@1aboveio/skills 0.0.0-stage → 1.0.0

package/skills/core/reg-parser/references/mandates/hk-amlo-cap615.md

@@ -0,0 +1,389 @@
+# Hong Kong Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) — Contract Obligation Extract
+
+> **Source:** Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), Hong Kong  
+> **Slug:** `hk-amlo-cap615`  
+> **Jurisdiction:** Hong Kong SAR  
+> **Last Updated Date:** 2 November 2023 (as printed in ordinance)  
+> **Converted from:** PDF via pdftotext  
+> **Scope:** Applies to **financial institutions** (authorized institutions, licensed corporations, insurers, licensed money service operators, SVF licensees, licensed VAS providers, Postmaster General) and **DNFBPs** (designated non-financial businesses and professions: accounting professionals, legal professionals, estate agents, TCSP licensees, Category B PMS registrants)
+
+---
+
+## Mandatory Downstream Agreement Clauses
+
+### Schedule 2 section 2 — Customer Due Diligence (CDD) Measures
+**Schedule 2 section 2(1)(a)/(ab) — Customer Identification**: Financial institutions and DNFBPs must identify the customer and verify identity using documents, data, or information from a governmental body, relevant authority, recognized digital ID system, or other reliable independent source.  
+**Applies to:** Financial institutions; DNFBPs (accounting professionals, estate agents, legal professionals, TCSP licensees, Category B PMS registrants)
+
+**Schedule 2 section 2(1)(b) — Beneficial Owner Identification**: Must identify any beneficial owner of the customer and take reasonable measures to verify beneficial ownership, including understanding ownership/control structure of legal persons and trusts.  
+**Applies to:** Financial institutions; DNFBPs
+
+**Schedule 2 section 2(1)(c) — Purpose of Business Relationship**: When establishing a business relationship, must obtain information on the purpose and intended nature of the relationship unless obvious.  
+**Applies to:** Financial institutions; DNFBPs
+
+**Schedule 2 section 2(1)(d) — Authority of Agents**: Where a person purports to act on behalf of the customer, must identify that person, verify their identity, and verify their authority to act.  
+**Applies to:** Financial institutions; DNFBPs
+
+---
+
+### Schedule 2 section 3 — When CDD Must Be Carried Out
+
+**Schedule 2 section 3(1)(a) — Pre-Relationship CDD**: Must carry out CDD before establishing a business relationship with a customer.  
+**Applies to:** Financial institutions; DNFBPs
+
+**Schedule 2 section 3(1)(b) — Occasional Transaction Threshold ($120,000)**: Must carry out CDD before carrying out an occasional transaction of $120,000 HKD or above (or equivalent), whether in single or linked operations.  
+**Applies to:** Financial institutions; DNFBPs
+
+**Schedule 2 section 3(1)(d) — Suspicion Trigger**: Must carry out CDD when the institution suspects the customer or customer's account is involved in money laundering or terrorist financing.  
+**Applies to:** Financial institutions; DNFBPs
+
+**Schedule 2 section 3(1)(e) — Doubt in Prior Information**: Must carry out CDD when doubting the veracity or adequacy of previously obtained identification information.  
+**Applies to:** Financial institutions; DNFBPs
+
+**Schedule 2 section 3(1A) — Wire/Virtual Asset Transfer Threshold ($8,000)**: Financial institutions must carry out CDD before an occasional wire transfer or virtual asset transfer of $8,000 HKD or above.  
+**Applies to:** Financial institutions (excluding licensed VAS providers for this sub-section)
+
+**Schedule 2 section 3(1B) — Licensed VAS Provider Threshold ($8,000)**: Licensed VAS providers must carry out CDD before an occasional transaction (non-wire/VA transfer) of $8,000 or above.  
+**Applies to:** Licensed VAS providers
+
+**Schedule 2 section 3(3) — Timely Completion**: Where verification is deferred, it must be completed as soon as reasonably practicable after establishing the business relationship.  
+**Applies to:** Financial institutions; DNFBPs
+
+**Schedule 2 section 3(4) — Inability to Comply — Refusal/Termination**: If unable to complete CDD, must not establish a business relationship or carry out any occasional transaction; if already established, must terminate the relationship as soon as reasonably practicable.  
+**Applies to:** Financial institutions; DNFBPs
+
+---
+
+### Schedule 2 section 5 — Continuous Monitoring
+
+**Schedule 2 section 5(1)(a) — Records Review**: Must continuously monitor business relationships by periodically reviewing documents, data, and information obtained for CDD to ensure they remain up-to-date and relevant.  
+**Applies to:** Financial institutions; DNFBPs
+
+**Schedule 2 section 5(1)(b) — Transaction Scrutiny**: Must conduct appropriate scrutiny of transactions to ensure consistency with customer knowledge, business profile, and source of funds.  
+**Applies to:** Financial institutions; DNFBPs
+
+**Schedule 2 section 5(1)(c) — Unusual Transaction Examination**: Must identify complex, unusually large, or unusual-pattern transactions with no apparent economic/lawful purpose and examine and document findings in writing.  
+**Applies to:** Financial institutions; DNFBPs
+
+**Schedule 2 section 5(3) — Enhanced Monitoring (High-Risk Situations)**: Must take additional measures to compensate for ML/TF risk where the customer: (a) has not been physically present for identification; (b) is a politically exposed person (PEP); or (c) is involved in a high-risk situation under section 15.  
+**Applies to:** Financial institutions; DNFBPs
+
+---
+
+### Schedule 2 section 6 — Pre-Existing Customers
+
+**Schedule 2 section 6(1) — Trigger for CDD on Pre-Existing Customers**: Must carry out CDD on pre-existing customers when an unusual/suspicious transaction occurs or when there is a material change in account operation.  
+**Applies to:** Financial institutions; DNFBPs
+
+**Schedule 2 section 6(2) — Inability to Comply — Termination**: If unable to comply with section 6(1), must terminate the business relationship as soon as reasonably practicable.  
+**Applies to:** Financial institutions; DNFBPs
+
+---
+
+### Schedule 2 section 7 — Pre-Existing Respondent Banks
+
+**Schedule 2 section 7(2) — Termination Unless Conditions Met**: Authorized institutions must terminate correspondent banking relationships with pre-existing respondent banks (outside HK) on the commencement date unless adequate AML/CTF controls were assessed, responsibilities documented, and ongoing customer monitoring confirmed.  
