63 questions

Business Operations, Internal Controls and AML

The AMLO framework is built on a 'risk-based approach', which means a firm should:

  • a.Apply exactly the same procedures to every client regardless of risk
  • b.Refuse to serve any client who is not a Hong Kong resident
  • c.Rely entirely and solely on the client's own verbal assurances regarding their identity and the source of their funds
  • d.Apply enhanced due diligence to higher-risk situations and may apply simplified measures to lower-risk ones✓

A risk-based approach requires firms to assess and tier money-laundering/terrorist-financing risk, applying enhanced due diligence to higher-risk customers and relationships, and (where permitted) simplified measures to demonstrably lower-risk ones. Resources are focused where risk is greatest.

Business Operations, Internal Controls and AML

When a prospective client is identified as a politically exposed person (PEP), the firm should:

  • a.Apply enhanced due diligence, including obtaining senior management approval to establish the relationship✓
  • b.Apply only simplified due diligence
  • c.Automatically refuse to deal with them in every single case, since PEPs are barred from opening any securities account
  • d.Ignore the status, since PEPs are low risk

PEPs are treated as higher risk under the AMLO. Enhanced due diligence is required, including establishing source of wealth and funds and obtaining senior management approval before establishing or continuing the relationship. Being a PEP does not automatically bar the relationship.

Business Operations, Internal Controls and AML

To meet its AML/CFT obligations, a licensed corporation should appoint:

  • a.An external auditor as its only AML control
  • b.No particular officer, as AML is optional
  • c.A Money Laundering Reporting Officer (MLRO) / compliance officer to oversee AML systems and handle internal suspicious-transaction reporting✓
  • d.A director drawn from a completely unrelated outside company to act as the firm's nominal money laundering reporting officer in name only

Firms are expected to appoint a compliance officer and a Money Laundering Reporting Officer (MLRO) to oversee AML/CFT policies and act as the central point for evaluating and reporting suspicious transactions. Clear internal responsibility is a key control under the SFC's AML Guideline.

Business Operations, Internal Controls and AML

'Tipping off' a client that a suspicious transaction report has been or may be made about them is:

  • a.A criminal offence under Hong Kong's anti-money-laundering legislation✓
  • b.Required by the AMLO
  • c.Permitted, provided that it is done politely and in writing to the client
  • d.Good customer service and encouraged

Disclosing to a client that a suspicious transaction report has been or may be made ('tipping off') is a criminal offence, as it may prejudice an investigation. Suspicions must instead be reported to the Joint Financial Intelligence Unit (JFIU) without alerting the client.

Business Operations, Internal Controls and AML

Under the Securities and Futures (Client Securities) Rules, a standing authority permitting a firm to deal with client securities (e.g. for stock lending or as collateral) is generally valid for a maximum of:

  • a.1 week
  • b.It never expires and remains valid permanently once it is first given
  • c.3 months
  • d.12 months (though it may be renewed, including by deemed renewal)✓

A client's standing authority for the use of client securities is limited to a maximum of 12 months, after which it must be renewed (renewal may be by the client's express agreement or by deemed renewal on notice). This periodic renewal protects clients' control over their assets.

Business Operations, Internal Controls and AML

Following the execution of a client's securities transaction, an intermediary must provide the client with a contract note:

  • a.Only once a year
  • b.Within three years
  • c.By the end of the next business day after the transaction✓
  • d.Only if and when the client actually complains about the trade

The Contract Notes Rules require an intermediary to deliver a contract note to the client by the end of the business day following the transaction. Contract notes and periodic statements of account give clients a clear record of their dealings and holdings.

Business Operations, Internal Controls and AML

Client money received by a licensed corporation must, under the Client Money Rules, be paid into a segregated client account:

  • a.Only at the end of the financial year
  • b.Within 30 days
  • c.Only if the client specifically insists
  • d.Within one business day of receipt✓

The Securities and Futures (Client Money) Rules require client money to be paid into a segregated client account, with an authorised institution, promptly - within one business day of receipt. Segregation keeps client money separate from the firm's own funds and protects it on the firm's insolvency.

