CGj reviews the key regulatory developments and practical insights on anti–money laundering and counter–financing of terrorism (AML/CFT) shared at the Institute’s annual AML/CFT conference held in November 2025.

The AML/CFT landscape continues to evolve at pace, shaped by rapid technological change and increasingly stringent regulatory expectations. The Institute’s 6th AML/CFT Conference – AML/CFT Regulations, Topical Issues and Practical Sharing – held on 25 November 2025, examined the latest regulatory developments and emerging risk considerations confronting governance and compliance professionals. This article reviews the key takeaways from the conference, focusing on the regulatory changes in Hong Kong.

Wendy Ho FCG HKFCG(PE), Institute Council member and Chairman of the Professional Development Committee, and Executive Director, Company Secretarial Services, Vistra, opened Session One by setting the context for the discussion. She highlighted the rapidly evolving AML/CFT backdrop, as well as the increasing expectations placed on governance professionals. The first session of the conference, she noted, would focus on three areas of growing regulatory importance – AML/CFT obligations for virtual asset service providers (VASPs), the Companies Registry’s updated AML/CFT requirements for trust or company service providers (TCSPs) and the emerging AML/CFT risks arising from Hong Kong’s new company redomiciliation regime amid global tax reform.

AML/CFT controls for VASPs

Tracy Law, Partner, Financial Services Risk Consulting, Ernst & Young Advisory Services Ltd, examined the AML/CFT regulatory requirements associated with the rapid growth of the virtual asset sector. She noted that ‘93% of the participants in the market research conducted by EY in February 2023 believe that digital assets and blockchain technology have long-term value in the market’. This market expectation for digital assets and blockchain technology is also a driving factor for regulators to strengthen oversight of the sector.

In terms of the global regulatory direction, Ms Law stressed that regulators worldwide are tightening AML/CFT requirements to mitigate financial crime risks. She discussed overseas regulatory approaches, including Europe’s Markets in Crypto- Assets Regulation, developments in the UK and the US, and recent enforcement actions illustrating the consequences of weak controls.

‘Jurisdictions may move at different speeds, but the regulatory direction is very consistent – virtual asset activities are now within AML/CFT parameters,’ she said. ‘Regulators have shown that they are prepared to take action where there are prolonged and systemic failures in AML/CFT controls.’

Turning to Hong Kong, Ms Law outlined the city’s regulatory journey, beginning with the foundational policy statement issued in October 2022 on virtual asset development, and moving on to the implementation of the licensing regime for virtual asset trading platforms in June 2023 and the introduction of the new roadmap to develop Hong Kong as a global virtual asset hub, introduced by the Securities and Futures Commission in February 2025. She emphasised that, although VASPs share many core AML/CFT principles with traditional financial institutions, their business models require enhanced technological solutions. These include remote e-KYC onboarding, blockchain analytics for wallet screening, on-chain transaction monitoring and compliance with the travel rule.

‘Customer due diligence and ongoing monitoring are fundamental requirements for AML/CFT compliance, which apply regardless of whether the underlying activity involves traditional or virtual assets,’ she said. She added that the implementation of the travel rule is a key regulatory milestone, stating that, ‘the travel rule reinforces the expectations for how originator and beneficiary information is collected, verified and transmitted between VASPs.’

Ms Law concluded by accentuating the importance of senior management accountability, robust institutional risk assessments and a risk-based approach, noting that AML/CFT compliance for VASPs is non-negotiable in an environment of increasing regulatory scrutiny.

Note: The views reflected in this section of the article are the views of the speaker and do not necessarily reflect the views of the global EY organisation or its member firms.

Practical impact of the Companies Registry’s updated AML/CFT guidelines

Wendy Kam FCG HKFCG(PE), Managing Director of Corporate Secretarial Services, In.Corp Corporate Services (HK) Ltd, focused on the practical implications of recent updates to the Companies Registry’s AML/CFT requirements for TCSPs. She explained that the changes place greater emphasis on transparency, timeliness and accountability, with direct consequences for daily operations, rather than relating purely to policy documents.

The key updates discussed included the 30-working-day identity verification requirement, the formalisation of the risk-based approach through mandatory institutional risk assessments and the new expectations around AML/ CFT governance frameworks, staff vetting, ongoing training and independent AML/CFT audits.