+**Applies to:** Authorized institutions (banks)
+
+---
+
+## Prohibited Conduct
+
+### Schedule 2 section 16 — Anonymous Accounts
+
+**Schedule 2 section 16**: Must not open or maintain any anonymous account or account in a fictitious name for any customer.  
+**Applies to:** Financial institutions; DNFBPs
+
+### Schedule 2 section 17 — Shell Bank Prohibition
+
+**Schedule 2 section 17(1)**: Authorized institutions must not establish or continue a correspondent banking relationship with a shell bank — i.e., a corporation incorporated outside HK, authorized to carry on banking business, but with no physical presence in that jurisdiction and not an affiliate of a corporation with physical presence.  
+**Applies to:** Authorized institutions (banks)
+
+### section 5 section 5(5) — Knowingly Contravening Schedule 2
+
+**section 5(5)**: A financial institution that knowingly contravenes a specified provision of Schedule 2 commits an offence: on conviction on indictment — fine of $1,000,000 and imprisonment for 2 years; on summary conviction — level 6 fine and 6 months imprisonment.  
+**Applies to:** Financial institutions
+
+### section 5(6) — Intent to Defraud
+
+**section 5(6)**: If a financial institution, with intent to defraud any relevant authority, contravenes a specified provision of Schedule 2 — fine of $1,000,000 and imprisonment for 7 years (on indictment) or $500,000 fine and 1 year imprisonment (summary).  
+**Applies to:** Financial institutions and their officers/employees
+
+---
+
+## Special Requirements
+
+### Schedule 2 section 9 — Non-Physically Present Customers
+
+**Schedule 2 section 9(1)**: Where a customer has not been physically present for identification, must carry out at least one additional measure: further document-based verification, supplementary verification measures, or ensuring first payment is from an account in the customer's name with a qualifying institution.  
+**Applies to:** Financial institutions; DNFBPs  
+*Exception: section 9(2) — Does not apply if customer was identified using a recognized digital identification system.*
+
+---
+
+### Schedule 2 section 10 — Politically Exposed Persons (PEPs)
+
+**Schedule 2 section 10(1) — New PEP Customer**: Before establishing a business relationship with a known PEP (or whose beneficial owner is a PEP), must: (a) obtain senior management approval; and (b) take reasonable measures to establish source of wealth and source of funds.  
+**Applies to:** Financial institutions; DNFBPs
+
+**Schedule 2 section 10(2) — Existing PEP Customer**: If an existing customer or their beneficial owner becomes a PEP, must not continue the business relationship unless senior management approval is obtained and source of wealth/funds is established.  
+**Applies to:** Financial institutions; DNFBPs
+
+---
+
+### Schedule 2 section 11 — Insurance Policies
+
+**Schedule 2 section 11(1)**: Whenever a beneficiary or new beneficiary is identified/designated under an insurance policy, must record the beneficiary's name (if identified by name) or obtain sufficient information to establish identity at time of exercise or payout.  
+**Applies to:** Financial institutions (insurers/banks dealing with insurance)
+
+**Schedule 2 section 11(2)-(3)**: At time of exercise of rights or payout, must verify the beneficiary's identity, and where the beneficiary is a legal person or trust, identify its beneficial owners and (if high risk) verify their identities.  
+**Applies to:** Financial institutions (insurance context)
+
+---
+
+### Schedule 2 section 12 — Wire Transfers
+
+**Schedule 2 section 12(3) — Ordering Institution Recording Requirements**: Before carrying out a wire transfer, ordering institution must record: originator's name, account number (or unique reference), address/ID/date of birth (for transfers ≥$8,000), recipient's name, and recipient's account number.  
+**Applies to:** Financial institutions acting as ordering institutions
+
+**Schedule 2 section 12(5) — Information Accompanying Transfers**: Must include required information (originator + recipient details) in the message/payment form accompanying the wire transfer.  
+**Applies to:** Financial institutions acting as ordering institutions
+
+**Schedule 2 section 12(6) — Domestic Wire Transfers**: For domestic wire transfers, may include only account reference number, but must provide full information to requesting institutions or relevant authority within 3 business days.  
+**Applies to:** Financial institutions (domestic wire transfers)
+
+**Schedule 2 section 12(8) — Intermediary Institution Pass-Through**: Intermediary institutions must transmit all information received with the transfer to the next institution in the chain.  
+**Applies to:** Financial institutions acting as intermediary institutions
+
+**Schedule 2 section 12(9)-(10) — Beneficiary/Intermediary Institution — Incomplete Information**: Where required information is missing or incomplete on receipt of a wire transfer, must obtain the missing information; if unable to obtain it, must consider restricting/terminating relationship with the sending institution or take reasonable measures to mitigate ML/TF risk.  
+**Applies to:** Financial institutions acting as beneficiary/intermediary institutions
+
+---
+
+### Schedule 2 section 13 — Remittance Transactions
+
+**Schedule 2 section 13(2)**: Before carrying out a remittance transaction (non-wire, ≥$8,000) a licensed money service operator must: identify the originator, verify identity by reference to identification document, and record name, ID number, address, currency/amount, date/time, recipient name/address, and delivery method.  
+**Applies to:** Licensed money service operators
+
+---
+
+### Schedule 2 section 13A — Virtual Asset Transfers
+
+**Schedule 2 section 13A(2) — Ordering Institution Recording**: Before carrying out a virtual asset transfer, must obtain and record: originator's name, account/reference number, address/ID (for transfers ≥$8,000), recipient's name, and recipient's account/reference number.  
+**Applies to:** Financial institutions acting as ordering institutions for VA transfers
+
+**Schedule 2 section 13A(4) — Submission to Beneficiary Institution**: Must submit all required originator/recipient information to the beneficiary institution in accordance with applicable codes/guidelines.  
+**Applies to:** Financial institutions acting as ordering institutions for VA transfers
+
+**Schedule 2 section 13A(5) — Beneficiary Institution Recordkeeping**: Beneficiary institution must obtain and record the submitted information.  
+**Applies to:** Financial institutions acting as beneficiary institutions for VA transfers
+
+**Schedule 2 section 13A(6) — Intermediary Pass-Through**: Intermediary institutions must transmit all information received to the next institution.  
