Hong Kong AMLO Anti-Money Laundering Regulations 2026 Update: CDD and PEPs screening points that licensed institutions must know

Hong Kong AMLO Anti-Money Laundering Regulations 2026 Update: Why act now?

Hong Kong's relevant legal obligations should be based onThe Anti-Money Laundering and Counter-Terrorist Financing Ordinance, Chapter 615, Laws of Hong Kongand applicable regulatory guidelines..

With the globalAnti-money laundering and counter-terrorism financing supervisionContinuous upgrade, Hong Kong as an international financial center, Compliance requirements for licensed institutions are being further strengthened.involving capital flows, customer assets, Cross-border payment, For institutions involved in securities and virtual asset related businesses, Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO)Not just legal texts, It is also the "underlying rule" that determines whether the business can operate stably in the long term..

Regulatory trends around 2026, The market generally pays attention to two high-frequency keywords: CDD (Customer Due Diligence)与PEPs (Political Exposed Persons) Screening.These two tasks seem to be "process-oriented", In fact, it is the core starting point for regulatory agencies to judge whether a company has substantial compliance capabilities..Many organizations attach great importance to institutional documents during the license application stage., However, dynamic execution is ignored during the licensed operation stage., Finally, spot checks, Issues exposed during annual review or law enforcement investigation.

For companies that want to tap into the Hong Kong market, Compliance should not be understood as a "cost center", Rather, it should be used as an asset for risk control and business reputation..Among the types of customers that 88MSO and its professional team have served for a long time, A common pain point is not "not understanding the regulations", It's about "knowing the requirements but being unable to implement them consistently".therefore, This article will start from the update trends in 2026, Systematic breakdown of CDD and PEPs screening key points that licensed institutions must master, and provide executable rectification paths.

one, AMLO 2026 Regulatory Trends: From "systematic" to "proven"

1. Regulatory logic changes: heavy result, Heavy evidence, Heavy penetration

In the past, many organizations believed that, As long as the manual is complete, Complete templates, Even if it "satisfies compliance".In the latest regulatory environment, The thinking of law enforcement and inspection has obviously changed:

• heavy result: Whether high-risk customers and suspicious transactions are truly identified, rather than just completing form check boxes.
• Heavy evidence: Determine whether there is a file for each item, System log, Approval records are traceable.
• Heavy penetration: Whether to identify the ultimate beneficiary (UBO), Actual control relationships and the purposes behind complex transactions.

That is to say, Institutions must not only "do", It also needs to "leave traces that can be audited", And be able to explain "why you do it".

2. Further strengthening integration with international standards

Hong Kong's anti-money laundering supervision continues to refer to the FATF risk-based approach (RBA), and refine it based on the risk characteristics of local industries..Around 2026, Licensed institutions may face more frequent special inspections, Key coverage:

• Are the admission standards for high-risk customers too low?;
• Is the PEPs identification mechanism "done for the first time"?, There will be no further updates";
• Is the threshold for triggering enhanced due diligence (EDD) reasonable?;
• Suspicious Transaction Report (STR) to determine whether there is "systematic late reporting/missing reporting".

two, CDD Due Diligence: High-risk areas where licensed institutions are most likely to "formally comply"

1. CDD is not just an account opening action, But full life cycle management

Many institutions understand CDD as collecting documents once before opening an account., fill out a questionnaire, This approach is extremely risky under the 2026 regulatory framework.Full CDD should cover:

• Before establishing a relationship: Identification, Beneficiary identification, Business purpose and funding source verification;
• The relationship is ongoing: Trading behavior monitoring, Data update, Risk level reassessment;
• After triggering event: Abnormal transactions, Change of control, Additional due diligence when negative news appears.

2. CDD modules that should be strengthened in 2026

(1) Penetrating identification of customer identity and beneficial owner

The most common problem for corporate customers is the complexity of the equity chain, Multi-jurisdictional, Multi-layer SPV architecture.Institutions should establish standards for "penetration to natural persons", Avoid staying at the first level of shareholder information.fiduciary arrangements, Nominee holder arrangement, family office structure, Additional documentation requirements should be clarified.

