This question assesses the application of enhanced due diligence (EDD) measures under Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and related SFC guidelines. Statement I is correct because identifying and verifying the ultimate beneficial owners (UBOs) is a fundamental requirement of customer due diligence, and it is especially critical for a complex structure like an investment fund from a high-risk jurisdiction. Statement II is correct as the AMLO explicitly requires that for high-risk business relationships, a licensed corporation must obtain approval from its senior management to establish or continue the relationship. Statement III is incorrect because EDD mandates taking reasonable measures to establish the source of wealth and source of funds. Relying solely on a client’s self-declaration without independent corroboration is insufficient, particularly for a high-risk client. Statement IV is correct because a key component of managing a high-risk relationship is to conduct enhanced ongoing monitoring of the business relationship, which includes scrutinizing transactions more frequently and intensively to identify any suspicious activity. Therefore, statements I, II and IV are correct.

The correct answer is that the provider must conduct enhanced due diligence (EDD) to assess and mitigate the higher risks associated with the client. According to Hong Kong’s Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations), a risk-based approach is mandatory. When a potential client is identified as being from a jurisdiction with higher money laundering or terrorist financing risks, standard due diligence is insufficient. The depositary must take additional steps, such as obtaining more detailed information on the source of wealth and funds, understanding the purpose of the account, and securing senior management approval before establishing the business relationship. This process is known as EDD. Simply applying standard due diligence procedures would be a regulatory breach, as it fails to address the elevated risk profile. Immediately rejecting the business without conducting a proper risk assessment is not the prescribed initial step; the regulations allow for managing high-risk clients provided appropriate mitigating controls (like EDD) are in place. Reporting the application to the Joint Financial Intelligence Unit (JFIU) is premature, as no suspicious transaction has occurred; reporting obligations are triggered by suspicion of illicit activities, not by the client’s origin alone.

The explanation teaches the concept of suspicious transaction reporting under Hong Kong’s anti-money laundering framework. The correct course of action, upon forming a suspicion of money laundering or terrorist financing, is to file a Suspicious Transaction Report (STR) with the Joint Financial Intelligence Unit (JFIU) as soon as is reasonably practicable. This is a primary obligation under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO). Critically, this report must be made without alerting the client, as doing so would constitute ‘tipping off’, which is a serious offense. The option to immediately terminate the client relationship without reporting is incorrect because the legal duty to report the suspicion to the authorities takes precedence. While termination may be a subsequent commercial decision, it does not fulfill the regulatory reporting requirement. The option to only increase the frequency of monitoring and await further suspicious activity is also incorrect; the obligation to report arises as soon as a suspicion is formed, and delaying the report is a breach of the ordinance. Finally, directly confronting the client with the suspicion and demanding a full explanation before taking action is wrong because it amounts to tipping off, which could prejudice an investigation.

This question assesses the understanding of the dual regulatory framework in Hong Kong for financial institutions that are both Authorized Institutions (AIs) under the Hong Kong Monetary Authority (HKMA) and also registered with the Securities and Futures Commission (SFC) to conduct regulated activities. Statement I is correct because the HKMA is the primary regulator for the prudential supervision of all AIs, focusing on their financial soundness, capital adequacy, and liquidity, which are foundational to their ability to provide safe depositary services. Statement II is correct as any entity, including an AI registered with the SFC (known as a Registered Institution), must comply with the SFC’s Code of Conduct concerning the business practices and standards of conduct for its regulated activities, such as securities custody. Statement III is incorrect because while the SFC has its Guideline on Anti-Money Laundering and Counter-Financing of Terrorism, the HKMA also issues its own comprehensive AML/CTF Guideline that applies to the entire AI. The supervision is a joint effort, not the sole responsibility of the SFC. Statement IV is incorrect because when an AI provides depositary services that fall under a regulated activity (e.g., Type 1 – Dealing in Securities, which includes providing custody), it must be registered with the SFC for that activity. Therefore, statements I and II are correct.

