The Securities and Futures Commission (SFC) is the primary regulator for licensing and supervising entities that conduct regulated activities in Hong Kong, as defined in the Securities and Futures Ordinance (SFO). Providing custody services for a collective investment scheme (CIS) falls under regulated activities, typically Type 1 (Dealing in Securities). Therefore, the SFC’s involvement is essential. If the entity providing depositary services is an authorized institution (AI), such as a licensed bank, it is primarily regulated by the Hong Kong Monetary Authority (HKMA) under the Banking Ordinance. The HKMA and SFC have a Memorandum of Understanding to coordinate the supervision of AIs’ securities-related businesses. The Mandatory Provident Fund Schemes Authority (MPFA) specifically regulates custodians for MPF schemes, not all types of investment funds. The Financial Services and the Treasury Bureau (FSTB) is a government body responsible for setting financial policy and legislation, but it does not directly license or supervise financial intermediaries. Therefore, statements I and II are correct.

This question assesses the understanding of the dual regulatory framework in Hong Kong governing financial institutions that are both Authorized Institutions (AIs) under the Banking Ordinance and registered with the Securities and Futures Commission (SFC) for conducting regulated activities. Statement I is correct because any entity conducting SFC-regulated activities, such as providing securities custody which falls under dealing in securities (Type 1), must adhere to the SFC’s Code of Conduct. This applies to both licensed corporations and registered institutions. Statement II is also correct. The Hong Kong Monetary Authority (HKMA) is the primary prudential supervisor for all AIs (i.e., licensed banks, restricted licence banks, and deposit-taking companies). This oversight covers the institution’s overall operational and financial soundness, including the risk management frameworks for all its business lines, such as depositary services. Statement III is incorrect because the SFC’s role does not replace the HKMA’s. Instead, they have complementary roles. The HKMA focuses on the prudential supervision of the entire institution, while the SFC focuses on the conduct of its regulated activities. Statement IV is incorrect as the International Organization of Securities Commissions (IOSCO) is an international standard-setting body that promotes cooperation among securities regulators. It does not have the authority to directly license or regulate individual financial institutions in any jurisdiction, including Hong Kong. Therefore, statements I and II are correct.

The correct answer is that the Securities and Futures Commission (SFC) is the primary regulator. For collective investment schemes (CIS) authorized by the SFC for public offering in Hong Kong, the SFC sets out specific requirements for the scheme’s trustee or custodian. These requirements are detailed in the Code on Unit Trusts and Mutual Funds. The SFC’s oversight is crucial for ensuring the protection of the investing public by regulating the structure, operation, and service providers of these funds, including the depositary. The Hong Kong Monetary Authority (HKMA) is responsible for the prudential supervision of authorized institutions (i.e., licensed banks, restricted licence banks, and deposit-taking companies), many of which provide custody services. However, in the context of an SFC-authorized fund, the SFC’s specific regulatory regime for the fund’s depositary takes precedence. The Financial Services and the Treasury Bureau (FSTB) is a government body responsible for formulating and implementing financial policies and the legal framework, but it does not act as the day-to-day supervisor of financial institutions. Hong Kong Exchanges and Clearing Limited (HKEX) operates the stock and futures markets and related clearing houses; its regulatory function is primarily concerned with listing rules and market operations, not the oversight of depositaries for investment funds.

Statement I is correct. The Securities and Futures Commission (SFC) is the primary regulator for public investment funds in Hong Kong. Under the SFC’s Code on Unit Trusts and Mutual Funds (UT Code), the SFC must approve the appointment of the trustee/custodian (depositary) for any authorized collective investment scheme (CIS), ensuring it meets specific eligibility criteria regarding capital, independence, and experience. Statement II is also correct. If the entity is a trust company, it falls under the supervisory ambit of the Hong Kong Monetary Authority (HKMA) concerning its trust business, as per the Trustee Ordinance. The HKMA oversees the company’s corporate governance, internal controls, and financial soundness. Statement III is incorrect. Providing pure depositary or custody services for a CIS is not, in itself, a Type 1 (Dealing in Securities) regulated activity under the Securities and Futures Ordinance (SFO). While many custodians may also be licensed for Type 1 for other business lines (like trade execution), the core qualification for acting as a depositary for an SFC-authorized fund is meeting the requirements of the UT Code, not holding a specific SFO license for that function. Statement IV is correct. The SFC’s regulatory requirements for custodians of public funds are heavily influenced by and aligned with international best practices, such as the Principles for the Custody of Collective Investment Scheme Assets established by the International Organization of Securities Commissions (IOSCO). Therefore, statements I, II and IV are correct.