(2) Business purpose and expected transaction portrait

Supervision increasingly focuses on "why customers trade with you".It is recommended that institutions form a verifiable expected picture during the account opening stage, include:

• Source of funds and major counterparty areas;
• Average monthly trading volume and peak range;
• Product preferences and transaction frequency;
• Whether it matches the customer's main business.

Under follow-up monitoring, Once customer behavior deviates from the profile,, Review should be triggered automatically, Rather than relying on artificial "feeling judgment".

(3) Continuous due diligence and periodic review (Periodic Review)

Differentiated update frequencies should be applied to customers with different risk levels.The typical approach is:

• low risk: Review every 2-3 years;
• medium risk: Review every 1-2 years;
• high risk: Review at least annually, Update in real time when necessary.

Notice: Supervision pays more attention to "overdue review ratio" and "overdue duration", This is one of the hard indicators in the inspection.

three, Screening for PEPs: Not "checked once", But "dynamic continuous monitoring"

1. Misunderstandings about the definition and scope of PEPs

Many organizations understand PEP only as "current senior officials", this is far from enough.In practice, it should cover:

• foreign country, Politically exposed figures related to domestic and international organizations;
• Family members and close associates (RCA);
• Retired but still influential, Persons exposed to corruption risks.

If you only do "list matching", But does not evaluate the relationship chain and transaction background, It is extremely easy to cause "false negatives".

2. Four key control points for PEPs screening

(1) Pre-admission screening

Customers must complete list screening before establishing a business relationship, and perform manual review of "potential hits", Avoid system false positives or negatives.

(2) Batch re-screening of existing customers

PEP status may change during the relationship.It is recommended to re-screen high-risk customer groups in batches at least monthly, Cover all customers on a quarterly basis, And keep the rescreening report.

(3) Triggered instant screening

The occurrence of the following events should trigger immediate rescreening:

• Change of Customer Control;
• Large or unusual cross-border transactions;
• negative news, Sanctions linkage or enforcement notification occurs;
• Customers require new trading channels for high-risk countries.

(4) Post-hit approval and EDD mechanisms

PEP hit does not mean denial of service, But there must be strengthening measures, For example:

• Senior management approval leaves traces;
• Deeper source of wealth (SoW) and source of funds (SoF) verification;
• Improve transaction monitoring sensitivity and review frequency;
• Limit product scope or transaction amount when necessary.

Four, How to link CDD and PEPs screening: Establish a "risk-based" closed loop

in mature institutions, CDD and PEPs are not two parallel processes, It is an input item of the same risk control engine..A groundable closed loop usually includes:

• risk scoring model: customer area, industry, product, trading behavior, Unified quantification of PEP status;
• Hierarchical management: Automatically assign due diligence depth and review cycles based on scores;
• Early warning and upgrade: Automatically notify the compliance team and MLRO for review after the threshold is triggered;
• audit trail: Each judgment step can be played back, Meet regulatory spot checks.

For licensed institutions, The real difficulty is not "whether there is a system", But "whether the system rules are consistent with business reality".therefore, Rule parameters need to be specified by Compliance, business, Risk control, IT joint maintenance, Avoid "the model looks good but is not practical".

five, Five priority actions that licensed institutions must complete by 2026

1. Updated AML Policy and Operations Manual

Mapping latest AMLO requirements to internal systems, Especially to complement PEP dynamic screening, EDD trigger condition, Periodic review time limit, STR upgrade path and other terms.

2. Calibrating KYC and Screening Data Quality

A large number of false positives and false negatives come from "dirty data": Name spelling is inconsistent, Document field is missing, The country code is not standardized.Do master data governance first, Screening effectiveness can be improved.

3. Rebuilding the training system: From "propaganda type" to "scenario type"

front, customer service, operations, Compliance officers often have inconsistent understandings of identifying suspicious behavior.It is recommended to carry out case-based training based on positions, And set up a closed-book assessment and supplementary training mechanism.