The correct course of action is to file a Suspicious Transaction Report (STR) with the Joint Financial Intelligence Unit (JFIU) as soon as reasonably practicable. According to Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), when a financial institution knows, suspects, or has reasonable grounds to suspect that any property is connected to an indictable offense, it has a mandatory obligation to report it. The combination of a Politically Exposed Person (PEP) from a high-risk jurisdiction, a complex ownership structure, and a vaguely explained, large, third-party payment constitutes strong grounds for suspicion. The institution should also consider freezing the onboarding process and refraining from completing the transaction until it has fulfilled its reporting duties. Informing the client that a report will be filed constitutes ‘tipping off’, which is a serious criminal offense under the AMLO. While enhanced due diligence is required for PEPs, it does not replace the obligation to file an STR when suspicion arises; simply proceeding with enhanced monitoring is insufficient in this case. Seeking further clarification from the client should not delay the filing of an STR once a suspicion has been formed, as the primary duty is to report.

Under Hong Kong’s regulatory framework, particularly the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and the SFC’s Guideline on Anti-Money Laundering and Counter-Financing of Terrorism, a licensed corporation providing depositary services has direct compliance obligations. Statement I is correct because the identification of complex, unusually large transactions involving a high-risk jurisdiction constitutes reasonable grounds for suspicion. This triggers the legal requirement to file a Suspicious Transaction Report (STR) with the Joint Financial Intelligence Unit (JFIU). Statement III is also correct as the risk-based approach mandates that when high-risk factors are present, the institution must apply enhanced due diligence (EDD) to better understand the client’s profile, source of funds, and the rationale behind the transactions. Statement II is incorrect; a depositary cannot unilaterally freeze client assets based on suspicion alone, as this action typically requires a formal directive from law enforcement or a court order. Their primary duty is to report, not to enforce. Statement IV is incorrect because AML/CTF obligations are independent for each licensed entity. The depositary cannot delegate its legal responsibility to file an STR to the fund manager, even if the fund manager also has its own reporting duties. Therefore, statements I and III are correct.

The correct answer is that the depositary must implement enhanced due diligence measures to identify and verify the ultimate beneficial owners and the source of wealth of the fund. According to Hong Kong’s Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations), a risk-based approach is mandatory. When high-risk factors are present, such as a client from a jurisdiction with known AML/CFT deficiencies (as identified by FATF) and a complex, opaque ownership structure (like multiple shell corporations), standard due diligence is insufficient. The firm is required to apply Enhanced Due Diligence (EDD). This involves taking additional, more stringent measures to understand the client’s background, the nature of its business, its source of wealth and funds, and to identify the ultimate beneficial owners (UBOs) behind the corporate layers. The option to proceed with standard client due diligence is incorrect because the presence of clear high-risk indicators legally obligates the firm to escalate its verification processes beyond the standard level. Treating an institutional client from a high-risk jurisdiction with a complex structure as a typical low-risk case would be a significant compliance failure. The suggestion to immediately decline the business relationship without assessment is also incorrect. While the firm may ultimately decide to reject the client, the required regulatory step is to first conduct a thorough risk assessment via EDD to make an informed decision. An automatic rejection without assessment is not the prescribed procedure. Finally, focusing on commercial terms like the service level agreement before completing mandatory AML/CFT checks is a serious breach of regulatory priorities. Compliance obligations must always be satisfied before finalizing a business relationship.

This question assesses the application of Hong Kong’s Anti-Money Laundering (AML) and Know Your Customer (KYC) requirements for a depositary service provider. According to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) and relevant SFC guidelines, financial institutions have specific obligations.

Statement I is correct. A fundamental principle of customer due diligence (CDD) is to identify the ultimate beneficial owners (UBOs) of a client, especially when dealing with complex legal structures like offshore funds with nominee shareholders. The depositary cannot simply accept the corporate structure at face value and must take reasonable measures to look through it.

Statement II is correct. Establishing the source of wealth (SOW) and source of funds (SOF) is a critical component of the risk-based approach to AML. For a new fund, understanding where the initial capital originated is essential to ensure the assets are not proceeds of crime.

Statement III is incorrect. While the AMLO allows for reliance on a third party to carry out some CDD measures, it does not permit the ‘full delegation’ of responsibility. The Hong Kong depositary remains ultimately responsible for ensuring that the CDD requirements are met. It must satisfy itself that the third party is reliable and regulated, and it must obtain all necessary information from the third party to fulfill its own obligations.

