What are the AML regulations in Hong Kong?
On 8 November 2024 the HKMA fined Fubon Bank (Hong Kong) HK$4 million. From April 2019 to July 2022 the bank had no effective procedures to manage changes to its monitoring system, to follow up a substantial decrease in transaction alerts or to review which transactions the system covered. Fubon had reported the monitoring failures itself. The penalty rests on s. 21 of the AMLO.
The main AML law is the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO, Cap. 615), in effect since 1 April 2012. Schedule 2 holds the customer due diligence (CDD) and record keeping duties; other parts give supervisors their powers. Until 1 March 2018 its short title ended in "(Financial Institutions)"; its duties now also bind designated non financial businesses and professions. The laundering offense itself sits in s. 25 of OSCO and DTROP. As an FATF member, Hong Kong is obliged to implement the FATF Recommendations, and its AML regulations follow them.
| Ordinance | Chapter | What it does for AML | Dated source (in force, November 2026) |
|---|---|---|---|
| AMLO | Cap. 615 | CDD, records, monitoring, PEP and wire duties (Sch. 2); offenses (s. 5); supervisory penalties (s. 21); licensing of money services (s. 29), TCSPs (Part 5A) and virtual asset platforms (Part 5B); dealer registration (Part 5C) | In effect 1 April 2012; Amendment Ordinance enacted 16 December 2022, in force 1 April 2023 (dealer registration) and 1 June 2023 |
| Organized and Serious Crimes Ordinance (OSCO) | Cap. 455 | Laundering offense for proceeds of indictable offenses (s. 25); duty to report (s. 25A) | HKMA Guideline, May 2023, paras 1.20, 1.22 |
| Drug Trafficking (Recovery of Proceeds) Ordinance (DTROP) | Cap. 405 | The same offenses for drug proceeds; freezing and confiscation | Paras 1.19, 1.22 |
| United Nations (Anti-Terrorism Measures) Ordinance (UNATMO) | Cap. 575 | Terrorist financing offenses, freezing, reporting (s. 12) | Paras 1.21, 1.23 |
| United Nations Sanctions Ordinance (UNSO) | Cap. 537 | Most UN Security Council sanctions take effect through it | Para 1.26 |
| Weapons of Mass Destruction (Control of Provision of Services) Ordinance | Cap. 526 | Bars services a person believes or suspects, on reasonable grounds, may be connected to proliferation finance (s. 4) | Para 1.27 |
| Stablecoins Ordinance | Cap. 656 | HKMA licensing of stablecoin issuers | In force 1 August 2025 |
| Payment Systems and Stored Value Facilities Ordinance | Cap. 584 | HKMA disciplinary action (s. 33Q) against stored value facility (SVF) licensees that breach s. 8Q | HKMA actions of 30 August 2024 and 22 July 2025 |
Who provides regulatory oversight of AML in Hong Kong?
| Body | Supervises or does | Basis (in force, November 2026) |
|---|---|---|
| Hong Kong Monetary Authority (HKMA) | Banks (authorized institutions), SVF licensees, licensed stablecoin issuers | AMLO s. 21; Cap. 584; stablecoin AML guideline from 1 August 2025 |
| Securities and Futures Commission (SFC) | Licensed corporations and licensed virtual asset trading platforms | SFC AML/CFT Guideline, revised from 1 June 2023 |
| Insurance Authority (IA) | Insurers and reinsurers in long term business, and licensed agents, agencies and brokers in long term business | AMLO ss. 11, 12, 21 |
| Customs and Excise Department | Money service operators (license); dealers in precious metals and stones (registration since 1 April 2023) | Customs pages and releases |
| Registrar of Companies | Licensed trust or company service providers (TCSPs) | AMLO Part 5A, since 1 March 2018 |
| Regulatory bodies for lawyers, accountants and estate agents | The Law Society (legal professionals); the Accounting and Financial Reporting Council (AFRC), with the HKICPA for some functions (accounting professionals); the Estate Agents Authority (estate agents) | AMLO Sch. 1, "regulatory body" |
| Joint Financial Intelligence Unit (JFIU) | Receives suspicious transaction reports (STRs); sits under the Hong Kong Police Force | DTROP and OSCO s. 25A; UNATMO s. 12 |
| Financial Services and the Treasury Bureau (FSTB) | Leads Hong Kong's FATF delegation | FATF country page |
Oversight follows the license: a bank answers to the Hong Kong Monetary Authority, a broker to the SFC, a life insurer to the Insurance Authority and a remittance shop to Customs. The AMLO calls a financial institution's supervisor its "relevant authority" and a professional's its "regulatory body".