The correct answer is that the firm must conduct enhanced due diligence and, if suspicions persist, file a Suspicious Transaction Report with the Joint Financial Intelligence Unit. Under Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and related SFC guidelines, financial institutions, including depositary service providers, are required to apply a risk-based approach. When a potential client presents high-risk factors, such as being incorporated in a jurisdiction with weak AML/CFT controls and being secretive about its ultimate beneficial owners, standard customer due diligence is insufficient. The firm must perform enhanced due diligence (EDD), which involves obtaining more detailed information on the source of wealth, source of funds, and the client’s business. If, after EDD, the firm still suspects that the funds may be related to criminal activity, it is legally obligated to file a Suspicious Transaction Report (STR) with the Joint Financial Intelligence Unit (JFIU) and should refuse to establish the business relationship. Simply accepting the client’s business while performing internal monitoring is a breach of regulatory duties, as it fails to address the external reporting obligation and exposes the firm to the risk of facilitating money laundering. Relying solely on a director’s self-declaration is inadequate, as it does not constitute independent verification, which is a cornerstone of effective due diligence. Reporting directly to the Securities and Futures Commission (SFC) for AML suspicions is incorrect; while the SFC is the primary regulator for licensed corporations, the designated authority for receiving and analyzing STRs is the JFIU.

The correct answer is that the firm must obtain approval from its senior management to establish the business relationship. According to Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and the associated SFC Guideline, when a potential client’s ultimate beneficial owner is identified as a Politically Exposed Person (PEP), the financial institution must implement Enhanced Due Diligence (EDD) measures. A mandatory step in this EDD process is to secure approval from senior management before establishing the business relationship. This ensures that the heightened risks associated with PEPs are reviewed and accepted at an appropriate level of authority within the firm. Filing a Suspicious Transaction Report (STR) with the Joint Financial Intelligence Unit (JFIU) is incorrect because being a PEP is a risk factor that triggers EDD, not an automatic cause for suspicion of money laundering. An STR is only required if the firm has knowledge or suspicion of criminal activity. Simply documenting the source of wealth and funds, while a critical component of EDD, is not the most crucial procedural step; the relationship cannot proceed at all without senior management’s explicit approval. Relying solely on the client’s self-declaration regarding their PEP status is insufficient and fails to meet the regulatory requirement for independent verification and risk assessment.

The correct answer is that for a client assessed as high-risk, particularly due to a complex ownership structure involving secretive jurisdictions, the depositary must conduct Enhanced Due Diligence (EDD). A fundamental component of EDD, as stipulated by the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism issued by the SFC, is to take reasonable measures to establish the source of wealth and source of funds of the beneficial owners. This goes beyond merely identifying them and is crucial for understanding the legitimacy of the assets being placed under custody. Filing a suspicious transaction report (STR) immediately is incorrect. An STR is filed when there is knowledge or suspicion that property represents proceeds of crime, not simply because a client is high-risk. The high-risk classification triggers EDD, which may or may not lead to suspicion. Obtaining senior management approval is also a required step for high-risk clients, but this approval should be based on the findings of the EDD, including the assessment of the source of wealth. The due diligence must be performed first to inform the decision. Simply verifying the identity of the directors is part of standard Customer Due Diligence (CDD) and is insufficient for a high-risk scenario where the primary concern is the opaque structure and the ultimate beneficial owners, not just the appointed management.