Statement IV is correct. The risk-based approach is central to Hong Kong’s AML regime. The depositary must conduct a risk assessment of the new client. If the complex structure, jurisdiction, or other factors lead to a high-risk classification, enhanced due diligence (EDD) measures, such as more intensive verification and more frequent transaction monitoring, are required. Therefore, statements I, II and IV are correct.

For a collective investment scheme (CIS) authorized by the Securities and Futures Commission (SFC) under the Code on Unit Trusts and Mutual Funds (UT Code), the depositary (often a trustee or custodian) has several core regulatory duties. Statement I is correct as the primary function of a depositary is the safekeeping of the scheme’s assets, holding them in custody or under its control for the benefit of the unitholders. Statement II is also correct; the depositary has a critical oversight function to ensure the fund manager adheres to the investment and borrowing restrictions outlined in the scheme’s constitutive documents (e.g., the trust deed). Statement IV accurately describes the depositary’s cash monitoring responsibilities, which involve overseeing all cash flows and verifying that subscription monies from investors are properly received. Statement III is incorrect because the formulation of investment strategy and the execution of trades are the responsibilities of the fund manager, not the depositary. The depositary’s role is to oversee these activities, not to perform them. Therefore, statements I, II and IV are correct.

The correct answer is that the firm must apply enhanced due diligence measures, which must include obtaining approval from senior management before establishing the business relationship. According to Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and the SFC’s Guideline on Anti-Money Laundering and Counter-Financing of Terrorism, when a client or their beneficial owner is identified as a Politically Exposed Person (PEP), licensed corporations are required to implement enhanced due diligence (EDD). A critical and mandatory step in this process is to secure approval from senior management before establishing a business relationship. This ensures that the heightened risks associated with PEPs are acknowledged and accepted at an appropriate level within the firm. Simply proceeding with onboarding while planning for more frequent reviews is insufficient as it bypasses the crucial pre-approval step required by the regulations. Reporting the potential client directly to the Securities and Futures Commission (SFC) is incorrect; the designated authority for receiving Suspicious Transaction Reports (STRs) in Hong Kong is the Joint Financial Intelligence Unit (JFIU). Rejecting the application and informing the client about their high-risk profile, while a possible outcome, is not the correct immediate procedure and could potentially be construed as ‘tipping off’ if a suspicion is later formed and reported.

The correct answer is that the firm is obligated to file a Suspicious Transaction Report (STR) with the Joint Financial Intelligence Unit (JFIU). Under Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), when a financial institution knows or suspects that any property represents proceeds of an indictable offence or is connected to terrorist financing, it must, as soon as is reasonably practicable, disclose that knowledge or suspicion to an authorized officer, which is done by filing an STR with the JFIU. This is a primary and mandatory legal obligation. Simply reporting the matter to the firm’s primary regulator, the Securities and Futures Commission (SFC), does not fulfill this specific statutory reporting duty, as the JFIU is the designated body for receiving such reports. While requesting further documentation from the client is part of ongoing due diligence, it should not delay the filing of an STR once suspicion has been formed; the legal threshold is ‘suspicion,’ not certainty. Immediately terminating the client relationship is a commercial and risk management decision, but it is not a substitute for the legal requirement to report the suspicion to the authorities. Furthermore, taking such an action without careful consideration could potentially ‘tip off’ the client, which is a separate offence under the ordinance.

This question assesses the understanding of Enhanced Due Diligence (EDD) measures required under Hong Kong’s anti-money laundering framework, specifically the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations). When a client is identified as high-risk, such as being from a jurisdiction with strategic AML/CFT deficiencies noted by the FATF, standard Client Due Diligence (CDD) is insufficient.

Statement I is correct because establishing a business relationship with a high-risk client requires approval from senior management. This ensures appropriate oversight and accountability.

Statement II is correct as a fundamental component of EDD is to take reasonable measures to establish the client’s and beneficial owner’s source of wealth and the source of funds for the specific transactions. This helps to ensure the assets are not derived from illicit activities.

Statement III is incorrect. While information from other financial institutions can be considered, a licensed corporation cannot rely solely on it to fulfill its own KYC obligations, especially for a high-risk client. The depositary must conduct its own independent verification and due diligence.