+**Applies to:** Financial institutions acting as intermediary institutions for VA transfers
+
+**Schedule 2 section 13A(7) — Missing Information — Beneficiary/Intermediary**: Where required VA transfer information is missing or incomplete, must obtain it from the sending institution; if unable, must consider restricting/terminating relationship or take reasonable ML/TF risk mitigation measures.  
+**Applies to:** Financial institutions as beneficiary/intermediary institutions in VA transfers
+
+---
+
+### Schedule 2 section 14 — Correspondent Banking Relationships
+
+**Schedule 2 section 14(1) — Pre-Establishment Due Diligence**: Before establishing a correspondent banking relationship, authorized institution must collect sufficient information about the proposed respondent bank, determine its reputation and supervisory quality from public information, and assess its AML/CTF controls.  
+**Applies to:** Authorized institutions (banks)
+
+**Schedule 2 section 14(2) — Conditions for Establishment**: Must not establish a correspondent banking relationship unless: senior management approval obtained; AML/CTF controls assessed as adequate and effective; responsibilities documented; and confirmation obtained that respondent bank will verify and monitor customers who can directly operate accounts, and provide relevant documentation on request.  
+**Applies to:** Authorized institutions (banks)
+
+---
+
+### Schedule 2 section 15 — High-Risk Situations
+
+**Schedule 2 section 15 — Enhanced Due Diligence in High-Risk Situations**: In any high-risk situation (as notified by relevant authority or inherently high-risk): (a) before establishing a business relationship — must obtain senior management approval and establish source of wealth/funds or take additional risk mitigation; (b) if relationship already established — must obtain senior management approval, verify beneficial ownership, and establish source of wealth or take additional mitigation; (c) for occasional transactions — must take additional risk mitigation measures.  
+**Applies to:** Financial institutions; DNFBPs
+
+---
+
+### Schedule 2 section 18 — CDD via Intermediaries
+
+**Schedule 2 section 18(2) — Retained Liability**: A financial institution or DNFBP that carries out CDD through an intermediary **remains liable** for any failure to carry out that CDD measure.  
+**Applies to:** Financial institutions; DNFBPs
+
+**Schedule 2 section 18(4) — Data Retrieval Obligations**: When using an intermediary for CDD, must immediately obtain the data/information from the intermediary after completion; ensure the intermediary will provide copies of documents upon request within the record-keeping period; and (for related foreign financial institutions) take reasonable ML/TF risk mitigation measures.  
+**Applies to:** Financial institutions; DNFBPs
+
+---
+
+### Schedule 2 section 19 — Internal Procedures
+
+**Schedule 2 section 19(1) — PEP Identification Procedures**: Must establish and maintain effective procedures for determining whether a customer or beneficial owner is a PEP.  
+**Applies to:** Financial institutions; DNFBPs
+
+**Schedule 2 section 19(2) — Wire Transfer Compliance Procedures**: Financial institutions carrying out wire transfers must establish and maintain effective procedures for identifying and handling non-compliant wire transfers (those not accompanied by required information under section 12(5)).  
+**Applies to:** Financial institutions carrying out wire transfers
+
+**Schedule 2 section 19(2A) — VA Transfer Compliance Procedures**: Financial institutions carrying out virtual asset transfers must establish and maintain effective procedures for identifying and handling non-compliant virtual asset transfers.  
+**Applies to:** Financial institutions carrying out virtual asset transfers
+
+**Schedule 2 section 19(3) — General CDD Compliance Procedures**: Must establish and maintain effective procedures consistent with the Ordinance for carrying out CDD duties under sections 3, 4, 5, 9, 10, and 15, for each type of customer, business relationship, product, and transaction.  
+**Applies to:** Financial institutions; DNFBPs
+
+---
+
+## Record-Keeping Requirements
+
+### Schedule 2 section 20 — Duty to Keep Records
+
+**Schedule 2 section 20(1)(a) — Transaction Records**: For each transaction, must keep the original or copy of documents obtained, and a record of data and information obtained in connection with the transaction under Part 2 of Schedule 2.  
+**Applies to:** Financial institutions; DNFBPs
+
+**Schedule 2 section 20(1)(b) — Customer Records**: For each customer, must keep: (i) original or copy of identification/verification documents; and (ii) original or copy of account files and business correspondence with the customer and any beneficial owner.  
+**Applies to:** Financial institutions; DNFBPs
+
+**Schedule 2 section 20(2) — Transaction Record Retention: 5 Years**: Transaction records must be kept for at least 5 years from the date on which the transaction is completed (regardless of whether the business relationship has ended).  
+**Applies to:** Financial institutions; DNFBPs
+
+**Schedule 2 section 20(3) — Customer Record Retention: 5 Years Post-Relationship**: Customer records must be kept throughout the business relationship and for at least 5 years after the relationship ends.  
+**Applies to:** Financial institutions; DNFBPs
+
+**Schedule 2 section 20(5) — Extended Retention on Regulator Notice**: Where a relevant authority issues a written notice requiring retention for an investigation or other specified purpose, records must be kept for the extended period specified in the notice.  
+**Applies to:** Financial institutions; DNFBPs
+
+---
+
+### Schedule 2 section 21 — Record Format
+
+**Schedule 2 section 21**: Records must be kept as: (a) original documents or microfilm/computer database copy; (b) data/information on microfilm or in a computer database.  
+**Applies to:** Financial institutions; DNFBPs
+
+---
+
+## Group/Cross-Border Obligations
+
+### Schedule 2 section 22 — Branches and Subsidiaries Outside Hong Kong
+
+**Schedule 2 section 22(1) — Financial Institution Group Obligation**: Financial institutions incorporated in HK must ensure their overseas branches and subsidiary undertakings (carrying on the same business) have procedures in place to comply — to the extent permitted by local law — with requirements similar to Schedule 2 Parts 2 and 3.  
+**Applies to:** Financial institutions incorporated in Hong Kong
+
+**Schedule 2 section 22(2) — Notification Where Local Law Prohibits Compliance**: Where local law prevents compliance, the financial institution must notify the relevant authority and take additional measures to effectively mitigate ML/TF risk in the branch/subsidiary.  
+**Applies to:** Financial institutions incorporated in Hong Kong
+
+**Schedule 2 section 22(2A)-(2B) — DNFBP Group Obligation**: DNFBPs incorporated in HK must similarly ensure overseas branches/subsidiaries comply with equivalent requirements; where local law prohibits, must notify the relevant authority/regulatory body and take additional mitigation measures.  