Each body applies Schedule 2 through its own guideline; the Insurance Authority investigates under AMLO ss. 11 and 12 and disciplines under s. 21. The HKMA's AML/CFT Guideline for authorized institutions, revised in May 2023, prints the Schedule 2 section beside each paragraph, and this guide cites those sections. The licensing offenses, the DNFBP scope and the HK$8,000 line were read on 5 November 2026 in the AMLO's official text, version in force from 24 September 2026.
How does Hong Kong's AML regime differ from mainland China's?
Hong Kong SAR has its own AML law, financial intelligence unit, supervisors and FATF seat, as "Hong Kong, China". China's AML Law is missing from the national laws listed in Annex III of the Basic Law, which means it is not applied in Hong Kong (art. 18).
The sharpest onboarding gap with mainland China's AML regime is the PEP test. Since 1 June 2023 someone entrusted with a prominent public function on the mainland is a "non-Hong Kong PEP": the statutory definition moved from a function outside the People's Republic of China to one outside Hong Kong (SFC circular 23EC21). Hong Kong now sorts PEPs three ways: non-Hong Kong, Hong Kong and international organization.
| Rule (in force, November 2026) | Hong Kong SAR | Mainland China |
|---|---|---|
| Main law | AMLO (Cap. 615), in effect 1 April 2012; laundering offense in OSCO and DTROP s. 25 | AML Law, revised 2024, in force 1 January 2025 (art. 65) |
| Supervisor | HKMA, SFC, IA, Customs, Registrar of Companies | People's Bank of China (PBOC) |
| Financial intelligence unit | JFIU | CAMLMAC |
| Reports | Suspicion based STRs (s. 25A); no general large value report in the HKMA Guideline | Large value and suspicious transaction reports |
| Records | At least 5 years (Sch. 2 s. 20) | At least 10 years (AML Law art. 34) |
| Beneficial owner | More than 25 percent (Sch. 2 s. 1) | 25 percent or more (BO Identification Measures art. 8) |
| PEPs | Mainland officials are non-Hong Kong PEPs | Foreign PEPs named (CDD Measures art. 33); domestic PEPs not named |
| Next evaluation | APG plenary 2030 | 2027, IMF led |
Who must comply with the AMLO?
The AMLO binds financial institutions and designated non financial businesses and professions. The JFIU's 2025 count shows where reports come from: banks filed 164,844 of 190,636 STRs (86.47 percent).
| Who | Licensed or supervised by | Scope of the duties (in force, November 2026) |
|---|---|---|
| Banks, private banks included | HKMA (authorized institutions) | All customers; private banking gets more due diligence than retail (HKMA Guideline para 12.3) |
| Securities and futures firms | SFC | Licensed corporations |
| Insurers and insurance intermediaries | IA | Long term business |
| SVF licensees | HKMA (Cap. 584) | All customers; 12,261 STRs in 2025 |
| Money services (remittance, money changing) | Customs license (s. 29) | All customers; 7,291 STRs in 2025 |
| Virtual asset platforms; stablecoin issuers | SFC (Part 5B); HKMA (Cap. 656) | See the next section |
| Trust or company service providers | Registrar of Companies license (Part 5A), since 1 March 2018 | Their trust or company services (s. 5A(5)) |
| Lawyers and accountants, as designated non financial businesses and professions | Law Society; AFRC, with the HKICPA for some functions | Only when, by way of business in Hong Kong, they prepare for or carry out for a client a transaction concerning buying or selling real estate; managing client money, securities or other assets; managing bank, savings or securities accounts; organizing contributions for creating, operating or managing corporations; creating, operating or managing legal persons or legal arrangements; buying or selling business entities; or a trust or company service (s. 5A(3)) |
| Estate agents | Estate Agents Authority | Only when involved, in Hong Kong, in buying or selling real estate for a client (s. 5A(4)) |
| Dealers in precious metals and stones | Customs registration (Part 5C) | Registration before any transaction of HK$120,000 or more, unless exempt, and cash at that level only for a Category B registrant (s. 53ZUE); Schedule 2 binds only a Category B registrant, for a cash transaction of HK$120,000 or more that is not an excluded transaction (s. 5A(5A)) |
What do virtual asset platforms and stablecoin issuers need?
