The IA's Twin Giants: AIA HK$23m & FWD HK$19.5m

The two largest fines in Insurance Authority history landed two years apart: AIA International was fined HK$23 million in August 2024, then FWD Life (Bermuda) HK$19.5 million in September 2026. Both were AML failures — and the FWD decision reads almost like a textbook on how not to verify sources of premium.

1. What the two cases got wrong

AIA (HK$23m, 2024): described by the IA as its largest-ever AML inspection. The failures centred on PEP screening and suspicious-transaction monitoring — missing beneficiary data broke downstream customer screening outright. The breach period ran 2013–2021, eight years.

FWD (HK$19.5m, 2026): a routine inspection launched 2023 covering April 2012 – September 2024 — over twelve years. The findings were almost three-dimensional:

• Forged draft declarations: of 129 sampled premium bank drafts (HK$400k–4.7m each), 126 carried customer-signed "Premium Payment Declaration" forms — yet 68 were not actually purchased by the signatory. More than half of the large-payment "declarations" were false.
• Split-cash blind spot: throughout 2022 there was no procedure to review split-cash premium payments — 306 policies were never examined. Under regulatory direction, a look-back found HK$23.8m paid by unknown third parties, later reported to the JFIU.
• System design holes: a system flaw meant 100+ transaction-monitoring alerts were never generated at all.
• Eight years of PEP-screening vacuum: from April 2012 to November 2020, missing beneficiary data on trust and corporate policies made PEP screening ornamental — 58 PEPs missed in total, including 7 foreign PEPs, with no EDD and no senior sign-off.

2. Why it is controversial

• Self-declaration is not verification: the PPD form exists so the customer tells the insurer "the money is mine" — a 68/126 forgery rate proves the paper alone is worthless. The IA's position: large payments need independent verification. That line hits industry practice directly.
• Brokers are not "just filling forms": the IA stated plainly that a broker who fills in a PPD or arranges large payments for a client is part of the process. Administrative help can now become compliance liability.
• Most breaches were regulator-found, not self-found: the IA stressed that a majority of FWD's breaches were identified by the regulator rather than the company — the self-checking machinery simply did not work.
• The FATF countdown: Hong Kong's next FATF mutual evaluation lands in H2 2029 — every financial regulator is expected to show enforcement muscle beforehand. The timing of the two record fines is no coincidence.

3. The legal and regulatory analysis

Worth noting is the mitigation arithmetic: FWD earned reductions for full cooperation, no prior AMLO record, and remediation (including a completed review confirming no ineligible customer was wrongly covered) — a textbook lesson in post-breach damage control.

4. Compliance takeaways

• Large payments cannot run on self-declaration: PPD-style forms need independent verification (draft issuance records, bank confirmation), not just a signature
• Split payments are a red flag: the same customer splitting premiums into smaller payments is the classic large-declaration dodge — systems need aggregation logic
• Beneficiary data is the foundation of downstream screening: gaps at intake = PEP screening fails wholesale — data quality at the point of sale is compliance quality
• Broker level: before filling a PPD or arranging third-party payments, recognise you are already "in the process" — verify, document, or decline; never sign blind

5. Official sources and reports