According to Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism issued by the SFC, a licensed corporation providing depositary services must implement robust customer due diligence (CDD) measures. Statement I is correct because identifying and verifying the ultimate beneficial owners (UBOs) is a fundamental requirement to understand who ultimately owns or controls the client. Statement II is correct as understanding the purpose of the account and the client’s source of wealth and funds is essential for risk assessment and for detecting unusual or suspicious activity. Statement IV is also correct because CDD is an ongoing process; licensed corporations must continuously monitor the business relationship and transactions to ensure they align with the client’s known profile. Statement III is incorrect because while the AMLO allows for reliance on intermediaries under specific conditions, a licensed corporation cannot rely solely on an introduction. It retains the ultimate responsibility for ensuring CDD requirements are met and must conduct its own verification, especially when dealing with a client from a jurisdiction with weaker AML/CFT standards, which presents a higher risk. Therefore, statements I, II and IV are correct.

This question assesses the application of Enhanced Due Diligence (EDD) measures as required by Hong Kong’s anti-money laundering regulations, specifically the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations) issued by the SFC. When dealing with a high-risk client, such as a fund from a jurisdiction with high secrecy, standard KYC is insufficient.

Statement I is correct. A fundamental component of EDD is to obtain and corroborate additional information on the client’s source of wealth (the origin of their total assets) and the source of funds (the origin of the specific funds being used for the business relationship). This helps to ensure the assets are not derived from illicit activities.

Statement II is correct. For legal persons or arrangements like a private fund, identifying and taking reasonable measures to verify the identity of the ultimate beneficial owners (UBOs) is a critical EDD step. This prevents the use of shell companies to obscure the identity of individuals behind the transactions.

Statement III is incorrect. While a self-declaration form is a part of the information-gathering process, relying ‘solely’ on it is a significant compliance failure, especially under EDD. The depositary service provider has an obligation to take reasonable measures to verify the information provided, using independent and reliable sources.

Statement IV is correct. EDD is not a one-time process at onboarding. It necessitates enhanced and ongoing monitoring of the business relationship and transactions. This includes scrutinizing transactions more frequently and in greater depth to identify any activity that is inconsistent with the client’s profile. Therefore, statements I, II and IV are correct.

The fundamental principle protecting client assets held by a licensed depositary in Hong Kong is the mandatory segregation of those assets from the firm’s own proprietary assets. As stipulated by the Securities and Futures (Client Securities) Rules and the Securities and Futures (Client Money) Rules, a licensed corporation must hold client assets in segregated accounts, effectively creating a statutory trust. This legal separation ensures that client assets do not form part of the firm’s general assets and are therefore protected from the claims of the firm’s creditors in the event of its insolvency or liquidation. The maintenance of sufficient regulatory capital is a prudential requirement to ensure the firm’s financial stability but does not directly shield client assets in a liquidation scenario. The Investor Compensation Fund offers a layer of protection, but it is a secondary recourse with specific compensation limits and is not the primary protective mechanism. Daily reporting to the SFC is a supervisory requirement for monitoring compliance; it does not in itself confer legal protection or priority over the assets.

Under the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism issued by the SFC, financial institutions, including depositary service providers, must apply enhanced due diligence (EDD) measures when dealing with high-risk clients. A client with a complex ownership structure involving a trust in a jurisdiction with limited transparency qualifies as high-risk. Statement I is correct because a fundamental part of EDD is to establish the source of wealth (SOW) and source of funds (SOF) of the ultimate beneficial owners to ensure the assets are legitimate. Statement II is correct as obtaining senior management approval is a required internal control measure before establishing a business relationship with a high-risk client. Statement IV is also correct because high-risk relationships necessitate enhanced and ongoing monitoring to detect any unusual or suspicious transactions promptly. Statement III is incorrect because relying solely on a client’s self-declaration for SOW, especially in a high-risk scenario, is insufficient. The licensed corporation is expected to take reasonable measures to verify the information provided. Therefore, statements I, II and IV are correct.

Under Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), when a financial institution, such as a depositary, identifies transactions it suspects are related to the proceeds of an indictable offence, it has a statutory obligation to report these suspicions. The correct procedure is to file a Suspicious Transaction Report (STR) with the Joint Financial Intelligence Unit (JFIU) as soon as is reasonably practicable. A critical component of this obligation is the prohibition against ‘tipping off’. Informing the client that a report is being filed or that their activities are under suspicion is a serious offence, as it could prejudice a potential investigation. Therefore, demanding a formal explanation from the client after suspicion has formed is incorrect. Simply increasing internal monitoring without reporting to the authorities fails to meet the legal requirement and exposes the firm to significant regulatory and legal risk. While the Securities and Futures Commission (SFC) is the primary regulator for the firm’s licensed activities, the JFIU is the specific agency designated to receive and analyse STRs related to money laundering and terrorist financing.

