be treated as misconduct.

Most of the difficulty in applying the Guideline to asset management comes from one question: who is the customer? Paragraph 4.1.6 answers it for the securities sector. The customer is the client of the licensed corporation, as "client" is defined in Schedule 1 to the SFO. The table applies that to the relationships a manager actually has.

For a manager whose customers are funds, the practical consequence is that investor due diligence is governed by two provisions working together: the definition of beneficial owner (Schedule 2, s.1 and Guideline footnote 41) and the simplified due diligence rule for investment vehicles (s.4(3)(d)). The next two sections take them in turn. For the general principles see our guides to know your investor and the look-through approach.

Section 4 of Schedule 2 is the provision that decides how much investor work a manager, administrator or transfer agent must do when the customer is a fund, and how a distributor or platform is treated when it holds units for underlying clients. Chapter 4.8 of the Guideline explains it. See also our glossary entry on simplified due diligence.

• What is simplified. Under s.4(1) of Schedule 2 the firm may carry out only the measures in s.2(1)(a), (ab), (c) and (d), that is everything except the beneficial-owner measure, if it has reasonable grounds to believe the customer falls within s.4(3). The Guideline adds that all other aspects of CDD and ongoing monitoring remain (4.8.1 and 4.8.5).
• Who qualifies. An AMLO financial institution; an equivalent-jurisdiction institution carrying on a similar business, with similar measures and supervised for them; a corporation listed on any stock exchange; the Hong Kong Government or a public body, or an equivalent-jurisdiction government or public body; and an investment vehicle where the person responsible for carrying out CDD-like measures on all the investors is an AMLO financial institution, or a Hong Kong or equivalent-jurisdiction institution with similar measures that is supervised for compliance (s.4(3)(a) to (f)).
• Appointed institutions. The responsible person may be the vehicle itself or an institution it appoints, "such as a manager, a trustee, an administrator, a transfer agent, a registrar or a custodian" (Guideline 4.8.11). The firm must be satisfied that reliable systems and controls exist to conduct CDD on the underlying investors to a standard similar to Schedule 2.
• If no one qualifies. The firm must identify and take reasonable measures to verify the identity of any investor in the vehicle as a beneficial owner. It may consider a written representation from the vehicle or appointed institution stating, to its actual knowledge, who the investors are, depending on risk factors such as whether the vehicle is operated for a small, specific group; the representation must be documented and periodically reviewed (4.8.12).
• Equivalent jurisdiction means a FATF member other than Hong Kong, or a jurisdiction that imposes requirements similar to Schedule 2. For non-FATF members the firm must assess and document equivalence itself (4.19.1 and 4.19.2).
• Never when there is suspicion or doubt about previously obtained information (4.8.2).

A manager that wants the benefit of s.4(3)(d) for a fund it manages should be able to show, from its own file, who the responsible person is, why that person qualifies, how it satisfied itself about the systems and controls, and when it last checked. A manager that is itself the responsible person for a fund's investors should expect the fund's bank, broker and other counterparties to ask for exactly that evidence.

Fund managers rarely perform every CDD measure themselves. Section 18 of Schedule 2 and paragraphs 4.15 of the Guideline set the terms on which another institution's work can be used.

• Who can be an intermediary. Among others, an authorized institution, a licensed corporation, an authorized insurer or licensed insurance intermediary in Hong Kong; Hong Kong accounting and legal professionals, estate agents and TCSP licensees with adequate procedures; their regulated and supervised equivalents in an equivalent jurisdiction; and a related foreign financial institution covered by group policy and supervised at group level (Schedule 2, s.18(3) and (3A)).
• Conditions. The intermediary must consent in writing to act, and the firm must be satisfied that it will provide copies of documents and records on request without delay (s.18(1)). The firm must obtain the data or information immediately after the intermediary has carried out the measure (s.18(4)(a)).
• Liability stays with the firm. A firm that relies on an intermediary remains liable under the Ordinance for a failure to carry out that measure (s.18(2); Guideline 4.15.1).
• Not for monitoring, and not outsourcing. A firm cannot rely on an intermediary to continuously monitor the relationship (footnote 57), and reliance is distinct from outsourcing or agency, where the agent applies the firm's own procedures under its control (4.15.2).
• Evidence. Obtain an undertaking that the intermediary keeps the underlying CDD records for the relationship and at least five years after it ends, and run sample tests from time to time to confirm that records are produced on demand without undue delay (4.15.5 and 4.15.6).

The distinction in 4.15.2 matters for administrators: an administrator that applies the manager's procedures under the manager's control is an outsourced provider, and the manager's own controls govern. An administrator that applies its own procedures to its own client, the fund, is an intermediary under s.18. Both arrangements should be named as such in the agreement.

Section 5 of Schedule 2 imposes a continuous duty, and chapter 5 of the Guideline explains how the SFC expects it to be discharged.

• Review documents, data and information from time to time so that they stay up to date and relevant (Schedule 2, s.5(1)(a)). Reviews on a regular cycle and on trigger events; keeping information current does not mean re-verifying identities already verified unless doubts arise (Guideline 5.2 and footnote 82).
• High-risk customers must be reviewed at least annually, or more often if the firm considers it necessary (5.3).
• Scrutinise transactions for consistency with the firm's knowledge of the customer, its business, risk profile and source of funds (s.5(1)(b)). For a fund manager this covers subscriptions, redemptions, transfers and third-party payments into and out of the funds, and trading on managed accounts.
• Identify complex, unusually large or unusual-pattern transactions with no apparent economic or lawful purpose, examine their background and purpose and set out the findings in writing (s.5(1)(c)).
• Maintain systems and processes to monitor transactions, such as exception reports, with a degree of automation appropriate to the business (5.4). See our guides to transaction monitoring and how it works.

List every relationship the firm has: managed funds, segregated mandates, delegated and sub-advisory mandates, nominee and platform accounts, and distributors. For each, write down who the customer is under Guideline 4.1.6 and whether the firm or someone else performs CDD on the end investors.

Identify the person responsible for CDD on all investors (the fund, the manager, the administrator, the transfer agent). Record whether that person is an AMLO financial institution or a supervised Hong Kong or equivalent-jurisdiction institution, how you satisfied yourself about its systems and controls (4.8.11), and the date of the next review. Where no one qualifies, build the investor file as beneficial-owner files (4.8.12).

Where an administrator, distributor or group entity performs CDD for you, obtain the written consent and the undertaking to provide records on request, collect the CDD data immediately, and schedule sample tests. Keep ongoing monitoring in-house (s.18; 4.15).

Document the factors, obtain senior management approval, and align the simplified and enhanced measures in your procedures with Appendix C. Make sure non-Hong Kong PEP handling meets s.10 and that higher-risk jurisdiction lists are current.

Check seniority, independence, Hong Kong presence, access to records and cover for absence against 3.7, and that the MIC of AML/CFT appointment is consistent with the CO role.

Walk a subscription, a redemption to a third party and an unusual trading pattern from alert to decision. Confirm that findings are written up, that the MLRO route to the JFIU is documented and that the tipping-off controls are understood by staff.

Five years from the end of the relationship for CDD files, five years from each transaction for transaction records, with the ability to produce them swiftly to the regulator (8.2 and s.20).