Statement IV is correct. EDD is not a one-time process at onboarding. It requires enhanced and ongoing monitoring of the relationship, which includes scrutinizing transactions more frequently and deeply to identify any unusual or suspicious patterns. Therefore, statements I, II and IV are correct.

This question assesses the application of enhanced due diligence (EDD) measures under Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and related SFC guidelines. Statement I is correct because identifying and verifying the ultimate beneficial owners (UBOs) is a fundamental requirement of customer due diligence, especially for complex structures like an SPC. Statement II is correct as establishing the source of wealth (SOW) and source of funds (SOF) is a critical EDD measure when dealing with higher-risk clients, such as those using complex offshore structures. Statement IV is correct because high-risk clients necessitate enhanced ongoing monitoring to detect unusual or suspicious transactions promptly. Statement III is incorrect. While information from a regulated third party can be considered, a licensed corporation in Hong Kong cannot delegate its AML/CFT obligations. It must conduct its own independent risk assessment and due diligence and cannot rely exclusively on the checks performed by another entity, even if that entity is in a FATF member jurisdiction. The ultimate responsibility remains with the Hong Kong licensed corporation. Therefore, statements I, II and IV are correct.

Under Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and the SFC’s Guideline on Anti-Money Laundering and Counter-Financing of Terrorism, a depositary service provider must conduct thorough Customer Due Diligence (CDD). Statement I is correct because identifying and verifying the legal entity (the fund) and its key controllers (directors, investment manager) is a fundamental step. Statement II is also correct as the risk-based approach requires identifying the ultimate beneficial owners (UBOs) who ultimately own or control the client, which is crucial for understanding the source of funds and potential risks. Statement III is incorrect because while the AMLO allows for reliance on CDD performed by third parties under specific conditions, the ultimate responsibility for ensuring CDD is properly conducted remains with the financial institution (the depositary). It cannot ‘solely rely’ on the checks without meeting stringent criteria and retaining accountability. Statement IV is incorrect because the application of simplified due diligence (SDD) is not automatic for institutional clients. A risk-based assessment must be performed. In this case, the client’s structure (Cayman SPC), cross-border nature, and investor base could be considered higher-risk factors, potentially requiring enhanced due diligence (EDD) rather than SDD. Therefore, statements I and II are correct.

This question assesses the understanding of the distinct yet overlapping roles of Hong Kong’s key financial regulators concerning depositary services provided by a licensed bank.

Statement I is correct. As an authorized institution under the Banking Ordinance, a licensed bank’s primary prudential supervisor is the Hong Kong Monetary Authority (HKMA). The HKMA is responsible for the stability of the banking system and oversees the bank’s overall financial health, including its capital adequacy, liquidity, and internal control systems.

Statement II is also correct. The Securities and Futures Commission (SFC) regulates the securities and futures markets. When a bank acts as a depositary (or trustee/custodian) for an SFC-authorized Collective Investment Scheme (CIS), it falls under the SFC’s purview for that specific function. The SFC sets the rules for the authorization of the CIS and the eligibility, duties, and operational conduct of its depositary, as detailed in regulations like the Code on Unit Trusts and Mutual Funds.

Statement III is incorrect. Under the Securities and Futures Ordinance (SFO), licensed banks are considered ‘exempt persons’ for certain regulated activities, including dealing in securities (Type 1) when it is ancillary to their main banking business. Providing custody or depositary services is typically part of this exemption. Therefore, the bank does not need to obtain a separate Type 1 license from the SFC, although it must still comply with the SFC’s applicable codes and conduct requirements.

Statement IV is incorrect. The Mandatory Provident Fund Schemes Authority (MPFA) has a specific mandate to regulate MPF schemes and their service providers. Its jurisdiction does not extend to non-MPF retail funds or other types of CIS. The SFC is the lead regulator for publicly offered non-MPF funds. Therefore, statements I and II are correct.