This question assesses the application of Hong Kong’s anti-money laundering (AML) and know-your-customer (KYC) regulations in the context of a depositary onboarding a new institutional client. Statement I is correct. Under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), a financial institution like Apex Custody is required to identify and take reasonable measures to verify the identity of the ultimate beneficial owners (UBOs) of its corporate clients. This includes identifying individuals who ultimately own or control more than 25% of the shares or voting rights. Statement III is also correct. A fundamental component of customer due diligence (CDD) is to understand the purpose and intended nature of the business relationship. For a depositary, this involves understanding the fund’s investment strategy, source of funds, and expected transactional activity to establish a baseline for ongoing monitoring. Statement II is incorrect. While the client being an SFC-licensed corporation may allow for simplified due diligence in certain low-risk situations, it does not absolve the depositary of its own independent CDD obligations. The depositary retains the ultimate responsibility for assessing the money laundering and terrorist financing risks and cannot solely rely on the client’s own due diligence. Statement IV is incorrect. The AMLO generally requires that verification of a customer’s identity must be completed before establishing a business relationship or conducting any transaction for the customer. Deferring verification is only permitted in very specific and exceptional circumstances and is not a standard procedure. Therefore, statements I and III are correct.

The explanation teaches the concept that when a financial institution encounters red flags indicating a higher risk of money laundering or terrorist financing (ML/TF), such as complex ownership structures involving high-risk jurisdictions and a vague source of funds, it is required to conduct Enhanced Due Diligence (EDD). The correct answer is that the firm must initiate EDD to obtain a deeper understanding of the client’s ultimate beneficial ownership, source of funds, and source of wealth. This is a critical step mandated by the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and SFC guidelines to properly assess and mitigate the identified risks before establishing a business relationship. Filing a Suspicious Transaction Report (STR) immediately is premature; an STR should be filed only after due diligence leads the firm to know or suspect that a transaction involves proceeds of crime. The initial red flags are a trigger for investigation, not a conclusion of suspicion. Proceeding with account opening, even with a high-risk rating, is a direct violation of AMLO, as a firm must complete its customer due diligence obligations before establishing a business relationship. While declining the business relationship is a possible outcome, it is not the prescribed immediate step; the firm’s primary regulatory obligation is to first attempt to mitigate the risk by gathering more information through EDD. A decision to decline would typically follow an unsatisfactory EDD process.

This question assesses the application of Hong Kong’s anti-money laundering (AML) and counter-terrorist financing (CFT) obligations for a licensed corporation providing depositary services. Statement I is correct because onboarding a client from a high-risk jurisdiction with a complex, opaque ownership structure is a significant red flag that mandates the application of Enhanced Due Diligence (EDD) under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism. EDD involves taking additional measures to understand the client’s ownership, control structure, and source of wealth/funds. Statement II is also correct as ongoing monitoring is a fundamental pillar of any AML/CFT program, required for all clients to detect transactions that are inconsistent with the institution’s knowledge of the client or that may be suspicious. Statement IV is correct because if, during the relationship, the depositary develops a suspicion (e.g., due to evasive answers about the source of funds) that cannot be reasonably dispelled, it has a legal obligation to file a Suspicious Transaction Report (STR) with the Joint Financial Intelligence Unit (JFIU) as soon as practicable. Statement III is incorrect because while the AMLO allows for reliance on third parties for due diligence under certain conditions, a licensed corporation cannot ‘solely’ rely on an overseas administrator, especially for a high-risk client. The Hong Kong licensed corporation retains ultimate responsibility for ensuring that the KYC requirements are met and must satisfy itself of the adequacy of the procedures of the third party. Therefore, statements I, II and IV are correct.