A virtual asset service provider that runs a trading platform in Hong Kong, or holds itself out as running one, needs an SFC license under Part 5B of the AMLO, a regime in force since June 2023 (s. 53ZRD). Actively marketing such a service to the Hong Kong public, from Hong Kong or abroad, counts as running it (s. 53ZRB(3) to (5)). Operating without one carries up to HK$5 million and 7 years on indictment, plus HK$100,000 for each day the offense continues. The SFC's list, read on 5 November 2026, names 13 licensed platforms. The latest, NewBX, was licensed on 18 May 2026.
Licensed platforms follow the SFC's AML/CFT Guideline, whose Chapter 12 covers virtual assets, and two HK$8,000 CDD lines (Sch. 2 s. 3(1A), (1B)).
The Stablecoins Ordinance took effect on 1 August 2025 with an HKMA AML/CFT guideline for licensed issuers. The HKMA's register lists two issuers, Anchorpoint Financial and HSBC, licensed from 10 April 2026.
What are the AML compliance requirements in Hong Kong?
AML compliance in Hong Kong means Schedule 2 of the AMLO plus the supervisor's guideline. A guideline breach alone creates no liability. In AMLO proceedings, though, a court takes a relevant provision into account, and the HKMA must have regard to it when it decides whether a bank breached Schedule 2 (s. 7; para 1.7). The approach is risk based: a documented institutional risk assessment, approved by senior management and kept up to date, comes first (para 2.3). Read the fourth column for the piece of complead, formerly Sanction Scanner, that handles each duty.
| Obligation | Legal basis (in force, November 2026) | What a program must do | How complead does it |
|---|---|---|---|
| Systems and risk assessment | Sch. 2 s. 23; HKMA Guideline paras 2.2, 2.3, 3.1 | Take all reasonable measures to prevent breaches of Parts 2 and 3 of Schedule 2 and to mitigate risk; keep a documented risk assessment. | Rules scoped per product, segment or jurisdiction, versioned with who changed what, when and why. |
| Compliance officer and MLRO | Paras 3.5, 3.10 | Senior management oversight; a compliance officer and an MLRO, who is the main contact with the JFIU. | Every alert decision records who decided. |
| Customer due diligence (CDD) | Sch. 2 ss. 2(1), 3(1), (1A); paras 4.2.1, 4.3.1 | Identify the customer and verify the identity from a reliable and independent source; identify the beneficial owner and take reasonable measures to verify that owner; learn the purpose of the relationship; identify and verify anyone acting for the customer and their authority. Due before a relationship, before occasional transactions at the HK$120,000 or HK$8,000 lines, on suspicion, or on doubt about earlier data. | Customer risk assessment and KYC puts one risk score on each customer. |
| Beneficial owners | Sch. 2 ss. 1, 2(1)(b); paras 4.4.6 to 4.4.11 | Company: an individual owning or controlling more than 25 percent of the issued shares or votes, directly or indirectly, or exercising ultimate control of management. Partnership: more than 25 percent of capital, profits or votes, or ultimate control. A company or partnership acting for another person: that person. Trust: settlor, trustee, protector or enforcer, beneficiaries with a vested interest or their class, anyone in ultimate control. No owner found: the senior managing official. | KYB and UBO verification traces parents and controlling entities upward until it reaches natural persons, with no fixed depth cap; a layer it cannot resolve is shown as unresolved. |
| PEPs | Sch. 2 ss. 1, 5(3)(b), 10(1), (2); paras 4.9.7 to 4.9.19 | Three types of PEPs. Non-Hong Kong PEP, family members and close associates included: senior approval, source of wealth and funds, enhanced monitoring. Hong Kong and international organization PEPs: the same in high risk relationships. A former non-Hong Kong PEP who no longer presents a high risk may leave these after a risk assessment (s. 5(5), s. 10(3)). | PEP data feeds the match; the reviewer decides and the record shows who did. |