This question assesses the application of Hong Kong’s Anti-Money Laundering (AML) and Know Your Customer (KYC) requirements for a depositary service provider dealing with a high-risk client. Statement I is correct because a client from a jurisdiction with known AML/CFT deficiencies, combined with a complex ownership structure, automatically triggers the need for Enhanced Due Diligence (EDD) under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO). EDD involves gathering more detailed information, such as the specific source of funds and wealth. Statement II is correct as identifying and verifying the Ultimate Beneficial Owners (UBOs) is a fundamental requirement of customer due diligence, especially when dealing with opaque corporate structures like layered shell companies. Statement III is incorrect because a Hong Kong licensed corporation must adhere to Hong Kong’s AML/CFT standards. While reliance on third-party CDD is permitted under specific circumstances, it is generally not appropriate for high-risk clients, and certainly not when the third party is in a jurisdiction with weaker standards. Statement IV is incorrect because the AMLO mandates ongoing monitoring of business relationships. For high-risk clients, this monitoring must be more frequent and intensive; a one-time assessment at onboarding is insufficient. Therefore, statements I and II are correct.

The correct answer is that the firm must insist on obtaining satisfactory evidence to identify and verify the ultimate beneficial owners and understand the complete ownership structure before proceeding. According to Hong Kong’s Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations), a fundamental Know Your Customer (KYC) obligation is to identify and take reasonable measures to verify the identity of the ultimate beneficial owners (UBOs). For a client with a complex ownership structure from a jurisdiction with low transparency, enhanced due diligence (EDD) is required. This involves taking more stringent measures to understand the ownership and control structure. If the firm cannot satisfactorily identify the UBOs, it must not establish a business relationship. Proceeding to open the account while planning for enhanced monitoring is incorrect because the initial due diligence requirements have not been met; monitoring is a subsequent step for managing an established relationship, not a substitute for proper onboarding. Accepting a signed declaration from a director is insufficient as it is not an independent verification of the UBO’s identity and does not fulfill the ‘reasonable measures’ requirement. While reliance on an introducer’s due diligence is permitted under specific circumstances, the ultimate responsibility for compliance remains with the depositary firm, and in a high-risk scenario like this, direct verification is expected.

The correct answer is that the depositary must not establish a business relationship until customer due diligence measures, including the identification and verification of the ultimate beneficial owners, are satisfactorily completed. According to Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), financial institutions are obligated to conduct thorough Customer Due Diligence (CDD) before entering into a business relationship. This is a foundational requirement. In situations presenting higher risk, such as complex ownership structures involving offshore entities and a client’s unwillingness to provide transparency, enhanced due diligence is required. Proceeding without identifying the ultimate beneficial owners would be a serious regulatory breach. Filing a Suspicious Transaction Report (STR) is an obligation when there is knowledge or suspicion of money laundering, but it does not replace the primary duty to complete CDD before onboarding. Establishing the relationship on a provisional basis is generally not permitted when fundamental CDD information is missing, as it exposes the institution to unacceptable risks. Relying on a client’s declaration or promise to provide information later is insufficient and does not fulfill the institution’s legal responsibility to independently verify the client’s identity and ownership structure.

This question assesses the understanding of Enhanced Due Diligence (EDD) measures required for high-risk clients under Hong Kong’s anti-money laundering (AML) framework, specifically the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations). When dealing with a client from a jurisdiction with strategic AML deficiencies, a licensed corporation like a depositary must apply EDD.

Statement I is correct. For any high-risk business relationship, obtaining approval from senior management is a mandatory EDD measure. This ensures appropriate oversight and accountability for taking on higher-risk clients.

Statement II is correct. A fundamental component of EDD is to take reasonable and adequate measures to establish the client’s (and their beneficial owners’) source of wealth and source of funds. This helps the firm understand the legitimacy of the assets being managed.

Statement III is incorrect. A Suspicious Transaction Report (STR) should only be filed when there is knowledge or suspicion that property represents proceeds of crime or is connected to terrorist financing. The client’s high-risk jurisdiction is a trigger for EDD, not an automatic basis for suspicion. Filing an STR without genuine suspicion is inappropriate; the EDD process itself is designed to assess and manage the risk.

Statement IV is correct. High-risk relationships must be subject to enhanced ongoing monitoring. This involves more frequent reviews of the relationship and greater scrutiny of transactions to identify any unusual or suspicious activity promptly. Therefore, statements I, II and IV are correct.

