@1aboveio/skills 0.20.2 → 0.20.3

package/skills/document-utils/reg-parser/references/checklists/hk-amlo-checklist.md

@@ -0,0 +1,469 @@
+```yaml
+name: "HK AMLO Compliance Checklist"
+regulation: "Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), Hong Kong"
+version: "1.0"
+scope: "Customer due diligence, ongoing monitoring, special requirements (wire transfers, virtual asset transfers, correspondent banking, PEPs), prohibitions, and record-keeping obligations imposed on financial institutions and DNFBPs under Schedule 2 of Cap. 615 (consolidated 15-05-2026)"
+date: "2026-05-15"
+summary:
+  categories: 9
+  total_items: 31
+  critical: 23
+  major: 7
+  minor: 1
+```
+
+## CAT-01: Customer Due Diligence Measures
+
+### CAT-01-001: Identify and verify customer identity
+
+- **Requirement:** Identify the customer and verify the customer's identity using documents, data, or information from a governmental body, the relevant authority/regulator, an equivalent foreign authority, a recognized digital identification system, or another reliable and independent source, before establishing a business relationship or carrying out a triggering occasional transaction.
+- **Source:** Schedule 2, §2(1)(a), §2(1)(ab), §3(1)(a), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Identification documents collected for each customer (natural person or entity)
+  - [ ] Source of the identifying documents/data falls within an approved source class (gov body, relevant authority, foreign equivalent, recognized digital ID system, or recognized reliable independent source)
+  - [ ] Verification completed before establishing the business relationship (or within the deferral conditions of §3(2))
+  - [ ] Verification date, method, and source of evidence recorded in the customer file
+- **Evidence:**
+  - Copy of identification document
+  - Verification log entry citing source and officer
+  - Customer onboarding form with date of verification
+
+### CAT-01-002: Identify and verify beneficial owners
+
+- **Requirement:** Where the customer has a beneficial owner, identify the beneficial owner and take reasonable measures to verify the beneficial owner's identity, including measures to understand the ownership and control structure of any legal person or trust customer.
+- **Source:** Schedule 2, §2(1)(b), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Beneficial owner(s) identified using the >25% ownership/voting threshold or "ultimate control" test in §1(1)
+  - [ ] For trust customers, beneficiaries, settlor, trustee, protector/enforcer, and ultimate controller all assessed
+  - [ ] Reasonable measures taken to verify each beneficial owner's identity
+  - [ ] Ownership/control structure of the legal person or trust mapped and recorded
+- **Evidence:**
+  - Beneficial ownership declaration
+  - Group/trust structure chart with percentages
+  - Verification records for each identified beneficial owner
+
+### CAT-01-003: Obtain purpose and intended nature of the business relationship
+
+- **Requirement:** Where a business relationship is to be established, obtain information on the purpose and intended nature of the business relationship, unless the purpose and intended nature are obvious.
+- **Source:** Schedule 2, §2(1)(c), Cap. 615
+- **Severity:** major
+- **Verification:**
+  - [ ] Customer questionnaire or equivalent captures purpose and expected nature of the relationship
+  - [ ] Expected transaction types and volumes documented
+  - [ ] Determination recorded where the purpose is judged "obvious" and CDD measure (c) omitted
+- **Evidence:**
+  - Completed onboarding questionnaire
+  - Account-opening memo
+
+### CAT-01-004: Verify persons purporting to act on behalf of the customer
+
+- **Requirement:** Where a person purports to act on behalf of the customer, identify that person, take reasonable measures to verify their identity using the approved source classes, and verify their authority to act on behalf of the customer.
+- **Source:** Schedule 2, §2(1)(d), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Identity of representative captured and verified per §2(1)(d)(i) or (ia)
+  - [ ] Documentary evidence of authority to act obtained (power of attorney, board resolution, authorisation letter, etc.)