| Enhanced due diligence | Sch. 2 s. 15; paras 4.9.1 to 4.9.3 | EDD where a situation by its nature may present a high risk, or where the HKMA specifies one by written notice; senior approval for high risk relationships. | The connections graph searches up to six hops by default for sanctioned, PEP or adverse media links. |
| Ongoing monitoring | Sch. 2 ss. 5(1), 19(3); paras 5.1 to 5.4 | Review CDD records regularly and on triggers, high risk at least yearly; scrutinize transactions against what the firm knows of the customer; look into the background and purpose of transactions that are complex, unusually large or of an unusual pattern and have no apparent economic or lawful purpose, and put the findings in writing. | Ongoing monitoring started and stopped per name through API triggers. |
| Wire transfers | Sch. 2 s. 12; paras 10.1 to 10.6 | The ordering institution sends full originator and recipient information (names, account or reference numbers, and the originator's address, ID number or date and place of birth) with a transfer of HK$8,000 or more, and both names and account or reference numbers with a smaller one, cover payments included; transfers between institutions acting on their own behalf fall outside s. 12. | Transaction screening checks sender and receiver through the API during the transfer. |
| Virtual asset transfers | Sch. 2 ss. 3(1A), 13A | CDD for occasional transfers of HK$8,000 or more; originator and recipient information under the s. 13A travel rule duties of ordering, intermediary and beneficiary institutions. | complead for crypto screens wallets and names on one engine; the travel rule message itself sits outside the platform. |
| Correspondent banking | Sch. 2 s. 14; paras 11.9, 11.17 | Complete respondent due diligence before the relationship, or end it; review high risk respondents at least yearly. | The connections graph keeps every hop sourced as case evidence. |
| Suspicious transaction reports | DTROP, OSCO s. 25A(1); UNATMO s. 12(1); paras 7.1, 7.5 | Report knowledge or suspicion "as soon as it is reasonable", even if no transaction went through; regulated entities file through STREAMS 2. | Reporting support within case management, part of the regulatory compliance setup; every alert shows which rule fired. |
| No tipping off | DTROP, OSCO s. 25A(5); UNATMO s. 12(5); para 7.6 | Reveal nothing that might prejudice an investigation, including a suspicion raised internally and not yet reported. | Outside the platform: a policy and training duty. |
| Sanctions | UNSO; UNATMO; Cap. 526 s. 4; paras 6.11 to 6.18 | Keep a database with the lists published in the Gazette or on the Commerce and Economic Development Bureau's website and the lists the HKMA flags; screen customers and owners at onboarding and against new designations as soon as practicable, and all relevant parties to a cross border wire before it goes. Hong Kong law does not normally make a bank have regard to other jurisdictions' unilateral sanctions; one operating internationally weighs them where they affect its business. | 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. |
| Records | Sch. 2 s. 20; paras 8.3 to 8.8 | CDD documents, account files and the results of any analysis through the relationship and at least 5 years after it ends; transaction records and occasional transactions at or above the CDD line, 5 years from the transaction. The HKMA may require a longer period for a specified transaction or customer by written notice (s. 20(4)). | Every search is recorded with who, what, when and the result, including no match. |
Which HK$ thresholds apply in 2026?