This question assesses the understanding of Enhanced Due Diligence (EDD) measures required under Hong Kong’s Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) when dealing with high-risk clients. The scenario describes a client that presents multiple high-risk factors: domicile in a non-FATF jurisdiction and a complex ownership structure. Statement I is correct because establishing a business relationship with a client assessed as high-risk requires the approval of senior management. This ensures appropriate oversight and accountability. Statement II is correct as a core component of EDD is to take reasonable and adequate measures to establish the source of wealth and source of funds of the ultimate beneficial owners. This is crucial for understanding the client’s risk profile and ensuring the legitimacy of their assets. Statement III is incorrect because a licensed corporation must conduct its own independent due diligence. While an introduction from a reputable third party can be considered, relying solely on it, especially for a high-risk client, is a significant compliance failure and does not satisfy the firm’s obligations. Statement IV is correct because for high-risk relationships, due diligence is not a one-off event at onboarding. The firm must conduct enhanced ongoing monitoring, which includes applying greater scrutiny to transactions to identify any activity that is inconsistent with the client’s profile or potentially suspicious. Therefore, statements I, II and IV are correct.

The correct course of action is to decline to establish a business relationship and assess whether a Suspicious Transaction Report (STR) should be filed with the Joint Financial Intelligence Unit (JFIU). According to Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and the SFC’s Guideline on Anti-Money Laundering and Counter-Financing of Terrorism, a financial institution must not establish a business relationship if it is unable to complete the required Customer Due Diligence (CDD) measures. In this scenario, the inability to verify the source of wealth and identify the ultimate beneficial owners constitutes a failure to complete CDD. The option to proceed with onboarding while applying enhanced monitoring is incorrect because enhanced monitoring is for clients who have already passed the initial CDD but are deemed high-risk; it is not a remedy for a failed CDD process. Relying solely on a director’s declaration is insufficient as it does not fulfill the institution’s obligation to independently verify the client’s information. While escalating to senior management is part of internal procedure, the decision is not a commercial one but a regulatory one; management cannot override the legal requirement to complete CDD before establishing a relationship.

The correct course of action is to conduct enhanced due diligence and seek senior management approval. According to Hong Kong’s Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT), when a client is identified as a Politically Exposed Person (PEP), particularly from a higher-risk jurisdiction, financial institutions must apply enhanced due diligence (EDD) measures. This involves taking reasonable measures to establish the source of wealth and source of funds of the client and beneficial owner. Crucially, the institution must obtain approval from its senior management to continue the business relationship. This demonstrates a risk-based approach where the heightened risks associated with the PEP are properly assessed and managed at a senior level. The option to immediately file a Suspicious Transaction Report (STR) and freeze assets is incorrect because the identification of a PEP is a risk factor requiring further scrutiny, not an automatic trigger for an STR. An STR is filed only if, after due diligence, there is a suspicion of money laundering or terrorist financing. The suggestion to simply update the client’s risk profile, while a necessary administrative step, is insufficient as it omits the critical EDD and senior management approval requirements. Finally, immediately terminating the relationship is not the prescribed first step. The institution must first assess the risk through EDD; termination is a possible outcome if the risk is deemed unacceptable, but it is not the mandatory initial action.

The explanation is that under Hong Kong’s Anti-Money Laundering and Counter-Financing of Terrorism (AMLO) framework and the SFC’s Guideline on Anti-Money Laundering and Counter-Financing of Terrorism, a depositary service provider has a primary obligation to conduct customer due diligence (CDD) before establishing a business relationship. When dealing with a client from a high-risk jurisdiction that is unwilling to disclose its ultimate beneficial owners (UBOs), this situation presents significant money laundering risks. Therefore, the provider must apply enhanced due diligence (EDD). This involves taking additional measures to verify the client’s identity and the source of funds. If, after applying EDD, the provider cannot satisfactorily identify and verify the UBOs, it must decline to establish the business relationship to mitigate the risk. Simply accepting the client on a provisional basis while monitoring transactions is a direct violation of the requirement to complete CDD upfront. Filing a Suspicious Transaction Report (STR) is required when there is knowledge or suspicion of criminal proceeds, but it does not replace the fundamental KYC obligation; the relationship should not be established in the first place if CDD fails. Relying solely on the client’s self-declaration without independent verification, especially for a high-risk client, fails to meet the required standard of due diligence.

