Hong Kong's new anti-money laundering regulations come into effect, comprehensive compliance points整理

Author: Xiaoza Legal Team

Introduction

On May 23, 2023, the Hong Kong Securities and Futures Commission (SFC) released the "Consultation Summary on Proposed Regulatory Requirements for Virtual Asset Trading Platform Operators Licensed by the SFC." The regulatory framework for virtual asset trading in Hong Kong has not been established overnight. Since 2017, the SFC has regulated fundraising through Initial Coin Offerings (ICOs) based on financial attributes, refined rules for virtual asset investors in 2018, and included virtual asset trading platforms offering security tokens into the regulatory framework in 2019. It is believed that the relaxation of retail investor investments in 2023, along with the detailed anti-money laundering regulations for virtual asset trading platforms, will help enhance market transparency and promote the long-term development of virtual asset trading in Hong Kong.

Three Stages of Money Laundering

1. Possible Uses of Virtual Assets in the Money Laundering Process

In general, virtual asset trading is conducted under pseudonyms or with enhanced anonymity features. However, the borderless nature of virtual assets and the near-instantaneous transaction speed can be exploited by criminals or money launderers, as virtual assets can sometimes be obscured through enhanced anonymity services (such as mixers or tumblers) and other anonymity-enhancing technologies or mechanisms (such as privacy coins or privacy wallets) that obscure the identities of the remitter, recipient, and actual owner of the virtual assets.

Given the pseudonymous nature and transaction speed of virtual assets, criminals and designated individuals may use multiple wallets to conduct large or structured virtual asset transactions, easily obscuring the flow of funds and complicating the trail, thereby hiding the source and destination of their virtual assets to avoid detection of their money laundering/terrorist financing or other illegal activities.

Moreover, since virtual asset transactions can be conducted on a peer-to-peer basis, if there are no intermediaries involved to perform customer due diligence and transaction monitoring measures against money laundering/terrorist financing, such transactions can also be exploited by criminals.

Therefore, customer due diligence is one of the important measures to prevent, combat, and halt money laundering/terrorist financing. The following will focus on what customer due diligence is, what circumstances will trigger customer due diligence, and the additional due diligence required for cross-border agents.

2. Customer Due Diligence

Considering the high anonymity of virtual asset transactions, identifying and verifying customer identity is the top priority of customer due diligence.

For individual customers, financial institutions should obtain at least the following information to identify the customer's identity:

• Full name;
• Date of birth;
• Nationality;
• Unique identification number (such as ID card number or passport number) and document type.

For corporate customers, financial institutions should verify their name, legal form, existence at the time of verification, and the powers governing and binding that corporation, including the following information:

• Full name;
• Date of registration, incorporation, or establishment;
• Place of registration, incorporation, or establishment (including registered office address);
• Unique identification number (such as registration number or business registration number) and document type; and
• Principal place of business (if different from the registered office address).

If the customer is a club, society, charity, religious organization, educational institution, or mutual aid association, the legitimate purpose of such organizations must be credible to the financial institution.

The SFC further stipulates additional customer information that allows financial institutions to identify and manage their business relationships with customers and/or their customers' virtual asset transactions:

• Internet Protocol (IP) address along with the relevant timestamp;
• Geolocation data;
• Device identifier.

3. When Customer Due Diligence is Required

Paragraph 4.1.9 of the "Anti-Money Laundering Guidelines" lists the general circumstances under which financial institutions must perform customer due diligence:

(a) Before establishing a business relationship with that customer;

(b) Before executing the following non-routine transactions, where the transaction:

(i) Involves an amount equal to HKD 120,000 or more (or the equivalent in any other currency),

(ii) Involves an amount equal to HKD 8,000 or more (or the equivalent in any other currency) and is a telegraphic transfer.

Whether the transaction is executed as a single operation or as several operations that the financial institution considers to be related;

(c) When the financial institution suspects that the customer or the customer's account is involved in money laundering/terrorist financing; or

(d) When the financial institution suspects that the information obtained in the past to identify or verify the customer's identity is not genuine or sufficient.

Non-routine transactions refer to transactions between customers with whom the institution does not have a business relationship. However, licensed virtual asset trading platforms should not conduct such transactions (4.1.11).

In terms of virtual assets, non-routine transactions may also include virtual asset transfers and virtual asset exchanges. Therefore, 4.1.9(b) should cover virtual asset transfers and exchanges. However, for non-routine transactions involving virtual asset transfers of no less than HKD 8,000, the SFC further requires in paragraph 12.3 that financial institutions must perform customer due diligence on that customer, regardless of whether the transaction is executed as a single operation or as several operations that the financial institution considers to be related.

4. Cross-Border Agents: Additional Due Diligence, Ongoing Monitoring, and Shell Virtual Asset Service Providers

Cross-border agency relationships specifically refer to a financial institution ("Agent") providing services to another virtual asset service provider or financial institution located outside Hong Kong ("Principal Agent") in the process of providing virtual asset services, where the relevant transactions executed in that business relationship are initiated by the Principal Agent as a principal or agent. For example, a financial institution located in Hong Kong (as the Agent) executing transactions for buying and selling virtual assets for a virtual asset service provider operating outside Hong Kong and serving its local customers as the Principal Agent would constitute a cross-border agency.

Note: Virtual asset services here include (1) offers to buy and sell virtual assets or (2) frequent introductions or identifications between individuals for the purpose of negotiating or completing the sale of virtual assets, forming binding transactions in that manner.

Given the high anonymity and instantaneous nature of virtual asset transactions, cross-border agency may trigger risks related to transaction authenticity identification, money laundering, and currency evasion. Therefore, the SFC imposes additional due diligence measures to control these risks: financial institutions should understand whether the Principal Agent engages in transactions involving virtual assets that provide higher anonymity and the extent of any such activities or transactions for non-resident customers of the Principal Agent. Additionally, financial institutions need to interview compliance officers, conduct on-site visits, or review the results of internal or external audit reports to assess whether the anti-money laundering/terrorist financing control measures implemented for virtual asset transfers and the screening of virtual asset transactions and related wallet addresses are sufficient and effective.

Moreover, in cross-border transactions, the relevant virtual asset transactions and related wallet addresses will also be continuously monitored by financial institutions.

As for shell virtual asset service providers, they are defined as:

• Incorporated outside Hong Kong;
• Approved to operate virtual asset businesses in that location;
• Having no physical presence in that location;
• Not being effectively regulated by the entire group of regulated financial groups.

They are explicitly prohibited from establishing or implementing cross-border agency relationships, and financial institutions are also prohibited from establishing cross-border agency relationships with them.

Conclusion

In recent years, as the scale of virtual asset businesses continues to expand globally, the use of virtual assets to conceal and launder criminal proceeds has also gradually increased. The FATF has issued warnings to various countries/regions regarding anti-money laundering measures for virtual assets and provided corresponding regulatory recommendations. The newly revised "Anti-Money Laundering and Terrorist Financing Ordinance" in Hong Kong has also specifically regulated anti-money laundering compliance issues related to virtual assets in detail. This ordinance will take effect on June 1 of this year. The Xiaoza team reminds all friends engaged in relevant businesses in Hong Kong, especially those involving cross-border virtual asset transactions, to pay close attention to anti-money laundering compliance, fulfill due diligence and ongoing monitoring obligations, and avoid legal risks.