Hong Kong AML Compliance, End to End
Built for institutions regulated in Hong Kong — Authorised Institutions under HKMA, SFC-licensed corporations, Stored Value Facility issuers, and Trust or Company Service Providers — under AMLO Cap. 615 and the supervisor-specific guidelines that elaborate it.
A Multi-Supervisor Regime, One Underlying Statute
Hong Kong's anti-money-laundering framework is anchored in the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) — usually shortened to AMLO. The Ordinance sets out the core CDD, recordkeeping, and reporting obligations, but is administered by different supervisors depending on the type of regulated entity.
The Hong Kong Monetary Authority (HKMA) supervises Authorised Institutions — licensed banks, restricted licence banks and deposit-taking companies — and licensed Stored Value Facility issuers. The Securities and Futures Commission (SFC) supervises licensed corporations, including the new Virtual Asset Trading Platform regime that brings retail crypto exchanges into regulation. The Insurance Authority covers insurance entities, the Companies Registry oversees Trust or Company Service Providers (TCSPs), and the Customs and Excise Department supervises money service operators and dealers in precious metals and stones.
Each supervisor publishes its own AML/CFT Guideline — built on the same AMLO foundation but tailored to the sector's risk profile. Reports of suspicion are filed to the Joint Financial Intelligence Unit (JFIU), the Hong Kong Police–Customs joint unit that receives suspicious transaction reports for Hong Kong.
AMLO Plus Supervisor-Specific Guidelines
Different parts of AMLO and different supervisor guidelines apply depending on your licence. One Constellation maps to whichever combination governs your firm.
Anti-Money Laundering Ordinance
The foundational statute — sets out CDD, recordkeeping, and reporting obligations. Schedule 2 prescribes the core CDD requirements; the Drug Trafficking (Recovery of Proceeds) Ordinance and OSCO sit alongside as the predicate-offence framework.
HKMA AML/CFT Guideline
The HKMA's binding guidance for Authorised Institutions — covering risk assessment, CDD, EDD, ongoing monitoring, sanctions, and the appointment of a Compliance Officer and Money Laundering Reporting Officer.
SFC AML/CFT Guideline
The SFC's binding guidance for licensed corporations — the same operating principles as HKMA's, calibrated to securities and asset-management activities, plus specific provisions for Virtual Asset Trading Platforms.
SVF Licensing Guideline
Operating requirements for Stored Value Facility licensees — including AML obligations, customer protection, and prudential standards. Covers e-wallets, prepaid cards, and digital-money issuers.
VATP & Virtual Asset Service Providers
The SFC licensing framework for Virtual Asset Trading Platforms serving retail customers — bringing crypto exchanges into the same AML regime as traditional licensed corporations, plus FATF Travel Rule obligations.
Offence, CFT & Sanctions Statutes
The Drug Trafficking (Recovery of Proceeds) Ordinance, Organized and Serious Crimes Ordinance and United Nations (Anti-Terrorism Measures) Ordinance define the money-laundering and terrorist-financing offences and the duty to report suspicion. UN sanctions are given effect through regulations under the United Nations Sanctions Ordinance (Cap. 537).
What HKMA & SFC Require — and How We Address It
Across HKMA and SFC guidelines the same operating obligations recur. Here are the seven the Hong Kong supervisors examine most closely.
Risk-Based Approach & Risk Assessment
Conduct an institution-wide risk assessment and assign each customer a risk rating reflecting geography, product, channel, and behavioural risk.
Customer Due Diligence (Schedule 2 AMLO)
Identify and verify every customer at onboarding using reliable, independent sources. For corporates, identify beneficial owners holding more than 25% of the shares or voting rights, or exercising ultimate control.
Enhanced Due Diligence
Apply EDD to non-Hong Kong PEPs, to Hong Kong and international-organisation PEPs where the relationship presents a high risk, to customers from higher-risk jurisdictions, and any customer presenting elevated risk under the institution's methodology.
Ongoing Transaction Monitoring
Monitor customer transactions on an ongoing basis. Detect activity inconsistent with the customer's expected behaviour or risk profile and investigate it.
Sanctions Screening (UN, Cap. 537 & UNATMO)
Screen every customer and counterparty against UN Security Council lists given effect in Hong Kong under the United Nations Sanctions Ordinance (Cap. 537) and UNATMO, plus other applicable global sanctions regimes.
STR Filing to JFIU
File a Suspicious Transaction Report to the Joint Financial Intelligence Unit (JFIU) as soon as suspicion is formed under DTROP, OSCO, or UNATMO.
CO & MLRO Function + Recordkeeping
Appoint a Compliance Officer and an MLRO. Retain all CDD records, transaction records, and STR documentation for at least five years from the end of the customer relationship.
HKMA and SFC Enforcement Is Active
Hong Kong supervisors have demonstrated willingness to fine, censure, and revoke licences for AML control failures — alongside criminal liability under AMLO and the predicate-offence statutes.
What HKMA & SFC-Aligned Compliance Looks Like
Common Questions
Related Guides
Hong Kong’s obligations sit on the same FATF spine as the other major centres. These guides cover the controls the AMLO and the supervisor guidelines require.
Suspicious Transaction Reporting — the internal path from alert to filing, the tipping-off prohibition, and the record a supervisor expects for reports not filed.
Correspondent Banking Due Diligence — the Wolfsberg CBDDQ and the respondent due diligence expected of a major correspondent centre.
PEP Categories and RCAs — the three PEP categories and the relatives and close associates that enhanced due diligence extends to.
The supporting controls are customer due diligence, transaction monitoring, PEP screening and STR filing.
Hong Kong Compliance, Done Properly
See the AMLO workflows, HKMA and SFC Guideline coverage, JFIU STR export, and VATP-ready crypto controls live — with the actual evidence trail your supervisor expects.