The correct course of action is to escalate the matter internally to senior management and consider filing a Suspicious Transaction Report (STR) with the Joint Financial Intelligence Unit (JFIU). According to Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and related SFC guidelines, when a licensed corporation identifies a transaction or client activity it suspects is related to money laundering or terrorist financing, it has a legal obligation to report it. The combination of red flags—a Politically Exposed Person (PEP) from a high-risk jurisdiction, vague source of wealth documentation, and pressure for an urgent, unusual third-party transaction—is sufficient to form such a suspicion. Escalation ensures the firm’s senior management is aware and can direct the STR filing process. Proceeding with the account opening, even with enhanced monitoring, would be a serious compliance breach given the high-risk indicators. The firm should not simply request more documents as the primary next step when a strong suspicion has already been formed; the obligation to report takes precedence. Finally, immediately rejecting the client and informing them of a report to the authorities constitutes ‘tipping off’, which is a criminal offence under the AMLO as it could prejudice an investigation.

A detailed breakdown of the statements reveals the correct compliance obligations. Statement I is correct because dealing with a client whose assets originate from a jurisdiction identified as having higher money laundering risks necessitates Enhanced Due Diligence (EDD) as stipulated by the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (for Licensed Corporations). A standard KYC process would be insufficient. Statement II is correct because the combination of a new client, a large transaction, and a high-risk jurisdiction constitutes potential red flags. The Responsible Officer has a statutory obligation under the Organized and Serious Crimes Ordinance (OSCO) to report any transaction they suspect is related to the proceeds of an indictable offence to the Joint Financial Intelligence Unit (JFIU). Statement III is incorrect; a licensed corporation cannot simply delegate its AML/CFT responsibilities. While it may place some reliance on due diligence performed by other regulated institutions, it must satisfy itself of the adequacy of those procedures and ultimately retains full responsibility for its own compliance. Statement IV is incorrect because the Personal Data (Privacy) Ordinance (PDPO) contains provisions that permit the collection and use of personal data for purposes required by law, which includes fulfilling AML/CFT obligations. Therefore, statements I and II are correct.

Under the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) applicable to licensed corporations in Hong Kong, a firm must not establish a business relationship if it is unable to complete the required customer due diligence (CDD) measures. A critical component of CDD is the identification and verification of the ultimate beneficial owners (UBOs) of a client. When a potential client, particularly one from a high-risk jurisdiction, is unable or unwilling to provide satisfactory information to identify its UBOs, this constitutes a failure of the CDD process. The correct course of action is to decline to establish the business relationship. Furthermore, the circumstances surrounding the refusal to provide information and the complex structure may give rise to a suspicion of money laundering or terrorist financing, which would obligate the firm to consider filing a Suspicious Transaction Report (STR) with the Joint Financial Intelligence Unit (JFIU). Proceeding with the relationship, even with a high-risk rating and enhanced monitoring, is a violation because the initial CDD was incomplete. Enhanced monitoring is applied to clients for whom CDD has been successfully completed but who are assessed as high-risk; it is not a remedy for failed CDD. Establishing a provisional relationship while awaiting information is also not compliant, as the regulations require CDD to be completed before the relationship commences. Seeking a waiver from the SFC for such a fundamental requirement is not a standard or acceptable procedure, as the onus of performing adequate CDD rests squarely on the licensed corporation.

A detailed breakdown of the regulatory requirements for a firm providing custody services in Hong Kong is as follows:

Statement I is correct. Providing custody for securities is often intrinsically linked to other regulated activities. If a firm holds client assets as part of its business of dealing in securities, it must be licensed by the Securities and Futures Commission (SFC) for Type 1 (Dealing in Securities) regulated activity. The SFC’s Code of Conduct and the Securities and Futures (Client Money) Rules and (Client Securities) Rules would apply.

Statement II is correct. The Securities and Futures Ordinance (SFO) does not define ‘pure’ or ‘standalone’ custody as a distinct type of regulated activity. Therefore, a firm offering only custody without conducting any other regulated activity (like dealing or asset management) might not need an SFC license. However, if the assets are held under a trust arrangement, the firm would have duties as a trustee under the Trustee Ordinance (Cap. 29).

Statement III is incorrect. The Hong Kong Monetary Authority (HKMA) is the primary regulator for Authorized Institutions (i.e., licensed banks, restricted licence banks, and deposit-taking companies). It does not license standalone custody providers that are not Authorized Institutions. Such firms would fall under the SFC’s purview if their activities constitute a regulated activity, or other regimes like the TCSP.