+**Applies to:** DNFBPs incorporated in Hong Kong
+
+---
+
+### Schedule 2 section 23 — General AML/CTF Safeguards
+
+**Schedule 2 section 23**: Must take all reasonable measures to: (a) ensure proper safeguards exist to prevent any contravention of Schedule 2 Parts 2 or 3; and (b) mitigate money laundering and terrorist financing risks.  
+**Applies to:** Financial institutions; DNFBPs
+
+---
+
+## Thresholds & Triggers
+
+| **Threshold** | **Obligation** | **Section** |
+|---|---|---|
+| $120,000 HKD (occasional transaction) | CDD required for financial institutions and DNFBPs before occasional transaction | Schedule 2 section 3(1)(b) |
+| $8,000 HKD (wire transfer or VA transfer) | CDD required for financial institutions before wire/VA transfer | Schedule 2 section 3(1A) |
+| $8,000 HKD (non-wire/VA occasional transaction, VAS providers) | CDD required for licensed VAS providers | Schedule 2 section 3(1B) |
+| $8,000 HKD (wire transfer) | Full originator info (incl. address) required in wire transfer message | Schedule 2 section 12(3A), section 12(5)(a) |
+| $8,000 HKD (remittance transaction) | Licensed MSO must record and verify originator details | Schedule 2 section 13(1) |
+| $8,000 HKD (VA transfer) | Full originator info (incl. address) required; below threshold, address optional | Schedule 2 section 13A(3) |
+| $8,000 HKD (life insurance annual premium) | Simplified CDD may apply | Schedule 2 section 4(5)(c)(i) |
+| $20,000 HKD (life insurance single premium) | Simplified CDD may apply | Schedule 2 section 4(5)(c)(ii) |
+| 5 years | Minimum record retention for transaction records from completion date | Schedule 2 section 20(2) |
+| 5 years | Minimum record retention for customer records after end of business relationship | Schedule 2 section 20(3) |
+| 3 business days | Domestic wire: full originator details must be provided to requesting institution on request | Schedule 2 section 12(6) |
+
+---
+
+## Audit & Oversight Rights
+
+### Part 3 section 9 — Routine Inspection Powers
+
+**section 9(1A)/(1B)**: Authorized persons (appointed by relevant authorities) may at any reasonable time: enter business premises; inspect and copy business records; and make inquiries of the institution or information holders concerning records or transactions.  
+**Applies to:** All prescribed persons (financial institutions, licensed VAS providers, associated entities)
+
+**section 9(3)-(5)**: Authorized persons may require production of specified business records within specified time and place, and require answers to questions regarding those records.  
+**Applies to:** All prescribed persons
+
+**section 9(9)-(10)**: Where required, authorized person may require verification of answers or statements by statutory declaration.  
+**Applies to:** All prescribed persons
+
+**section 9(13)-(14)**: Relevant authorities must provide authorized persons with a copy of their authorization, which must be produced for inspection as soon as reasonably practicable when exercising inspection powers.  
+**Applies to:** Relevant authorities and authorized persons
+
+### Part 3 section 12 — Investigative Powers
+
+**section 12**: Investigators may require the production of records, documents, or information from prescribed persons for investigative purposes.  
+**Applies to:** All prescribed persons
+
+### Part 5B section 53ZSC — Licensed VAS Providers: Audited Accounts
+
+**section 53ZSC**: Auditable entities (licensed VAS providers and associated entities) must submit audited financial statements, prescribed returns, and auditor's report to the Commission annually.  
+**Applies to:** Licensed VAS providers and associated entities
+
+**section 53ZSD**: Prescribed auditor must report to the Commission on any reportable matter (including suspected contraventions of regulatory requirements).  
+**Applies to:** Prescribed auditors of licensed VAS providers and associated entities
+
+### Part 5B section 53ZS — Mandatory Prescribed Auditor Appointment
+
+**section 53ZS**: Auditable entities must appoint a prescribed auditor meeting eligibility requirements. Office of auditor must remain filled at all times.  
+**Applies to:** Licensed VAS providers and associated entities
+
+---
+
+## Licensing and Registration Obligations
+
+### Part 5 section 29 — Money Service Operators
+
+**section 29**: No person may operate a money service (money changing or remittance) without holding a licence granted by the Commissioner under Part 5.  
+**Applies to:** All persons operating money services in HK
+
+### Part 5B section 53ZRD — Virtual Asset Service Providers
+
+**section 53ZRD(1)**: No corporation may carry on a business of providing a VA service in HK, or actively market such services to HK investors, without being licensed as a licensed VAS provider.  
+**Applies to:** Corporations providing VA services
+
+**section 53ZRD(3)**: No individual may perform a regulated function in relation to a licensed VAS provider's business without being a licensed representative accredited to that provider.  
+**Applies to:** Individuals performing regulated functions for VAS businesses
+
+### Part 5A section 53F — Trust or Company Service Providers
+
+**section 53F**: No person may carry on a trust or company service business without being licensed under Part 5A.  
+**Applies to:** All persons providing trust or company services in HK
+
+### Part 5C section 53ZUE — Precious Metals and Stones Dealers
+
+**section 53ZUE**: No person may carry out certain cash transactions in precious metals and stones above specified thresholds without being registered as a PMS dealer.  
+**Applies to:** Dealers in precious metals and stones
+
+---
+
+## Confidentiality Requirements (Part 6A)
+
+### section 76B — Confidentiality
+
+**section 76B**: Specified persons (relevant authorities, regulatory bodies, and their staff) must not disclose information obtained in performing functions under the Ordinance, except as permitted under sections 76C–76F.  
+**Applies to:** Relevant authorities and their authorized/appointed persons
+
+### section 76E — Tipping-Off Prohibition
+
+**section 76E**: A person subject to inspection, investigation, or disciplinary action must not disclose information that could prejudice the investigation or proceedings.  
+**Applies to:** Prescribed persons subject to regulatory proceedings
+
+### section 76F — Onward Disclosure Prohibition
+
+**section 76F**: Recipients of information disclosed under sections 76C, 76D, or 76E must not further disclose that information except as permitted.  