‘The 30-working-day verification requirement is clear in principle, but in practice it creates significant pressure, especially in cases involving complex structures or overseas clients,’ Ms Kam pointed out. She also highlighted the enhanced expectations around risk assessments. ‘Institutional risk assessment is no longer a formality and firms are now expected to demonstrate how their risk profile informs their AML/CFT controls,’ she said.

Ms Kam also pointed to the expanded guidance on connected parties, source of wealth and source of funds. ‘Regulators are expecting TCSPs to look beyond the immediate client entity, and to understand the individuals and relationships behind it.’

Ms Kam also spotlighted the expanded scope of customer due diligence, including the identification of connected parties, and clarified regulatory expectations around the source of wealth and source of funds in enhanced due diligence.

She stressed the role of senior management and boards, as well as the critical role of governance professionals and TCSPs as a bridge between operations and the board. ‘AML/CFT compliance is ultimately a governance responsibility and directors need to understand what their firms are doing and why.’ While acknowledging the increased compliance burden, Ms Kam observed that the updated guidelines also provide an opportunity to strengthen governance, improve operational discipline, and build trust with regulators and stakeholders. ‘These changes, if implemented properly, can strengthen governance and enhance client trust.’

AML/CFT risks from redomiciliation and global tax reform

Daniel Wong FCG HKFCG, Associate Director of Compliance and Risk Management, SWCS Corporate Services Group (Hong Kong) Ltd, examined AML/CFT challenges arising from the interaction between Hong Kong’s new company redomiciliation regime and the Organisation for Economic Cooperation and Development’s global minimum tax framework under its BEPS (base erosion and profit shifting) 2.0 Project. He explained that, while the redomiciliation regime is designed to attract multinational enterprises to Hong Kong, it can also introduce heightened AML/CFT risks due to complex cross-border structures and diverse regulatory standards.

‘When multinational groups restructure or redomicile, the complexity of ownership and control often increases rather than decreases,’ Mr Wong said. Drawing on a detailed case study, he illustrated how layered ownership arrangements involving trusts, foundations, partnerships and entities in multiple jurisdictions can obscure beneficial ownership and increase exposure to geographical, geopolitical, structural and transaction-based money laundering risks.

Mr Wong emphasised the need for geographically informed risk assessments. ‘AML/CFT risk cannot be assessed in isolation from jurisdictional, political or sanctions risks. Financial Action Task Force lists, corruption indices and sanctions regimes all have a direct bearing on how redomiciled structures should be assessed.’ Concluding his remarks, he warned that failure to properly identify and manage these risks can expose firms to serious regulatory and reputational consequences.

The Institute’s 6th AML/CFT Conference was held on 25 November 2025 in hybrid mode. More information is available on the Institute’s website: www.hkcgi.org.hk.

Guest of Honour Speech

Guest of Honour Joseph HL Chan JP, Under Secretary for Financial Services and the Treasury, the HKSAR Government, gave the opening speech at the Institute’s 6th AML/ CFT Conference, in which he focused on the government’s initiatives and priorities in strengthening AML/CFT measures in Hong Kong.

Good afternoon everyone. It is a pleasure to be here today to join you at the annual AML/CFT conference. First of all, many thanks to the Institute for organising this thought-provoking series of very topical discussions for government professionals, compliance leaders and governance practitioners to exchange insights, address emerging challenges and shape the future of our AML/CFT regime.

Hong Kong has long played the unique role of super connector between the Chinese mainland and the rest of the world, between the East and the West. We have consistently topped Asia’s league tables across international bond insurance, insurance density, cross-border wealth management and more. This success is underpinned by our mature market ecosystem, rigorous risk management and a regulatory framework that is compatible with major international markets.

Central to sustaining this reputation is our unwavering commitment to safeguarding the integrity of our financial system. We implement the international AML/CFT standards to deter and detect illicit funds flowing into and out of Hong Kong. As an active member of the Financial Action Task Force (FATF) since 1991, and as a founding member of the Asia-Pacific Group on Money Laundering since 1997, Hong Kong has built one of the most robust AML/CFT regimes in the world. This was confirmed in the 2019 FATF Mutual Evaluation Report, in which Hong Kong became the first jurisdiction in the Asia-Pacific region to achieve an overall ‘compliant and effective’ rating. The report praised our strong legal foundation and highlighted our particular effectiveness in risk identification, law enforcement, asset recovery, counter–terrorism financing and international cooperation. Then, in 2023, we successfully completed the regular follow-up process, which further affirmed the strength of our regime. As we look ahead to the next mutual evaluation in 2029/30, we are already conducting comprehensive stock-taking exercises and legislative planning to address any potential gaps, as well as to incorporate the latest FATF standards.