Statement IV is correct. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) (Cap. 615) requires any person who provides trust or company services as a business in Hong Kong to obtain a Trust or Company Service Provider (TCSP) licence from the Registrar of Companies. If the custody arrangement involves the creation and administration of trusts for holding client assets, the provider would need a TCSP licence. Therefore, statements I, II and IV are correct.

According to Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and related guidelines from the Securities and Futures Commission (SFC), when a licensed corporation forms a suspicion that a client’s funds or assets may be related to the proceeds of an indictable offence, it has a statutory obligation to report this. The correct course of action is to escalate the matter internally and file a Suspicious Transaction Report (STR) with the Joint Financial Intelligence Unit (JFIU) as soon as it is reasonably practicable. The presence of multiple red flags, such as an overly complex ownership structure, the use of shell companies in high-risk jurisdictions, and a vaguely defined source of wealth, constitutes reasonable grounds for suspicion. The institution should also consider delaying the onboarding process or refusing the business relationship until these significant concerns are resolved. Simply proceeding with onboarding under enhanced monitoring is insufficient as it fails to address the immediate legal requirement to report the suspicion. Informing the client directly about the suspicion of money laundering constitutes ‘tipping off’, which is a serious criminal offence under the AMLO. While requesting further documentation is a standard part of due diligence, it does not suspend the obligation to file an STR once a suspicion has already been formed; delaying the report pending a client’s response could breach regulatory requirements.

The correct answer is that the firm must obtain a Type 13 licence for providing depositary services for SFC-authorized collective investment schemes. This specific regulated activity was introduced under the Securities and Futures Ordinance (SFO) to strengthen the regulatory oversight of entities acting as top-level depositaries for public funds in Hong Kong, ensuring they meet specific competence and financial soundness requirements. The role of a depositary for an SFC-authorized fund involves not just safekeeping assets but also oversight duties, which is distinct from other regulated activities. A Type 1 licence for dealing in securities pertains to executing trades or acting as a broker, which is a different function from asset custody and oversight. A Type 9 licence for asset management is required for entities that make investment decisions and manage portfolios, which is the role of the fund manager, not the depositary. While the entity may need to be registered as a Trust or Company Service Provider (TCSP) with the Companies Registry for AML/CTF purposes related to its trust services, this is separate from and does not satisfy the SFC’s specific licensing requirement for providing depositary services to regulated funds.

The correct answer is that the firm must, without delay, file a Suspicious Transaction Report (STR) with the Joint Financial Intelligence Unit (JFIU) and consider freezing the assets. According to Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and the SFC’s Guideline on Anti-Money Laundering and Counter-Financing of Terrorism, when a licensed corporation knows or suspects that property is related to an indictable offence or terrorist activity, it has a statutory obligation to report it. The discovery of a sanctioned UBO is a major red flag that triggers this reporting duty. The action must be taken promptly and without alerting the client, as ‘tipping off’ is a serious offence. Simply terminating the relationship and returning the assets is incorrect because this could facilitate the movement of illicit funds, defeating the purpose of the AML regime. Requesting an explanation from the client before reporting is also incorrect as it could constitute tipping off and would cause an unnecessary delay in reporting the suspicion. While enhancing the client’s risk rating is a valid risk management step, it is an insufficient response to a direct sanctions match and does not fulfill the immediate legal obligation to file an STR.

This question assesses the understanding of the overlapping and distinct roles of Hong Kong’s key financial regulators concerning depositary services for a public fund. Statement I is correct because the Securities and Futures Commission (SFC) is the primary regulator for collective investment schemes (funds) offered to the public in Hong Kong. It authorizes these funds and regulates the conduct of the fund managers under the Securities and Futures Ordinance (SFO). Statement II is correct because the entity is also an authorized institution (a bank), making the Hong Kong Monetary Authority (HKMA) its primary prudential supervisor. The HKMA oversees the bank’s safety and soundness, including its capital adequacy, risk management, and trust business operations. Statement IV is correct as the SFC’s Code on Unit Trusts and Mutual Funds specifically outlines the stringent eligibility criteria, responsibilities, and operational duties for trustees and custodians of SFC-authorized funds to protect investors. Statement III is incorrect. The Mandatory Provident Fund Schemes Authority (MPFA) regulates MPF schemes and their approved trustees. While this retail fund might later be included as an underlying investment in an MPF scheme, the MPFA is not involved in the initial appointment of the custodian for a standard SFC-authorized retail fund. Therefore, statements I, II and IV are correct.