+**Applies to:** All recipients of regulated disclosures
+
+---
+
+## Notes
+
+- **Effective Date of PDF version:** 2 November 2023 (last updated date on ordinance)
+- **Key Amending Ordinances:** 4 of 2018 (major DNFBP expansion); 15 of 2022 (VA provisions, virtual asset transfers, PMS dealers)
+- **Downstream Use:** These clauses provide the basis for `[Mandated: hk-aml-guide section <ref>]` annotations in contract reviews, particularly for acquiring contracts, payment operator agreements, TCSP agreements, and VAS provider arrangements.
+- **Disclaimer:** This is a structured extract for contract reference purposes and does not constitute legal advice. For high-stakes matters, consult qualified HK legal counsel.
+- **DNFBPs defined as:** accounting professionals, legal professionals, estate agents, TCSP licensees, and Category B PMS registrants (dealers in precious metals and stones above specified cash transaction amounts)
+- **"Financial institutions" defined as:** authorized institutions (banks), licensed corporations (securities), authorized insurers, licensed insurance intermediaries, licensed money service operators, SVF licensees, licensed VAS providers, the Postmaster General

package/skills/core/reg-parser/references/mandates/visa-vars.md

@@ -0,0 +1,205 @@
+# Visa Acceptance Risk Standards (VARS) — Contract Obligation Extract
+> Source: Visa Ecosystem Risk Programs Guide, October 2024
+> Preprocessed: 2026-04-02
+> Version: October 2024
+
+---
+
+## Mandatory Downstream Agreement Clauses
+Clauses that Acquirers MUST include in their agreements with merchants/TPAs/PayFacs.
+
+**section AACQ.C2.1 Merchant Agreement — Compliance with Visa Rules**: Each Merchant Agreement must require the Merchant to adhere to Acquirer policies and procedures, fulfill applicable legal/regulatory obligations, comply with the Visa Rules, and refrain from submitting illegal transactions.
+
+**section AACQ.C2.1 Merchant Agreement — Revocation Clause**: The Merchant Agreement must contain a clause allowing the Acquirer to revoke Visa acceptance from any Merchant for activity that harms the goodwill of the Visa payment system, and must require written notification to the Merchant upon termination.
+
+**section AACQ.C2.1 Merchant Agreement — Termination for Cause / VMSS Listing**: Where a Merchant is terminated for cause, the agreement must require the Merchant to be listed on the Terminated Merchant File (e.g., VMSS), and Acquirers must suspend Visa processing by the date specified by Visa upon Visa-directed prohibition.
+
+**section AACQ.C2.1 Merchant Agreement — Investigation Cooperation**: In the event of an ongoing investigation at the time the Merchant Agreement is signed, the Merchant must fully cooperate with the investigation until its completion in compliance with local laws.
+
+**section AACQ.C2.1 Merchant Agreement — Prohibition on Transaction Laundering**: The Merchant Agreement must prohibit resubmission of previously disputed charges, submission of fraudulent/unauthorized transactions, transaction laundering (TLD), and unauthorized storage/processing/transmission of payment data.
+
+**section AACQ.C2.1 Merchant Agreement — VARS Reference (post October 21, 2024)**: Any Merchant Agreement executed on or after October 21, 2024 must reference the Visa Acceptance Risk Standards (VARS); agreements executed on or before October 20, 2024 may continue to reference GARS.
+
+**section AACQ.C3.1 Exposure Mitigation Clause**: Acquirer contracts with Merchants/TPAs must include a clause enabling exposure mitigation via reserves, personal/corporate/bank guarantees, and account/transaction level holds, with clear explanation of reconciliation processes and segregation of reserve funds.
+
+**section AACQ.C4.1 Settlement of Funds**: The Merchant Agreement must stipulate that the Acquirer settles funds promptly and in accordance with regulations, with settlement within market-based timelines (subject to mandated holding periods or ongoing investigations), and that the Acquirer is responsible for providing settlement funds.
+
+**section AACQ.C14.2 PCI DSS Compliance Clause in Contracts**: Contracts and agreements with TPAs and Merchants must clearly define their responsibilities to adhere to Visa standards, liabilities for noncompliance, and the obligation to permit inspections by the Acquirer or Visa.
+
+**section ATPA.C1.1 TPA Agreement — Minimum Standards**: Every written agreement with a TPA performing Cardholder/Merchant solicitation or handling Cardholder/Transaction data must incorporate Visa minimum standards; permit Visa to conduct financial and procedural audits at any time; require TPA compliance with Visa Rules and applicable laws; require TPA adherence to the Acquirer's policies and PCI DSS; require cooperation with forensic investigations; and include a termination provision linked to Visa Rules violations or insolvency.
+
+**section ATPA.C1.1 TPA Agreement — Settlement Prohibition**: The TPA Agreement must state that Acquirers pay or credit the TPA's account promptly after transaction deposit, and must prohibit deposit of transactions on behalf of another TPA.
+
+**section ATPA.C1.1 TPA Agreement — Visa Authority**: The contract must grant Visa the right to determine and impose risk conditions on the TPA and the right to limit or terminate the Acquirer's agreement with the TPA.
+
+**section ATPA.C1.2 PayFac/DWO Agreement — Key Provisions**: Acquirers must ensure PayFac/DWO agreements require that: both PayFac and its Sponsored Merchants adhere to Visa Rules; the PayFac contracts with each Sponsored Merchant; the Acquirer has the right to immediately terminate; the PayFac/DWO accepts full financial liability for all Sponsored Merchant transactions; Cardholders are not asked to waive dispute rights; no transactions are processed on behalf of another PayFac; and Sponsored Merchants adhere to PCI DSS and PCI SSF Standards.
+
+**section ATPA.C1.2 PayFac Agreement — Direct Merchant Agreement Threshold**: Acquirers contracting with a PayFac must establish a direct Merchant Agreement with any Sponsored Merchant whose annual Transaction volume exceeds USD 1 million (for new applications, upon renewal, or within 2 years of exceeding the threshold).
+
+**section ATPA.C1.3 Marketplace Agreement — Key Provisions**: Acquirers must ensure Marketplace agreements require Marketplace and its retailers to comply with the Visa Rules; the Marketplace must contract with each retailer before depositing transactions; the Acquirer may prohibit individual retailers from Visa participation; the Marketplace is fully financially liable for all Cardholder disputes and retailer transactions; the Marketplace must not transfer financial liability to Cardholders; and the Marketplace must not contract with retailers whose Visa acceptance was terminated by Visa or a government agency.