Business Operations, Internal Controls and AML

The primary purpose of the client asset segregation rules (for client money and client securities) is to:

  • a.Increase the firm's own working capital
  • b.Reduce the amount of stamp duty payable
  • c.Protect client assets from the firm's creditors if the firm becomes insolvent✓
  • d.Allow the firm to freely trade the client assets on its own account for profit

Segregation ensures client money and securities are held separately from the firm's own assets, so that if the firm fails, client assets are protected and not available to the firm's general creditors. This is a cornerstone of investor protection in the SFC's operational rules.

Business Operations, Internal Controls and AML

The international body that sets the standards on which Hong Kong's AML/CFT regime is modelled is the:

  • a.International Monetary Fund
  • b.World Trade Organization
  • c.The Stock Exchange of Hong Kong Ltd
  • d.Financial Action Task Force (FATF)✓

The Financial Action Task Force (FATF) sets the international standards for anti-money-laundering and counter-terrorist-financing. Hong Kong, as a FATF member, implements these standards through the AMLO and related legislation and guidelines.

Business Operations, Internal Controls and AML

A licensed corporation's handling of client complaints should be governed by:

  • a.Proper internal procedures ensuring complaints are handled promptly, fairly and are properly recorded and escalated✓
  • b.A standing firm policy of routinely ignoring all client complaints that happen to fall under a certain monetary size threshold
  • c.The client's own lawyers only
  • d.The Stamp Duty Ordinance

The Code of Conduct and internal-control guidelines require firms to have effective procedures for handling client complaints promptly and fairly, keeping proper records and escalating serious matters. Good complaints handling is part of treating customers fairly and sound operations.

Want these explained in order? HKSI Licensing Examination Paper 1 — Complete Study Guide (2026) — PDF + EPUB, $19.99 · 14-day refund →

Business Operations, Internal Controls and AML

Maintaining a separation between front-office (dealing) and back-office (settlement/record-keeping) functions is an example of:

  • a.A breach of the Code of Conduct
  • b.A specific requirement that is imposed directly by the Stamp Duty Ordinance on all firms
  • c.An unnecessary duplication that firms should avoid
  • d.A segregation-of-duties internal control that reduces the risk of error and fraud✓

Segregation of duties - separating those who execute trades from those who settle and record them - is a fundamental internal control that reduces the risk of undetected error or fraud. It is expected under the SFC's Management, Supervision and Internal Control Guidelines.

Business Operations, Internal Controls and AML

Under the AMLO, before establishing a business relationship a firm must identify the 'beneficial owner', which for a company generally means:

  • a.The natural person(s) who ultimately own or control the customer (typically an ownership interest above a set threshold, such as more than 25%)✓
  • b.The most junior employee
  • c.The company's external auditor
  • d.Any person at all who has at any time in the past ever bought even a single one of the customer company's ordinary listed shares on the open market

Beneficial ownership requires firms to look through legal entities to the natural persons who ultimately own or control the customer - commonly those holding more than 25% of the shares or voting rights, or otherwise exercising control. Identifying them is central to effective CDD under the AMLO.

Business Operations, Internal Controls and AML

Ongoing monitoring of a business relationship under the AMLO requires a firm to:

  • a.Rely entirely on the SFC to monitor the client
  • b.Verify the customer's identity only once at the point of account opening and then never again carry out any further review or monitoring of the relationship at all afterwards
  • c.Keep customer information up to date and scrutinise transactions to ensure they are consistent with the firm's knowledge of the customer and their risk profile✓
  • d.Monitor only transactions above HK$1 billion

Ongoing monitoring requires firms to keep CDD information current and to review transactions during the relationship to ensure they are consistent with what the firm knows about the customer, their business and risk profile. Unusual or inconsistent activity may trigger a suspicious-transaction report to the JFIU.

Report