Picture a remittance firm (illustrative) whose walk in customer, with no account, sends HK$8,000 to Manila. That occasional wire meets the HK$8,000 line in Sch. 2 s. 3(1A), which binds every financial institution, so CDD comes first. Next day the customer sends HK$5,000 twice to the same recipient. Each is under the line. Payments to one recipient over a short period can be linked, and linked operations count together, so the HK$10,000 pair is over it (paras 4.2.4, 4.2.5). Other occasional transactions start at HK$120,000.
| CDD or report line | Amount | Legal basis (in force, November 2026) |
|---|---|---|
| Occasional transaction CDD | HK$120,000 or more, single or linked | Sch. 2 s. 3(1); para 4.2.1 |
| Occasional wire or virtual asset transfer CDD | HK$8,000 or more, single or linked | Sch. 2 s. 3(1A); para 4.2.1 |
| Other occasional transaction at a licensed virtual asset platform | HK$8,000 or more | Sch. 2 s. 3(1B) |
| Suspicion of laundering or terrorist financing | Any amount | Para 4.2.1(c) |
| Beneficial owner (company, partnership) | More than 25 percent | Sch. 2 s. 1; paras 4.4.6, 4.4.7 |
| Dealer registration | Before any transaction of HK$120,000 or more, unless exempt; Category B for cash | Customs |
| Cash report by dealers from outside Hong Kong | Cash of HK$120,000 or more, within one day or before leaving, whichever is earlier | Customs, 13 September 2026 |
| Lower risk life policy (simplified due diligence example) | Annual premium up to HK$8,000 or single premium up to HK$20,000 | Para 4.8.7 |
| Records | At least 5 years | Sch. 2 s. 20 |
When must a suspicious transaction report reach the JFIU?
There is no day count. If you know or suspect that property represents the proceeds of drug trafficking or an indictable offense, was used in connection with one or is meant to be, or is terrorist property, you must disclose it to the JFIU "as soon as it is reasonable" to do so (DTROP and OSCO s. 25A(1); UNATMO s. 12(1)). The HKMA wants the report as soon as reasonably practical after the suspicion was first identified, even when no transaction went through (paras 7.1, 7.5).
Since 2 February 2026 regulated entities file a suspicious transaction report only through STREAMS 2: XML, an uploaded PDF form or the web form, the first two with a Hong Kong Post electronic certificate.
Reports rose 3.7 times from 2019 to 2025, and laundering convictions ninefold.
| Year | STRs received by the JFIU | Persons convicted of money laundering (DTROP, OSCO) |
|---|---|---|
| 2019 | 51,588 | 103 |
| 2020 | 57,130 | 69 |
| 2021 | 56,913 | 83 |
| 2022 | 68,538 | 105 |
| 2023 | 97,577 | 208 |
| 2024 | 147,660 | 648 |
| 2025 | 190,636 | 925 |
| 2026, to 30 September | 157,478 | Not yet published |
What are the penalties for AML breaches in Hong Kong?
| Breach | Ceiling | Basis (in force, November 2026) |
|---|---|---|
| Money laundering (dealing with property knowing or having reasonable grounds to believe it is proceeds) | 14 years and HK$5 million | DTROP, OSCO s. 25; HKMA Guideline para 1.22 |
| Terrorist financing | 14 years and a fine | UNATMO ss. 6, 7, 8, 8A, 13, 14; para 1.23 |
| Failure to report | 3 months and HK$50,000 (level 5) | DTROP, OSCO s. 25A; UNATMO ss. 12, 14; para 1.24; JFIU |
| Tipping off | 3 years and a fine | DTROP, OSCO s. 25A(5); UNATMO s. 12(5); paras 1.25, 7.6 |
| A financial institution knowingly breaching a specified provision, or staff knowingly causing or permitting it | 2 years and HK$1 million | AMLO s. 5; paras 1.16, 1.17 |
| The same with intent to defraud the supervisor (for staff, also the institution) | 7 years and HK$1 million | AMLO s. 5 |
| Supervisory action for breaching a specified provision | Public reprimand, remedial order, penalty up to the greater of HK$10 million or 3 times the profit gained or costs avoided | AMLO s. 21; para 1.18 |
| Operating a money service without a license | HK$1 million and 2 years on indictment; level 6 fine and 6 months on summary conviction | AMLO s. 29(2); Customs, 13 January 2026 |
| Providing a virtual asset service without a license | HK$5 million and 7 years on indictment, plus HK$100,000 a day while it continues | AMLO s. 53ZRD(5) |
| Knowingly advertising an unlicensed person's virtual asset service | Level 5 fine (HK$50,000) and 6 months | AMLO s. 53ZRE |
| Dealing in precious metals and stones without registration | Level 6 fine (HK$100,000) and 6 months | AMLO s. 53ZUE(5); Customs DPMS page |
| Unlicensed TCSP | HK$100,000 and 6 months | AMLO s. 53F(1), (2); Registrar's licensing guideline, May 2025 |
Two tracks run side by side. Courts try laundering, failure to report and tipping off under DTROP, OSCO and UNATMO. Supervisors act under AMLO s. 21 when a financial institution breaches a specified provision, the list in s. 5(11), and a pecuniary penalty can sit beside a public reprimand and a remedial order. A large breach can therefore pass HK$10 million. The two SVF penalties below used Cap. 584 instead.