+
+**section AATM.C2.1 ATM Operator Agreement**: ATM Acquirers must have a written agreement with each ATM Operator that identifies the ATM Acquirer, includes a termination-for-noncompliance clause, and states that ATM Operators must comply with the Visa Rules; pricing arrangements must not be included.
+
+**section AHIR.C1.1 High Integrity Risk Merchant Controls**: Acquirers and their designated TPAs processing for High Integrity Risk Merchants must maintain controls and oversight to ensure TPAs operate legally in all countries, and that Merchants only submit transactions legal in both buyer's and seller's jurisdictions.
+
+---
+
+## Prohibited Conduct
+Explicitly prohibited activities, business types, or merchant categories.
+
+**section AACQ.C2.1**: Merchants are prohibited from knowingly submitting any transaction that is illegal or that the Merchant should have known was illegal.
+
+**section AACQ.C2.1**: Resubmission of previously disputed charges (charges returned to the Merchant via dispute) is prohibited.
+
+**section AACQ.C2.1**: Submission or execution of fraudulent or unauthorized transactions into the payment system is prohibited.
+
+**section AACQ.C2.1**: Transaction laundering (TLD) — processing card payments for undisclosed goods or services by layering them through an approved Merchant's credentials — is prohibited.
+
+**section AACQ.C2.1**: Unauthorized storage, processing, or transmission of payment data through non-approved software and processes is prohibited; failure to enforce data security requirements for Merchants/TPAs is also prohibited.
+
+**section ATPA.C1.1**: TPAs must not knowingly submit any transaction that is illegal or that the Merchant should have known was illegal.
+
+**section ATPA.C1.2**: PayFacs must not process transactions on behalf of another PayFac; Acquirers must ensure PayFacs only deposit transactions between a Cardholder and a Sponsored Merchant of that PayFac.
+
+**section ATPA.C1.2**: PayFacs and SDWOs must not process transactions from Sponsored Merchants or retailers outside the Acquirer's jurisdiction.
+
+**section ATPA.C1.2**: PayFacs and Marketplaces must not contract with a Sponsored Merchant or retailer whose contract to accept Visa transactions was terminated by Visa or a government agency.
+
+**section ATPA.C1.2 / ATPA.C1.3**: PayFacs, DWOs, and Marketplaces must not require or ask Cardholders to waive their dispute rights, and must not allow their Sponsored Merchants/retailers to do so either.
+
+**section AHIR.C1.1**: Acquirers must not enter High Integrity Risk Merchant transactions into the Visa Payment System before the High Integrity Risk Acquiring Registration has been approved by Visa.
+
+**section AACQ.C14**: Post-authorization storage of the following data is prohibited for all TPAs and Merchants: full magnetic stripe data, CVV2, PIN or encrypted PIN block, TAVV, DTVV, and Visa Secure CAVV.
+
+---
+
+## Thresholds & Triggers
+
+**section AACQ.C8.3 Exception Report Trigger — Settlement Delay**: Exception reports are generated when the average elapsed time between the Processing Date and the Transaction Date or Settlement Date exceeds **15 calendar days**; Acquirers must investigate and report results to Visa immediately upon appearance on an exception report.
+
+**section ATPA.C1.2 Direct Agreement Threshold — Sponsored Merchant Volume**: A direct Merchant Agreement between the Acquirer and a Sponsored Merchant is required when the Sponsored Merchant's annual Transaction volume exceeds **USD 1 million** (applicable to new applications, renewals, or within 2 years of exceeding the threshold).
+
+**section ATPA.C9.1 Credit Risk Information — Response Deadline**: Acquirers must provide Visa with requested underwriting, exposure, and risk monitoring information (regarding Merchants, PayFacs, Marketplaces, DWOs, or other entities) within **5 business days** of the request.
+
+**section ATPA.C10.1 TPA Change Reporting Deadline**: Acquirers must notify Visa of any change in a TPA's principals or business relationship (including ownership changes or contract termination) within **5 business days** of the change or knowledge of the change.
+
+**section ATPA.C11.1 Record Retention Minimum**: TPAs must maintain complete Merchant records (including investigation information) for a minimum of **2 years** after Merchant Agreement termination, or longer as specified by local law.
+
+**section AACQ.C12.1 Dispute Retention Minimum**: Acquirers must investigate and retain dispute investigation details for a minimum of **2 years**, or as specified by law.
+
+**section AACQ.C12.1 Marketplace Disclosure Retention**: Marketplace retailer names, transaction dates, and transaction amounts must be made available to the Cardholder for at least **120 days** from the Processing Date.
+
+**Appendix J — VAMP Threshold**: Acquirers must maintain their Visa Acquirer Monitoring Program (VAMP) rate below **30 basis points (bps)**; individual Merchants must not exceed **150 bps**. Exceeding these thresholds triggers VAMP enforcement actions.
+
+**Appendix J — Enumeration Threshold**: Acquirers' enumerated authorization attempts must remain below **2,000 bps**. Exceeding this threshold triggers review and potential enforcement.
+
+**Appendix J — VIRP KPI**: Acquirers must have no VIRP identification or confirmed TLD cases for illegal or miscoded activity.
+
+**Appendix J — PCI DSS**: Full PCI DSS compliance is required as a KPI under the Account Information Security Program.
+
+**section AHIR.C1.2 High Integrity Risk Registration Tiers**:
+- **Tier 1**: Initial control assessment + periodic reassessments (up to annually) + annual control self-assessment per approved category.
+- **Tier 2**: Initial control assessment + periodic reassessments (up to annually) + annual control self-assessment.
+- **Tier 3**: Registration with Visa; complete control self-assessment upon request.
+
+---
+
+## Monitoring Program Requirements
+Requirements related to Visa Monitoring Programs (VAMP, VDMP, VFMP, etc.) that Acquirers must comply with or enforce downstream.
+
+**section AACQ.C8.1 Portfolio Monitoring — All Acquirers**: Acquirers must maintain continuous monitoring of Merchant/TPA activity throughout the entire relationship lifecycle (from onboarding through termination) to detect fraud/collusion, credit issues, disputes, AML, brand-damaging and illegal activities; must monitor transaction velocity, volume changes, refund patterns, authorization spikes, URL/product activity, and VMSS alerts.
+
+**section AACQ.C8.2 Fraud Monitoring**: Acquirers must possess fraud detection capabilities (rules/models for identifying suspicious behavior) and fraud prevention tools (AVS, CVV2, ML algorithms, fraud scoring, geolocation, velocity checking, biometric authentication) throughout the Merchant lifecycle.
