Why did DBS draw HK$10m, AIA HK$23m, UBS HK$8m and IBKR only HK$4.2m? Three regulators, three penalty formulas, one underlying logic: a statutory cap plus a weighted set of aggravating and mitigating factors. This piece reassembles the rules scattered across enforcement notices into one map — so you can see how a fine is actually computed.
1. The real structure of the cap: "10M or 3×"
All three regimes write the cap almost identically: HK$10m, or three times the profit gained / loss avoided, whichever is higher. The "3× limb" is the only way a fine clears ten million — AIA's HK$23m, FWD's HK$19.5m and EFG's HK$10.85m all came from that limb. Cases with no computable benefit (IBKR profited nothing from its bug) stay inside the HK$10m base and get tuned by factors.
So the first question when reading any fine is: was it computed on the base cap or the 3× limb? That alone tells you how much money the regulator thinks the firm made — or saved — by breaching.
2. How the weights actually play out
Stacking every case in this series, the factors behave roughly like this:
| Factor | Real case | Effect |
|---|---|---|
| Long breach period (top aggravator) | DBS 7 yrs → $10M cap; UBS 12 yrs → $8M | Each added year bends the curve upward |
| Systemic vs isolated | FWD "majority found by regulator" → systemic; Bright Smart's narrow rules → systemic | Systemic leaves almost no defence room |
| Self-reporting (strongest mitigator) | IBKR reported + fully compensated → $4.2M; UBS 2025 self-reported → fine fell below its 2021 one | Can more than halve the number |
| Remediation + cooperation + clean record | FWD's completed review earned mitigation; DBS remediated but seven years still hit the cap | Mitigation has a ceiling — it cannot buy back seven breach years |
3. The time dimension: the fine's lag
- Investigation-to-sanction lag runs 2–5 years: DBS finished remediating in 2019 and was fined in 2024; EFG's breach period ended 2020, fine landed 2025. "Fixed it" is not "finished".
- No sharp limitation clock: the FWD inspection covered 2012–2024 — twelve years. Regulators look back as far as they like; the five-year record-keeping floor may even leave you short of evidence for your own defence.
- The FATF 2029 macro-clock: Hong Kong's next mutual evaluation lands H2 2029 — expect AML inspection density and fine quantum across every regulator to keep rising until then. This is not a cycle; it is exam season.
4. Using the formula on yourself
A licensed corporation can run a penalty stress test: (breach duration × systemic degree) − (self-detection rate × reporting willingness) ≈ expected fine band. If most of your gaps surface in inspections rather than internally, you sit in FWD's cell; if you find it and report fast, you sit in IBKR's — and the spread between those cells can be an order of magnitude.
RegSir's take
Read across the whole series, penalty arithmetic is really a signalling game between regulator and industry: what regulators want is not revenue but a self-checking culture — which is why self-reporting carries the heaviest discount. The optimal industry strategy never changes: build systems that alarm on their own, then run the five-step sequence (stop, investigate, report, compensate, fix) faster than everyone else. IBKR settled a HK$586bn breach surface for HK$4.2m; UBS's second fine came in below its first. That is not luck — it is knowing how the formula scores.
5. Series index and official sources
This is the capstone of the Enforcement Files series — the full set:
| Article | Core issue |
|---|---|
| AIA + FWD fines | Two largest-ever IA fines, forged PPDs, split-cash holes |
| UBS repeat | 12-year PI misclassification; one root cause, two fines |
| HKMA AML ladder | Four fines in four years, the anonymous HK$16m, monitoring as the front line |
| EFG due diligence | Distributor PDD duty, two-regulator coordination |
| IBKR HK$586bn | A bug is a breach; the five-step remediation |
| Internal-control sweep | Bright Smart + Kylin — mid-tier enforcement |
| Personal liability | Fining individuals + criminal prosecution — the accountability pivot |
| Legislation | Link |
|---|---|
| Securities and Futures Ordinance (Cap.571) s.194 | elegislation.gov.hk ↗ |
| Anti-Money Laundering Ordinance (Cap.615) s.21 | elegislation.gov.hk ↗ |
| Insurance Ordinance (Cap.41) | elegislation.gov.hk ↗ |
| SFC — Disciplinary Fining Guidelines | sfc.hk ↗ |