Which firms have Hong Kong regulators fined since 2024?
Detection rules and core model rules in China CITIC Bank International's automated monitoring system were implemented incorrectly, so from November 2015 to July 2018 the system failed to alert on suspicious transactions. The HKMA fined it HK$4 million on 6 December 2024.
From April 2024 to July 2025 the HKMA fined seven banks HK$43.2 million under s. 21, and every one of the seven failed at monitoring. From October 2024 to July 2025 the SFC fined three futures brokers HK$17.35 million over client supplied trading systems used without due diligence. The Registrar of Companies reprimanded and fined four TCSPs from January to June 2026 (HK$4,000 to HK$30,000); two are listed.
| Date | Firm | Regulator and outcome | Main finding |
|---|---|---|---|
| 19 April 2024 | Hua Nan Commercial Bank, Hong Kong Branch | HKMA, HK$9,000,000 | Monitoring, April 2012 to July 2018; recipient names missing on cross border wires, 1 March to 9 July 2018 |
| 5 July 2024 | DBS Bank (Hong Kong) | HKMA, HK$10,000,000 | Monitoring, EDD and records, between April 2012 and April 2019 |
| 30 August 2024 | WeChat Pay Hong Kong | HKMA (Cap. 584), HK$875,000 | CDD reviews on trigger events and EDD, 2016 to 2021; self reported |
| 9 October 2024 | Xinhu International Futures (Hong Kong) | SFC, reprimand, HK$9 million; former responsible officer suspended 9 months | No due diligence on client supplied trading systems of 84 clients; deposits out of line with six clients' profiles |
| 9 October 2024 | CSC Futures (HK) | SFC, reprimand, HK$4.95 million | Same failure for 100 clients; deposits out of line with five clients' profiles |
| 8 November 2024 | Fubon Bank (Hong Kong) | HKMA, HK$4,000,000 | System change control, alert drop not followed up, 2019 to 2022 |
| 6 December 2024 | China CITIC Bank International | HKMA, HK$4,000,000 | Detection rules implemented incorrectly, 2015 to 2018 |
| 3 July 2025 | Freeman Commodities (now Arta Global Futures) | SFC, reprimand, HK$3.4 million; former responsible officer suspended 4 months | Client supplied systems of 89 clients; no effective monitoring |
| 22 July 2025 | Indian Overseas Bank, Hong Kong Branch | HKMA, reprimand, look back review, HK$8,500,000 | Transaction monitoring and management oversight |
| 22 July 2025 | Bank of Communications (Hong Kong); its Hong Kong Branch | HKMA, HK$4,000,000; HK$3,700,000 | Some transaction types not loaded into the shared monitoring system |
| 22 July 2025 | 33 Financial Services | HKMA (Cap. 584), reprimand, HK$1,600,000 | Purpose of relationships, CDD on business entities, outsourced ID checks, 2019 to 2023 |
| 22 October 2025 | Wong Ming Chun | High Court, 7 years 8 months (SFC findings referred to the Police) | Laundered Hua Han funds (OSCO s. 25(1)) |
| 13 February 2026 | Guoke (Hong Kong) Accounting Services | Registrar, public reprimand, HK$30,000 | Owner and agent checks, customers not physically present, records, safeguards (Sch. 2 ss. 2(1), 9, 20(1), 23) |
| 30 June 2026 | CY Business Consultant | Registrar, public reprimand, HK$25,000 | No adequate AML policies (license condition); procedures and safeguards (Sch. 2 ss. 19(3), 23) |
Is Hong Kong a high risk jurisdiction, and how did the FATF rate it?
