HKMA Updates Expectations for Remote On-Boarding Amid AI-Driven Fraud Risks

Key Takeaways

• The HKMA has issued updated guidance superseding its 2019 and 2021 circulars on remote customer on-boarding, requiring Authorized Institutions and Stored Value Facility licensees to strengthen identity authentication and identity matching controls in light of AI-driven impersonation, deepfake fraud, and mule-account risks.
• Firms must conduct a comprehensive review of their remote on-boarding systems and adopt a risk-based, tiered approach to customer due diligence, with ongoing recalibration to keep pace with evolving threats.

Deep Dive

This circular reflects the HKMA's recognition that remote on-boarding, now a core AML/CFT control mechanism for AIs and SVF licensees, must evolve alongside emerging technology-driven threats. The letter supersedes the February 2019 and May 2021 circulars but explicitly preserves the applicability of the September 2020 (corporate customers) and June 2020 (thematic review feedback) circulars, meaning firms need to read this guidance as part of a broader, cumulative regulatory framework rather than a standalone replacement.

The core substantive requirement is adherence to two principles: (i) identity authentication, requiring technology-based verification of the genuineness of identity documents obtained electronically, and (ii) identity matching, requiring technology to incontrovertibly link the customer to the verified identity. These principles are not new in concept but are being reinforced given the rise of deepfake technology and AI-driven impersonation tactics that increase the scale and sophistication of fraud and mule-account networks. The HKMA is also encouraging firms to adopt risk-based, tiered on-boarding models that scale account features, functionality, and transaction limits according to the customer's risk profile and behavior over time, rather than relying solely on static point-of-entry checks.

No specific compliance deadline is provided, but the HKMA expects a "continual program of updates and recalibration" to on-boarding systems, and explicitly instructs AIs and SVF licensees to conduct a "comprehensive review" of their remote on-boarding solutions, systems, and oversight arrangements. This should be treated as an immediate action item rather than a future-dated obligation, given the absence of a grace period and the regulator's framing of urgency around fraud intelligence-sharing with the Hong Kong Police Force.

Compliance teams should prioritize: (1) mapping current on-boarding technology against the identity authentication and identity matching principles to identify gaps, particularly around deepfake detection capabilities; (2) reviewing tiered risk-based account design and transaction monitoring calibration; (3) establishing a formal governance process for ongoing recalibration informed by HKMA/police intelligence updates; and (4) ensuring senior management oversight of on-boarding effectiveness is documented and active, as the HKMA explicitly links senior management engagement to the strength of AML/CFT controls. Failure to demonstrate a dynamic, intelligence-responsive on-boarding framework could expose institutions to supervisory findings in future thematic reviews, reputational risk from fraud incidents, and potential enforcement action given the Enforcement and AML Division's authorship of this circular.

Source: Hong Kong Monetary Authority