Statement I is correct. Under the SFC’s Code on Unit Trusts and Mutual Funds, any entity wishing to act as a trustee or custodian for a collective investment scheme that is to be authorized by the SFC must meet specific eligibility criteria and be approved by the SFC. This is a core part of the SFC’s role in protecting the investing public.
Statement II is correct. While the SFC licenses corporations to conduct regulated activities, if a financial institution is an Authorized Institution (AI) under the Banking Ordinance, or a subsidiary of one, the Hong Kong Monetary Authority (HKMA) acts as the frontline regulator for its overall business conduct, including prudential supervision and risk management systems.
Statement III is correct. The Mandatory Provident Fund Schemes Authority (MPFA) is the statutory body responsible for regulating and supervising the MPF system in Hong Kong. Any entity that wishes to act as a custodian for an MPF scheme must be an approved custodian under the Mandatory Provident Fund Schemes Ordinance.
Statement IV is incorrect. The Securities and Futures Commission (SFC), not the Hong Kong Exchanges and Clearing Limited (HKEX), sets the minimum liquid capital and other financial requirements for licensed corporations under the Securities and Futures (Financial Resources) Rules. HKEX’s role is primarily as a market operator for the securities and derivatives markets. Therefore, statements I, II and III are correct.

This question assesses the understanding of the fundamental duties of a depositary (trustee/custodian) for a Hong Kong SFC-authorized fund, as outlined in the Code on Unit Trusts and Mutual Funds. Statement I is correct because a primary duty of a depositary is the safekeeping of scheme assets, which includes ensuring they are properly segregated from the depositary’s own assets and the assets of other clients to protect them in case of insolvency. Statement II is also correct; the depositary has a crucial oversight function to ensure that the fund manager makes investment decisions in accordance with the restrictions and objectives stated in the fund’s constitutive documents (e.g., the trust deed and offering documents). Statement III is incorrect because the depositary is not merely an order-taker. It has a fiduciary duty to act in the best interests of the fund’s unitholders, which includes questioning and, if necessary, refusing to settle transactions that appear to breach the fund’s investment mandates or regulatory requirements. Statement IV is incorrect as the depositary’s role is preventative. It should challenge and refuse to settle a non-compliant instruction before it is executed, rather than processing it and reporting the breach afterwards. Therefore, statements I and II are correct.

The correct answer is that the firm must obtain senior management approval to establish the relationship and apply enhanced due diligence measures. Under Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and related SFC guidelines, when a potential client is identified as a Politically Exposed Person (PEP), the financial institution is required to implement enhanced due diligence (EDD). Key components of EDD for a PEP include obtaining approval from senior management before establishing a business relationship, taking reasonable measures to establish the source of wealth and the source of funds for the transaction, and conducting enhanced ongoing monitoring of the business relationship. Simply proceeding with standard onboarding and a simplified risk rating would be a serious compliance breach, as the presence of a PEP automatically elevates the risk profile. Filing a Suspicious Transaction Report (STR) immediately is premature; an STR should be filed if, after conducting EDD, the institution knows or suspects that any property represents proceeds of an indictable offence. Relying solely on the client’s self-declaration without further verification, even with a risk waiver, fails to meet the stringent verification requirements for high-risk clients like PEPs.

This question assesses the application of Hong Kong’s anti-money laundering regulations in the context of depositary services. Statement I is correct because the client’s domicile in a jurisdiction with strategic AML/CFT deficiencies, as identified by the FATF, is a clear high-risk indicator. According to the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (for Licensed Corporations), this situation mandates the application of enhanced due diligence (EDD) measures, which include obtaining additional information on the source of funds and wealth of the ultimate beneficial owners. Statement III is also correct as the same guideline requires that for any high-risk business relationship, a licensed corporation must obtain approval from its senior management to commence or continue the relationship. Statement II is incorrect because a high-risk jurisdiction is a trigger for EDD, not an automatic or mandatory trigger for filing a Suspicious Transaction Report (STR). An STR is filed only when the firm knows or has suspicion that a transaction is related to the proceeds of a crime, which may or may not be the case at the onboarding stage. Statement IV is incorrect because under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), a licensed corporation retains the ultimate responsibility for customer due diligence (CDD). While reliance on third parties is permitted under very specific conditions, it is generally not appropriate for high-risk clients, and the firm cannot simply delegate its core compliance obligations. Therefore, statements I and III are correct.

