1. The rule: paragraph 5.1 of the Code of Conduct
Paragraph 5.1 of the Code of Conduct for Persons Licensed by or Registered with the SFC requires intermediaries to "take all reasonable steps to establish the true and full identity of each of their clients". The SFC's Acceptable Account Opening Approaches page (last updated 2025-05-30) sets out six recognised approaches — which one applies depends on whether the client is in Hong Kong or overseas, individual or institutional.
2. The six accepted approaches
Approach 1: In-person execution
Account-opening documents are executed in the presence of an employee of the licensed person or registered institution. The most direct route — no additional verification required.
Approach 2: Third-party verification
Execution of the client agreement and sighting of identity documents may be performed by:
- Other licensed persons or registered institutions
- An affiliate of the licensed person or registered institution (the SFC expects it to be a regulated financial institution)
- A Justice of the Peace
- Professionals: a branch manager of a bank, certified public accountant, lawyer, notary public, chartered secretary (full member of the Chartered Governance Institute)
Approach 3: Recognised electronic certification services
Using certification services recognised under the Electronic Transactions Ordinance (Cap. 553) — e.g. Hongkong Post recognised certificates ("iAM Smart" e-certs, ID-Cert Class Twelve). Certificates from overseas certification authorities granted mutual recognition status by the HKSAR Government are also accepted.
Approach 4: Cheque + document verification
The client submits a signed client agreement plus copies of identity documents, and the intermediary obtains a cheque drawn on the client's account with a licensed Hong Kong bank (not less than HK$10,000, bearing the name shown on the identity documents) and clears it. The cheque signature must match the agreement signature; the account stays unusable until the cheque clears.
Approach 5: Online opening via designated bank account
- Electronically signed client agreement + copies of identity documents
- Initial deposit of not less than HK$10,000 transferred from a designated bank account held with a licensed Hong Kong bank
- All subsequent deposits and withdrawals must go through the designated bank account(s) — more than one may be designated, but each must complete verification
- Full records kept throughout, available for compliance inspection and audit
If the intermediary did not obtain sufficient remitter information from the receiving bank, it must obtain evidence from the client that the transfer indeed came from their account.
Approach 6: "iAM Smart" / "iAM Smart+"
The identity-verification functions of "iAM Smart" and "iAM Smart+" are both accepted for verifying client identity when establishing business relationships online.
3. Overseas clients: the eligible jurisdictions list
Approach 7 (officially grouped under remote procedures): overseas individual clients may open accounts remotely — provided their first and ongoing fund transfers go through a bank account opened in an eligible jurisdiction. The basis is the 2019-06-28 Circular to intermediaries on establishing business relationships with overseas individual clients through remote onboarding procedures.
The SFC compiled the list with reference to FATF mutual evaluation results and updates it from time to time. Removal of a jurisdiction has no retroactive effect — accounts already opened are unaffected.
- Argentina
- Australia
- Austria
- Belgium
- Brazil
- Canada
- France
- Germany
- Greece
- India
- Indonesia
- Ireland
- Israel
- Italy
- Japan
- Korea
- Luxembourg
- Malaysia
- Netherlands
- New Zealand
- Norway
- Portugal
- Saudi Arabia
- Singapore
- South Africa
- Spain
- Sweden
- Switzerland
- Türkiye
- United Kingdom
- United States
4. Compliance checklist
- First determine client type: HK individual / overseas individual / institution (the cheque approach is not available for institutions)
- Choose an accepted approach and record the basis in your procedures
- Remote overseas: check the client's bank-account jurisdiction against the 31-jurisdiction list (use the version in force on the opening date; retain a screenshot)
- Designated bank account: first transfer ≥ HK$10,000; subsequent fund movements locked to that account
- Record-keeping: opening-process records must be available for compliance inspection and audit at any time
- Periodic review: list updates, changes to the HK$10,000 threshold, new recognised certificate classes
5. Official sources
| Document | Link |
|---|---|
| Acceptable Account Opening Approaches (topic page, updated 2025-05-30) | sfc.hk ↗ |
| List of eligible jurisdictions for remote onboarding of overseas individual clients | sfc.hk ↗ |
| Circular to intermediaries: establishing business relationships with overseas individual clients through remote onboarding (2019-06-28) | SFC circular portal ↗ |
| Electronic Transactions Ordinance, Cap. 553 (legal basis for recognised certificates) | elegislation.gov.hk ↗ |
| Recognised e-certificates list / mutual recognition trust list | Digital Policy Office ↗ |
6. FAQ
Can an overseas client open an account without coming to Hong Kong?
Yes — provided the client banks in an eligible jurisdiction (31 at present) and runs the first and ongoing fund transfers through that account. Clients in unlisted jurisdictions (e.g. Mainland China, Taiwan) must use another accepted approach.
My client's jurisdiction was removed from the list — what happens to existing accounts?
The SFC is explicit: removal has no retroactive effect. Accounts opened in compliance with the then-current list are unaffected; but new clients can no longer use bank accounts in that jurisdiction for remote onboarding.
Can institutional clients use the designated-bank-account approach?
Approach 4 (cheque) expressly does not apply to institutional clients; designated-bank-account online opening and "iAM Smart" are designed mainly for individuals. Institutional onboarding generally relies on in-person execution or third-party verification.
What is the difference between "iAM Smart" and "iAM Smart+"?
Both are accepted for identity verification. "iAM Smart+" adds legally recognised digital signing; "iAM Smart" provides identity authentication. Which suits you depends on how your onboarding flow is designed.