1. The five CDD measures (Schedule 2, s.2)
Customer Due Diligence is more than "collect an ID" — Schedule 2 lists five things to identify and verify:
- The customer's identity — reliable independent source documents (ID card, passport, corporate registration papers)
- The beneficial owner — for legal entities, trace through layers to the natural person(s) ultimately in control (generally ≥25% ownership or actual control)
- Persons purporting to act (PPTA) — e.g. authorised persons placing orders for the client
- Connected parties — directors of corporate customers, etc.
- Purpose and intended nature of the relationship — not a formality: genuinely knowing why the account exists (long-term investing? day trading? acting for others?)
2. When CDD is triggered (s.3)
Before establishing any business relationship — "open now, documents later" is a red line
Before single or linked transactions of HK$120,000 or more
Any suspicion of money laundering or terrorist financing, regardless of amount
When previously obtained identity information turns out inconsistent or stale
3. SDD vs EDD — the two ends
| SDD — Simplified | EDD — Enhanced | |
|---|---|---|
| When | Specified lower-risk situations (e.g. certain regulated financial institutions as customers, designated products) | Higher risk: foreign PEPs, FATF-called high-risk jurisdictions, complex or unusually large transactions, high-risk non-face-to-face onboarding |
| What | Some verification steps may be waived — but the customer must still be identified | Extra documents/verification, source of wealth and source of funds, senior management approval, enhanced ongoing monitoring |
| Red line | Any ML suspicion kills SDD instantly. "The client is a listed company, so we went light" is an enforcement repeat offender. | |
4. PEP tiers — not all treated alike
- Foreign PEPs — always EDD: senior management approval + establish source of wealth and funds + enhanced monitoring
- Domestic PEPs (Hong Kong officials) and international-organisation PEPs — risk-assess first; EDD only if rated high risk
- PEP family members and close associates — equally within scope
- Former PEPs don't "graduate" automatically — the guideline requires a risk-based judgement; don't set your own expiry date
5. Ongoing monitoring + record-keeping
- Ongoing monitoring (s.5): transactions must stay consistent with what you know of the client — a "long-term investor" day-trading large sums needs enquiry; refresh CDD data periodically
- Record-keeping (s.20): transaction records, CDD files, verification data — at least 5 years after the relationship ends
- Anonymous accounts (s.16): anonymous, numbered or fictitious-name accounts are prohibited
6. Suspicious transaction reports (STR)
Spot something suspicious — file an STR to the Joint Financial Intelligence Unit (JFIU) via the STREAMS system. The duty comes from the Organized and Serious Crimes Ordinance (Cap.455), the Drug Trafficking (Recovery of Proceeds) Ordinance (Cap.405) and the United Nations (Anti-Terrorism Measures) Ordinance (Cap.575) — failing to report is itself a criminal offence, with imprisonment on conviction.
7. Official sources
| Document | Link |
|---|---|
| Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap.615), incl. Schedule 2 | elegislation.gov.hk ↗ |
| SFC AML/CFT pages (guideline, circulars, FATF list updates) | sfc.hk ↗ |
| Joint Financial Intelligence Unit (JFIU) — STREAMS reporting | jfiu.gov.hk ↗ |
| FATF standards and high-risk jurisdiction lists | fatf-gafi.org ↗ |
8. FAQ
Small firm, no budget for a dedicated MLRO?
The law requires a designated officer for AML reporting — small firms typically have an RO or compliance head double-hat the role, but the responsibility must be documented with real authority. "Too small to do it" is not a defence.
Do stale CDD documents need refreshing?
Ongoing monitoring requires data kept current — high-risk clients get periodic reviews; low-risk can run longer cycles, but trigger events (address change, pattern shift) force an immediate update.
How does eKYC / remote onboarding fit CDD?
Schedule 2 doesn't ban non-face-to-face onboarding, but it must use an approach acceptable under Code of Conduct paragraph 5.1 plus the extra safeguards — see the Remote Account Opening guide.
Can we keep trading for a client after filing an STR?
Yes — the law doesn't force termination — but on a risk-assessed basis. Continuing to process suspicious funds without reasonable explanation can itself be a money-laundering offence. Document the decision; when unsure, ask counsel.