The scenario presents several high-risk factors for money laundering and terrorist financing: a Politically Exposed Person (PEP) as the ultimate beneficial owner, a client from a high-risk jurisdiction, and funding from an unrelated third party in a non-cooperative jurisdiction. These factors trigger specific obligations under Hong Kong’s anti-money laundering framework.

Statement I is correct. The combination of these red flags would cause a licensed corporation to form a suspicion that the funds may be related to the proceeds of an indictable offence. Under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), there is a mandatory obligation to file a Suspicious Transaction Report (STR) with the Joint Financial Intelligence Unit (JFIU) as soon as reasonably practicable after forming such a suspicion.

Statement II is correct. The ultimate beneficial owner is identified as a PEP. The SFC’s Guideline on Anti-Money Laundering and Counter-Financing of Terrorism explicitly requires licensed corporations to obtain approval from senior management before establishing a business relationship with a PEP.

Statement III is incorrect. Regulations do not impose a blanket prohibition on establishing business relationships with PEPs. Instead, they require a risk-based approach, which involves applying enhanced due diligence (EDD) measures, including the actions described in statements II and IV. A firm may choose to reject the client based on its own risk appetite, but it is not a regulatory prohibition.

Statement IV is correct. As part of the required EDD for a high-risk client, particularly a PEP, the licensed corporation must take reasonable measures to establish the client’s source of wealth (the origin of their entire body of assets) and the source of funds (the origin of the particular funds being used for the transaction or relationship). Therefore, statements I, II and IV are correct.

The correct answer is that the depositary must activate its business continuity plan, immediately notify the client of the issue and potential impact, and begin documenting the incident for internal review and potential regulatory reporting. In the event of a significant operational failure, regulatory expectations and sound risk management principles, such as those embedded within the SFC’s codes and guidelines, prioritize a structured response. Activating the Business Continuity Plan (BCP) is the first step to ensure a controlled and systematic recovery process. Concurrently, transparent and prompt communication with the affected client is crucial for managing the relationship, maintaining trust, and allowing the client to take any necessary mitigating actions on their end. Finally, contemporaneous documentation of the incident is essential for subsequent internal investigation, remediation, and fulfilling any mandatory reporting obligations to the SFC or HKMA if the incident is deemed significant.

The correct course of action is to apply enhanced due diligence (EDD) measures to understand the complex corporate structure and properly identify and verify the ultimate beneficial owners (UBOs). According to Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and the SFC’s Guideline on Anti-Money Laundering and Counter-Financing of Terrorism, a risk-based approach is mandatory. Factors such as a client’s incorporation in a high-risk jurisdiction and the use of a complex, opaque ownership structure are significant red flags that elevate the money laundering risk. Consequently, standard due diligence is insufficient, and EDD must be performed before establishing a business relationship to mitigate these risks. This involves taking additional steps to verify the source of wealth and funds and to identify the natural persons who ultimately own or control the client. The option to simply accept a signed declaration from a director is incorrect because it fails to meet the verification requirements of KYC. While such a declaration can be part of the client file, the licensed corporation has an independent duty to take reasonable measures to verify the identity of the UBOs. Relying solely on a self-declaration, especially in a high-risk scenario, is a serious compliance failure. The suggestion to proceed with onboarding and schedule a standard review later is also incorrect. The risk assessment and appropriate level of due diligence must be completed before the business relationship is established. Delaying proper scrutiny of a high-risk client defeats the purpose of preventative AML measures. Finally, immediately reporting the client to the Joint Financial Intelligence Unit (JFIU) is premature. A high-risk profile necessitates EDD, not an automatic suspicious transaction report (STR). An STR should only be filed if, during the EDD process or at any other time, the firm forms a suspicion that the client or its funds are connected to criminal activity.