The correct answer is that the provider must conduct enhanced due diligence to fully understand the trust’s ownership structure and verify the source of wealth of the settlors and ultimate beneficial owners. According to Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and the SFC’s Guideline on Anti-Money Laundering and Counter-Financing of Terrorism, a risk-based approach is mandatory. A complex trust structure established in a jurisdiction with less stringent transparency standards presents a higher risk of money laundering or terrorist financing. This triggers the need for enhanced due diligence (EDD), which goes beyond standard customer due diligence (CDD). EDD requires obtaining additional information on the client, understanding the purpose of the trust, identifying all relevant parties (settlor, trustee, protector, beneficiaries, ultimate beneficial owners), and taking reasonable measures to verify their source of wealth and funds. Proceeding with standard due diligence would be inadequate given the heightened risk factors. Relying solely on the certification from the client’s legal counsel without independent verification fails to meet the licensed corporation’s direct obligation to conduct its own due diligence. Deferring the identification of beneficial owners until after the initial asset transfer is a direct violation of the principle that due diligence must be completed before establishing a business relationship, especially for high-risk clients.

The correct course of action is to insist on completing enhanced due diligence to identify and verify the ultimate beneficial owners of the fund before establishing the business relationship, irrespective of the client’s trading deadline. According to Hong Kong’s Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) Guideline, financial institutions must complete customer due diligence (CDD) measures before establishing a business relationship. In this scenario, several high-risk factors are present: the client is from a jurisdiction with known AML/CFT deficiencies and has a complex, opaque ownership structure. These factors mandate the application of Enhanced Due Diligence (EDD). The core of EDD is to take additional measures to understand the client’s ownership and control structure and to identify and verify the ultimate beneficial owners (UBOs). Commercial pressure from the client cannot be used as a justification to circumvent these critical regulatory requirements. Opening a temporary or restricted account before completing due diligence is a direct violation of the principle of conducting CDD prior to establishing a relationship, as it exposes the firm to significant money laundering risks. Relying solely on a signed declaration from a director is insufficient, as the guideline requires the institution to take reasonable and independent measures to verify the information provided, especially in a high-risk context. Filing a Suspicious Transaction Report (STR) at this stage is premature; the obligation is to first conduct the necessary due diligence. An STR should be filed if, during or after the EDD process, a suspicion of money laundering or terrorist financing is formed, for instance, if the client is unwilling or unable to provide the required information.

This question assesses the understanding of the distinct roles of key regulatory bodies in Hong Kong overseeing a firm that provides depositary services.

Statement I is correct. The Securities and Futures Commission (SFC) is the primary regulator for licensed corporations in Hong Kong. It grants licenses for regulated activities and enforces the Code of Conduct for Persons Licensed by or Registered with the SFC. For firms acting as custodians or trustees for SFC-authorized collective investment schemes, the SFC imposes specific requirements under the Code on Unit Trusts and Mutual Funds.

Statement II is incorrect. The Hong Kong Monetary Authority (HKMA) is the primary regulator for Authorized Institutions (i.e., banks) and oversees the stability of the financial system, including payment and settlement systems like the Central Moneymarkets Unit (CMU). However, the SFC is the direct conduct regulator for a licensed corporation’s activities, including its operational processes related to securities.

Statement III is correct. The Mandatory Provident Fund Schemes Authority (MPFA) is the statutory body responsible for regulating the MPF system. It sets out specific approval criteria, guidelines, and ongoing obligations for service providers to MPF schemes, including custodians, under the Mandatory Provident Fund Schemes Ordinance. An entity must be specifically approved by the MPFA to act as a custodian for an MPF scheme.

Statement IV is incorrect. While licensed corporations must comply with the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, the SFC is the authority responsible for issuing guidelines and monitoring compliance with AML/CFT requirements for the entities it licenses. Hong Kong Exchanges and Clearing Limited (HKEX) is the operator of the stock and futures markets and is not the primary regulator for a custodian’s internal AML policies. Therefore, statements I and III are correct.