No. Hong Kong, China has been an FATF member since 1991. Its FATF and APG mutual evaluation of 4 September 2019 found "a sound regime to fight money laundering and terrorist financing that is delivering good results", while asking for more prosecutions of laundering tied to crimes abroad and closer supervision of some non financial businesses. Six of eleven effectiveness outcomes rated Substantial and five Moderate.
Since the 17 February 2023 follow up report, the FATF page shows Compliant on 11 Recommendations, Largely compliant on 25 and Partially compliant on 4: R.12 (PEPs), R.15 (new technologies), R.22 (DNFBP due diligence) and R.25 (legal arrangements).
Hong Kong was on neither of the FATF high risk and monitored lists of 13 February or 19 June 2026. FinCEN's release on the FATF plenary of 30 October 2026 lists no change for Hong Kong: four removals from the monitored list and the same three call for action countries.
Hong Kong cooperates with international organizations through the Egmont Group, where the JFIU exchanges information with over 160 member units (LCQ10, 30 July 2025). The next evaluation is set for the APG's 2030 plenary.
How does anti money laundering software fit Hong Kong's rules?
The HKMA's sanctions screening review of 16 March 2026 repeats its 2018 requirement of regular testing that demonstrates "explainable, effective and efficient sanctions controls". The banks reviewed typically tested at least yearly, some also after material system updates, and loaded UN designations without delay. Some close false positive alerts automatically. Those banks showed explainable logic and sample quality checks.
Payment screening checks the sender and the receiver while each transfer is processed, where para 6.16(c) wants every relevant party to a cross border wire screened. Client screening and ongoing monitoring lets a team set its fuzzy matching thresholds per list type and per list.
The bank cases above were monitoring cases. In transaction monitoring a team writes rules without code and runs each change over 30, 60 or 90 days of real history first, which shows the alert volume it will produce; every change keeps a version and a one click rollback. Agents close the routine alerts, and the evidence, the narrative and the work log stay with each closed case. The MLRO decides whether a suspicion goes to the JFIU through STREAMS 2, and the record shows who decided.
What changed in Hong Kong AML in 2025 and 2026?
- 1 August 2025. The Stablecoins Ordinance and the HKMA's AML/CFT guideline for licensed issuers take effect.
- 12 December 2025. An HKMA circular on high end money laundering faults alerts closed without enough analysis (large deposits from opaque sources such as cash or cashier's orders, significant transactions with third parties whose link to the customer was not understood, transactions with jurisdictions that have no apparent link to the customer) and flags customers with several nationalities, some bought through citizenship by investment.
- 2 February 2026. STREAMS 2 becomes the only STR channel for regulated entities (SFC circular 26EC2).
- 16 March 2026. HKMA sanctions screening review.
- 10 April 2026. First two stablecoin issuer licenses, to Anchorpoint Financial and HSBC.
- 22 June 2026. An HKMA circular says banks with significant Hong Kong operations have filed plans for using artificial intelligence against financial crime.
- 28 August 2026. Version 2.0 of the HKMA's PEP Smart Tips, first issued in November 2025.
- 3 September 2026. New HKMA expectations for remote onboarding, citing deepfakes.
- 22 October 2026. HKMA circular on bribery of bank staff to get accounts opened, which makes money mule accounts harder to find.
Next: the government and the SFC promised the Legislative Council, on 24 June 2026, a bill this year for virtual asset dealing, custodian, advisory and management services (LCQ11). Hong Kong's technical compliance submission to the APG is due on 1 March 2029.
For a bank in Fubon's position the check is short. After any change to a monitoring system, compare alert volume before and after, confirm every transaction type still loads (the gap at both Bank of Communications entities), and record who signed the change off.
The PDF edition. Every rule, number and source stays readable on this page. The download beside it adds four working templates: a Schedule 2 CDD trigger card (HK$120,000, HK$8,000, suspicion, doubt), an STR decision log for STREAMS 2, a checklist for changing a monitoring system, and a PEP worksheet that covers all three PEP types and former PEPs.