The correct course of action is to refuse to establish the business relationship until the identity of all ultimate beneficial owners is satisfactorily verified. Under Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and related SFC guidelines, a licensed corporation providing depositary services has a strict obligation to conduct customer due diligence (CDD). A critical component of CDD is identifying and taking reasonable measures to verify the identity of the ultimate beneficial owners (UBOs) of a client. The client’s reluctance to provide this information, coupled with the use of a structure in a secrecy jurisdiction, constitutes significant red flags that mandate enhanced due diligence, not a waiver of requirements. Failing to obtain this information before establishing a relationship is a direct breach of these regulatory obligations. Simply assigning a high-risk rating without completing the necessary verification is insufficient; the rating is meant to guide the intensity of due diligence and ongoing monitoring, not replace it. Proceeding with simplified due diligence is entirely inappropriate for a high-risk scenario. While a Suspicious Transaction Report (STR) might eventually be filed if suspicion of money laundering arises, the primary and immediate obligation is to complete CDD, and if that is not possible, to decline the business.

This question assesses the application of Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) principles, specifically Customer Due Diligence (CDD) for a high-risk client, as required by the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and related SFC guidelines. Statement I is correct because identifying and verifying the ultimate beneficial owners (UBOs) is a fundamental requirement of CDD, especially for entities with complex ownership structures. Statement III is also correct; a client from a high-risk jurisdiction or with a complex structure necessitates a higher risk rating, which in turn triggers the need for enhanced due diligence (EDD) and more rigorous ongoing monitoring. Statement II is incorrect because while an intermediary can rely on a third party to perform some CDD measures, it cannot be a ‘complete substitute’. The ultimate responsibility for CDD remains with the Hong Kong firm, and specific conditions under the AMLO must be met for such reliance. Statement IV is incorrect as the AMLO requires CDD measures to be completed before establishing a business relationship. Deferring verification is only permitted in exceptional, low-risk circumstances and is not appropriate for a high-risk client. Therefore, statements I and III are correct.

The correct answer is that the compliance officer should escalate the matter for senior management review and consider filing a Suspicious Transaction Report (STR) with the Joint Financial Intelligence Unit (JFIU). According to Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and related SFC guidelines, when a financial institution encounters a situation with multiple high-risk indicators (such as a complex ownership structure, a high-risk jurisdiction, and a vague source of funds), it must apply Enhanced Due Diligence (EDD). If, after applying EDD, the suspicion of money laundering or terrorist financing cannot be dispelled, the institution has a legal obligation to report its suspicion to the JFIU. Escalating internally ensures proper governance and decision-making before filing the STR. Simply accepting the client, even with enhanced monitoring, is inappropriate as it bypasses the critical step of resolving the initial red flags before establishing a business relationship. Rejecting the client and informing them of a potential report constitutes ‘tipping off’, which is a specific offence under the AMLO. Relying solely on a self-declaration from the client is insufficient to satisfy EDD requirements; the institution must take reasonable measures to verify the source of funds and wealth from reliable, independent sources.

In Hong Kong’s dual regulatory system for financial institutions that are both banks and licensed for securities activities, the responsibilities are clearly delineated. Statement I is correct because the Securities and Futures Commission (SFC) is the primary regulator for the conduct of business related to regulated activities, such as dealing in or advising on securities. This includes the provision of custody services. The SFC’s Code of Conduct and other relevant guidelines apply directly to these activities. Statement II is also correct. The Hong Kong Monetary Authority (HKMA) is the prudential supervisor for all authorized institutions (i.e., banks). Its role focuses on the overall financial soundness, capital adequacy, liquidity, and risk management systems of the institution as a whole to ensure banking stability. Statement III is incorrect. While the regulatory frameworks of the SFC and HKMA are designed to avoid unnecessary duplication, a licensed corporation that is also an authorized institution is not granted a complete exemption from the SFC’s client asset rules, such as the Securities and Futures (Client Securities) Rules. Specific provisions apply, but the core principles of asset segregation and protection under the SFO framework remain relevant. Statement IV is incorrect. The SFC and HKMA operate under a Memorandum of Understanding (MoU) to coordinate their regulatory efforts. However, the SFC retains its independent statutory power to investigate and take disciplinary action against its licensees for breaches of the SFO or its codes, even if the licensee is also an authorized institution. The disciplinary process is not handled exclusively by the HKMA. Therefore, statements I and II are correct.