+
+**section AACQ.C8.3 Exception Reporting**: Acquirers must generate exception reports for deviations in daily transaction averages, deposit volumes, average transaction amounts, daily dispute counts, and settlement timing exceeding 15 calendar days; Acquirers must investigate flagged Merchants immediately and report findings to Visa.
+
+**section AACQ.C10.1 / ATPA.C8.3 Suspicious Activity Reporting**: Acquirers must immediately report any data breach, suspected or confirmed loss/theft/compromise of Visa account information, and any fraud or transaction laundering by a Merchant or TPA, including a remediation plan, as specified in "What to Do If Compromised."
+
+**section AACQ.C12.1 VAMP — Dispute Monitoring**: For Merchants exceeding VAMP thresholds, Acquirers must flag these Merchants and generate a monthly report on disputes by Merchant category and Merchant level; Acquirers must review Merchants with high dispute rates for deceptive marketing or misleading practices.
+
+**section AACQ.C17.1 Transaction Laundering Monitoring**: Acquirers must implement controls during underwriting and ongoing monitoring to detect concealed illegal transactions, including review of transaction data, URL verification, website analytics, and monitoring for Merchant identifier mismatches.
+
+**section ATPA.C8.1 TPA Portfolio Monitoring**: Acquirers must regularly analyze TPA transaction patterns, use fraud detection systems, conduct compliance checks against AML and data security standards, assess TPA risk profiles against KRIs, generate regular TPA transaction reports, and conduct an annual review of each TPA including financial statements, ownership changes, policy alignment, and PCI DSS status.
+
+**section ATPA.C8.1 — TPA Settlement Jurisdiction Compliance**: Acquirers must evaluate that TPAs are only submitting transactions into interchange within the Acquirer's jurisdiction, and from DWOs, Merchants, Marketplaces, and Sponsored Merchants within that jurisdiction.
+
+**section AATM.C4.1 ATM Monitoring**: ATM Acquirers must track and report suspicious ATM transactions, monitor for unusual deposit/withdrawal patterns, repeated high-volume withdrawals at the same ATM(s) from multiple cards of a single Issuer, and excessive charges for minor withdrawals.
+
+**section AVDC.C2.1 Visa Direct Scam Monitoring**: Money Movement Entities must monitor for Account Takeover (ATO), Authorized Push Payment (APP) scams, and unauthorized card usage in Visa Direct transactions; monitoring capabilities must include email/phone reputation analysis, KYC/sanctions/PEP checks, and behavioral analytics.
+
+**section AHIR.C1.1 VIRP Compliance**: Acquirers and TPAs processing for High Integrity Risk Merchants must comply with the Visa Integrity Risk Program (VIRP), maintain enhanced due diligence for all High Integrity Risk Merchants, and ensure TPAs comply with all applicable laws and regulations in each country in which they operate.
+
+**section AACQ.C16.1 Ongoing Compliance with Visa Rules**: Acquirers must ensure their operational, sales, and technical functions remain compliant with all Visa Rules and technical standards as updated periodically, and must adopt updated standards by the effective dates communicated by Visa.
+
+---
+
+## Audit & Oversight Rights
+
+**section ATPA.C1.1**: TPA agreements must permit Visa to conduct financial and procedural audits and general reviews of the TPA at any time, and require the TPA to make Cardholder and Merchant information accessible to Visa and regulatory agencies upon request.
+
+**section AACQ.C14.2**: Acquirers must guarantee that contracts and agreements with TPAs and Merchants clearly include the obligation to permit inspections by the Acquirer or Visa.
+
+**section AACQ.C14.6**: Upon request, Acquirers must provide Visa with certification that TPAs and Merchants comply with PCI DSS.
+
+**section ATPA.C3.1(h)**: Acquirers must confirm a TPA's capability to provide Visa with quarterly reports detailing the goods or services each of the Sponsored Merchants is doing business on, if requested.
+
+**section ATPA.C9.1**: Acquirers must provide Visa, upon request and within 5 business days, with a comprehensive overview of the underwriting process, a complete breakdown of current Visa exposure and collateral held, and a detailed breakdown of the risk monitoring policy for any entity in the Acquirer's portfolio.
+
+**section 5.1 VARS Reviews**: VARS reviews may be triggered at onboarding or on an ongoing risk-based basis; reviews must be completed by Visa staff or selected third-party reviewers with Visa oversight; Acquirers are responsible for the cost of a VARS review and must share the final report with Visa.
+
+**section 5.2 VARS Remediation**: Following a VARS review, Acquirers must implement approved remediation plans within agreed timeframes; if an Acquirer fails to do so, Visa may impose Member Risk Reduction Requirements as specified in the Visa Rules.
+
+**section ATPA.C11.1**: Acquirers of a TPA undergoing a forensic investigation must notify Visa upon receiving notice; TPAs must maintain complete Merchant records for at least 2 years after Merchant Agreement termination.
+
+**section AHIR.C1.2**: Tier 1 and Tier 2 High Integrity Risk Acquirers are subject to periodic reassessments (up to annually, at Visa's discretion) and must complete annual control self-assessments for each approved High Integrity Risk Merchant category; Tier 3 must complete a control self-assessment upon Visa's request.
+
+---
+
+## Registration & Reporting Requirements
+
+**section AACQ.C6.1 Merchant Data Reporting to Visa**: Acquirers must collect and provide to Visa (when requested) required KYC/KYB information for each Merchant, Marketplace, Sponsored Merchant, or Ramp Provider in the specified format, including: DBA name, legal name, outlet address, telephone number, Acquirer-assigned Merchant ID, business registration/tax number, PayFac name and identifier (where applicable), and Ramp Provider/Conversion Affiliate identifiers (where applicable).
+
+**section AACQ.C5.1 Terminated Merchant File Check**: Before finalizing a contract with any prospective Merchant, Acquirers must consult both internal terminated/declined profile lists and external resources including VMSS; if a match is found, Acquirers must verify identity, engage with the listing Acquirer, and make an informed decision.
+
+**section AACQ.C8.3 Exception Report Investigation & Reporting**: Acquirers must immediately investigate any Merchant appearing on an exception report and report the results of the investigation and actions taken to Visa; where investigation reveals illegal or fraudulent activity, Acquirers must cooperate with Visa, Issuers, and law enforcement.