4. Strengthen MLRO governance and reporting mechanisms

The MLRO (Compliance Officer) should be more than a "sign-off role", There should be sufficient resources and authority to promote rectification.The board/senior management should receive regular AML risk reports, Make sure "Governance is visible".

5. Conduct a "mock regulatory inspection"

Desktop review + sample backtracking via 3rd party or in-house independent team, Expose process breakpoints in advance.It is through pre-inspections that many institutions avoid major deficiencies in formal inspections..

six, Common violation scenarios and rectification suggestions

Scene A: Complete customer information, But cannot explain the risk rating logic

Nature of the problem: "Documents are compliant" but "judgment is distorted".
Correction direction: Create interpretable scoring rules, and record the basis for each rating adjustment.

Scenario B: PEP screening is only performed at account opening

Nature of the problem: Lack of continuous monitoring.
Correction direction: Establish a dual mechanism of scheduled re-screening + event-triggered re-screening, and incorporate KPIs.

Scene C: High risk clients have no substantial EDD

Nature of the problem: Risk stratification is disconnected from control measures.
Correction direction: Systematize the EDD list and approval thresholds, Materials that do not meet the requirements will not be released.

Scene D: Suspicious transaction identification relies on manual experience

Nature of the problem: Lack of data-driven rules.
Correction direction: Combined with transaction threshold, frequency, Establish an automatic early warning model for path anomalies.

seven, A realistic path to compliance construction: How can small and medium-sized institutions start at a low cost?

Many small and medium-sized licensed institutions worry that "comprehensive upgrades are too expensive".actually, You can press "Key First", Advance with the rhythm of "post-perfection":

• The first stage (0-3 months): compensation system, Clear data, Establish the minimum usable screening process;
• Phase 2 (3-6 months): Launched continuous due diligence and hierarchical review mechanism;
• The third stage (6-12 months): Optimization rule model, Conduct stress testing and independent audits.

in this process, A professional service team with practical experience in Hong Kong license compliance can significantly shorten the trial and error cycle.Hong Kong MSO with long-term coverage by 88MSO, SFC, Insurance brokerage and money lender licensing projects as an example, What companies benefit most from is often not "getting the template", But "turn templates into executable daily mechanisms".This is also what regulators value most."Ongoing Compliance Capabilities".

eight, Conclusion: 2026 is not a "new burden", It's a window for industry reshuffle

The essence of continuous upgrading of Hong Kong's AMLO framework, It is to promote the financial market from "license compliance" to "operation compliance".For licensed institutions, CDD and PEPs screening is no longer a back-end process, It is a prerequisite for business sustainability.Who can complete the system earlier?, data, Linkage between systems and governance, Who can gain more stable customer trust and cooperation opportunities in a stricter regulatory environment?.

If you are planning a license application, License maintenance or inventory compliance rectification, It is recommended to conduct a gap assessment with CDD and PEPs as the core as soon as possible, Identify high-risk items that "must be fixed immediately".The sooner you act, The lower the rectification costs, Regulatory risks are more controllable.

FAQ: The 4 issues that licensed institutions are most concerned about

Q1: Do I have to refuse to open an account after a PEP hit?

uncertain.The key is whether adequate EDD is completed, Is there executive approval?, Are controllable and continuous monitoring measures in place?.

Q2: Can the CDD review cycle be unified once a year?

Not recommended.Frequency should be set according to risk stratification, Unified cycles can easily lead to resource misallocation, It is also inconsistent with the risk-based principle.

Q3: Does only cross-border business need to pay attention to AMLO?

no.As long as it is a regulated business and involves client funds or transactions, All AML/CDD requirements should be strictly implemented.

Q4: What should I do if the system screening accuracy is not high?

Manage customer master data first, Then optimize the matching rules (alias, spell, Language conversion, threshold), And establish a closed loop of manual review.

Relevant compliance information: Hong Kong MSO Money Services License Application Requirements.