This high level of effectiveness does not happen by accident. It reflects sustained commitment at the highest level, chaired by the Financial Secretary through the Central Coordinating Committee on AML/CFT, with collaboration from policy firms, financial regulators, law enforcement agencies and the private sector.

A cornerstone of our regime is the risk-based approach. We conduct regular territory-wide risk assessments approximately every three years to keep Hong Kong’s risk profile up to date. These assessments follow the FATF guidance and adopt the World Bank methodology. The 2022 assessment confirmed that Hong Kong’s overall ability to combat AML/CFT and proliferation financing remains high. While we face elevated threats from fraud, both domestic and cross-border, and, to a lesser extent, drug-related crimes and corruption, our banking sector and money service operators remain the primary chain targeted by money launderers.

Importantly, the assessment found that existing preventive measures are effective, with suspicious activities being promptly detected and reported. Rising technology risks, particularly virtual asset– related fraud, have also been clearly identified. This has directly informed our regulatory responses, which I will elaborate on shortly.

Our regime rests on a five-pillar strategy – a robust legal framework, effective law enforcement, risk-based supervision by regulators, proactive publicity and capability building, and strong international collaboration. Allow me to sum up recent progress in the first three pillars.

First, the legal framework. The Anti–Money Laundering and Counter–Terrorist Financing Ordinance (Cap 615), is the bedrock of our regime. Since 2018, we have progressively extended statutory customer negligence and record-keeping requirements to designated non-financial businesses and professions, and have introduced a licensing regime for TCSPs. In addition, we established a mandatory licensing regime for virtual asset trading platforms (VATPs) in June 2023.

As of the end of October 2025, the Securities and Futures Commission (SFC) granted formal licences to 11 VATPs, with another eight applications under active processing. This regime aligns fully with international standards, while providing investment protection and clear rules for responsible innovation. Looking ahead, we have just concluded a public consultation on a proposed licensing regime for digital asset dealing services and custodian service providers. We aim to introduce the necessary legislation into LegCo in 2026, completing comprehensive regulatory coverage of key nodes in the digital asset ecosystem. In parallel, we are preparing a registration regime for dealers in precious metals and stones engaging in high-value cash flow sanctions. This will close the gaps in potential vulnerabilities identified in successive risk assessments.

Second, law enforcement remains highly effective. The Joint Financial Intelligence Unit (JFIU), staffed by police and customs officers, processed over 147,000 suspicious transactions reports in 2024, nearly triple the number in 2019. This sharp rise reflects not only heightened risk awareness in the private sector, but also the trust that financial institutions place in JFIU.

In October 2025, we launched the Virtual Asset Intelligence Task Force (VAIT), led by the Hong Kong Police Force, and bringing together the Hong Kong Monetary Authority (HKMA), the SFC, the Customs and Excise Department and licensed VATPs. VAIT enhances real-time information sharing and coordinated enforcement, ensuring our digital asset ecosystem remains safe and compliant.

Third, our regulators continue to strengthen risk-based supervision. The HKMA and SFC conduct intensive on-site and off-site examinations, and collaborate on the risk profile of each institution. Both regulators regularly update their guidelines and share thematic findings with the industry, a collaborative approach that drives continuous improvement.

Public–private partnership is not just a slogan in Hong Kong – it is our daily practice. Rental fraud trend reviews, domestic seminars and two-way feedback channels ensure that frontline compliance officers are equipped with the latest technologies and resources.

In short, Hong Kong’s AML/CFT regime is strong, mature and continually evolving. We are proud of our track record, but we are never complacent. As new risks emerge – whether from rapidly evolving technology, geopolitical tensions or sophisticated criminal methodologies – we will respond with agility, proportionality and resolve.

By working closely together with government, regulators, law enforcement and every one of you in this room and online, we will continue to protect the integrity of our financial system, uphold Hong Kong’s reputation as a trusted international financial centre and contribute responsibly to the global fight against money laundering and terrorist financing.

This is an extract of Mr Chan’s opening speech at the Institute’s annual AML/CFT conference held in November 2025.