+
+**section AACQ.C10.1 Data Breach Reporting**: Acquirers must immediately report any data breach to Visa including a remediation plan, as specified in "What to Do If Compromised," in a thorough and complete format.
+
+**section AACQ.C5.1 / AACQ.C6.2 KYC/KYB Requirements**: Acquirers must collect and verify principal/director information, ownership information, business license/registration, and screen all Merchants against applicable economic and government trade-sanction watch-lists; for e-Commerce Merchants, Acquirers must also collect and verify a listing of URLs used and confirm registered domain ownership.
+
+**section ATPA.C4.1 PayFac Registration with Visa**: Acquirers must ensure that their PayFac's registration (including due diligence review attestation) is confirmed by Visa before submitting any transactions on behalf of the PayFac or its Sponsored Merchants; if the PayFac is high-integrity risk, it must be registered as a High-Risk Internet PayFac.
+
+**section ATPA.C4.1 PayFac Unique Identifier**: Acquirers must obtain a unique PayFac identifier from Visa, assign it to each PayFac, and ensure all authorization records include both the PayFac identifier and the Sponsored Merchant identifier; clearing records must include at minimum the PayFac identifier.
+
+**section ATPA.C5.1 SDWO Registration**: Acquirers must register each Staged Digital Wallet Operator (SDWO) as a TPA with Visa and assign a unique CAID number for card-absent transactions; the SDWO's primary location must be set as the country of its principal place of business.
+
+**section ATPA.C8.3 TPA Suspicious Activity Reporting**: Acquirers must immediately report to Visa any suspected or confirmed loss, theft, compromise, or misuse of Visa account information, Cardholder information, transaction information, systems, or equipment by a Merchant or TPA, and any fraud or transaction laundering, with a thorough remediation plan.
+
+**section ATPA.C10.1 TPA Change Notification**: Acquirers must use the Program Request Management application (or appropriate form) to notify Visa of any change in a TPA's principals or business relationship (ownership changes, termination) within 5 business days of the change or knowledge of it.
+
+**section ATPA.C11.1 TPA Record Retention**: Acquirers must ensure TPAs maintain complete, well-documented Merchant records for at least 2 years after Merchant Agreement termination; Acquirers must notify Visa when a TPA is undergoing a forensic investigation.
+
+**section AHIR.C1.2 High Integrity Risk Acquirer Registration**: To acquire High Integrity Risk Merchants, Acquirers must complete and submit the High Integrity Risk Acquiring Registration Application with required documents, provide written attestation that no prohibited transactions have been or will be processed until registration is approved, submit a one-time non-refundable application fee, and be in good standing in all Visa Risk Management Programs.
+
+**section AHIR.C1.2 Annual Control Self-Assessment**: Tier 1 Acquirers must complete an annual control self-assessment per approved High Integrity Risk Merchant category; Tier 2 Acquirers must complete an annual control self-assessment for High Integrity Risk Merchant Tier 2 acquiring; Tier 3 Acquirers must complete a control self-assessment upon Visa's request.
+
+**section AVDC.C1.1 Program Information Form (PIF) for Visa Direct**: Money Movement Entities must have an approved Program Information Form (PIF) from Visa before BINs are enabled for OCTs and AFTs; if the Originator's business model changes over time, Visa must be contacted or the PIF updated.
+
+**section AACQ.C13.1 Merchant Data Consistency**: Acquirers and their TPAs must maintain uniformity in key identifiers (Registered Merchant Names, Merchant Logos, CAID, MCC, Merchant ID, Merchant DBA, Terminal ID, Merchant data) across the full transaction lifecycle including authentication, authorization, clearing, settlement, fraud reporting, and dispute reporting.
+
+**section AATM.C3.1 ATM Operator Data Collection**: ATM Acquirers must collect DBA name, legal name, outlet location, principal names/middle initials, and incorporation status from each ATM Operator and TPA during onboarding.
+
+**section AATM.C5.1 Visa ATM Acceptance Marks**: Acquirers must display Visa ATM and Plus Acceptance Marks on all ATMs within **30 days** from the date the Acquirer begins accepting Visa Cards and Plus enabled Cards.
+
+---
+
+## Notes
+- **Jurisdiction scope**: VARS applies globally to all Visa Principal Acquirers and Money Movement Entities using VisaNet/Visa Direct. Country- and region-specific requirements may supplement VARS; Acquirers must consult Visa Rules and local legal counsel for jurisdiction-specific obligations.
+- **Effective date / version**: This document is the October 2024 version of VARS, which replaces the Global Acquirer Risk Standards (GARS). Merchant agreements executed on or after October 21, 2024 must reference VARS (not GARS).
+- **Primacy of Visa Rules**: In any conflict between VARS content and the Visa Core Rules and Visa Product and Service Rules, the Visa Core Rules govern. VARS is a supplementary document.
+- **Acquirer liability**: Acquirers are liable for all acts and omissions of their Merchants, TPAs, and employees under the Visa Rules.
+- **Mandatory vs. Recommended Controls**: VARS distinguishes between Mandatory Controls (minimum requirements Acquirers must comply with) and Recommended Controls (optional best practices). Only Mandatory Controls create enforceable obligations.
+- **Archetype applicability**: AACQ obligations apply to all Acquirers. ATPA obligations apply only to Acquirers sponsoring TPAs. AHIR obligations apply only to Acquirers processing for High Integrity Risk Merchants. AATM obligations apply only to ATM Acquirers. AVDC obligations apply only to Money Movement Entities originating Visa Direct transactions. Archetypes are not mutually exclusive.
+- **VARS Review cost**: Acquirers bear the cost of VARS reviews; reviews must be conducted by Visa staff or Visa-approved third-party reviewers.
+- **VIRP**: High Integrity Risk Merchant details, registration tiers (Tier 1, 2, 3 categories), and VIRP-specific requirements are contained in a separate VIRP document accessible via Visa Online (VOL); this extract covers only what is referenced in the October 2024 VARS guide.
+- **Referenced documents**: Key downstream references include: Third-Party Agent Due Diligence Risk Standards; Payment Facilitator and Marketplace Risk Guide; Visa Account Information Security Program; What to Do If Compromised; PCI DSS; Digital Currency Transactions Guide – Ramp Provider Program Requirements; Third-Party Agent Registration Program – TPA Types and Functional Descriptions.