+  - [ ] Authorised-signatory record updated
+- **Evidence:**
+  - Representative's identification record
+  - Authorisation document (POA, resolution, letter)
+  - Signatory list
+
+### CAT-01-005: Apply CDD at all statutory triggers
+
+- **Requirement:** Carry out CDD measures before establishing a business relationship; before carrying out an occasional transaction at or above HKD 120,000 (or HKD 8,000 for a wire transfer or virtual asset transfer, including for licensed VAS providers); when there is a money-laundering or terrorist-financing suspicion; or when there is doubt about the veracity or adequacy of previously obtained identification information.
+- **Source:** Schedule 2, §3(1), §3(1A), §3(1B), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Onboarding workflow blocks relationship setup until CDD is complete (subject to §3(2) deferral)
+  - [ ] Transaction monitoring system flags occasional transactions at the relevant threshold (incl. linked-transaction aggregation)
+  - [ ] STR/SAR workflow triggers re-CDD on suspicion
+  - [ ] Process exists to re-verify when previously obtained information is doubted
+- **Evidence:**
+  - System control documentation
+  - Sample onboarding/transaction logs showing CDD trigger points
+  - Re-verification case files
+
+### CAT-01-006: Refusal and termination when CDD cannot be completed
+
+- **Requirement:** If unable to comply with §3(1), (1A), (1B), or (3), do not establish a business relationship or carry out the occasional transaction; if a relationship already exists, terminate it as soon as reasonably practicable.
+- **Source:** Schedule 2, §3(4), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Documented procedure for declining or exiting customers when CDD cannot be completed
+  - [ ] Cases logged where onboarding was refused or terminated on CDD-failure grounds
+  - [ ] Exit timeline tracked and reviewed
+- **Evidence:**
+  - Refusal/termination procedure
+  - Refused-applicant log
+  - Termination case files with timing
+
+## CAT-02: Simplified Due Diligence
+
+### CAT-02-001: Apply SDD only where the customer or product qualifies
+
+- **Requirement:** An FI or DNFBP applying Simplified CDD (limited to measures §2(1)(a)/(ab), (c) and (d)) must do so only where it has reasonable grounds to believe the customer falls within §4(3) (e.g. another FI, listed corporation, supervised investment vehicle, public body, or government in an equivalent jurisdiction) or the product falls within §4(5) (e.g. qualifying pension scheme, life policy under specified premium thresholds).
+- **Source:** Schedule 2, §4(1), §4(3), §4(4), §4(5), Cap. 615
+- **Severity:** major
+- **Verification:**
+  - [ ] SDD eligibility test applied and documented before applying simplified measures
+  - [ ] Documentary basis for the qualifying customer/product category recorded
+  - [ ] Periodic review confirms the qualifying status still holds
+- **Evidence:**
+  - SDD eligibility memo
+  - Listing/regulator confirmation for the qualifying customer
+  - Product spec showing premium/scheme limits
+
+## CAT-03: Ongoing Monitoring and Pre-existing Customers
+
+### CAT-03-001: Continuously monitor the business relationship
+
+- **Requirement:** Continuously monitor the business relationship by reviewing customer documents and data to keep them up-to-date and relevant, conducting appropriate scrutiny of transactions for consistency with the customer's profile and source of funds, and identifying complex, unusually large or unusual-pattern transactions with no apparent economic or lawful purpose, and examining and recording the findings in writing.
+- **Source:** Schedule 2, §5(1), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Periodic review schedule established by risk rating
+  - [ ] Transaction-monitoring system scrutinises activity against customer profile and source of funds
+  - [ ] Unusual/complex/large-pattern transactions flagged, investigated, and findings recorded in writing
+  - [ ] Customer KYC refresh process keeps documents and data current
+- **Evidence:**
+  - Periodic review records
+  - Transaction-monitoring alerts and dispositions
+  - Written findings memos on unusual-pattern transactions
+
+### CAT-03-002: Additional monitoring measures for higher-risk cases
+
+- **Requirement:** Where the customer was not physically present for identification, the customer or beneficial owner is known to be a politically exposed person, or the case falls within §15 (high-risk situations), take additional monitoring measures to compensate for the elevated ML/TF risk.
+- **Source:** Schedule 2, §5(3), §5(4), §5(5), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Risk classification flags non-face-to-face, PEP, and §15 high-risk relationships for enhanced monitoring
+  - [ ] Enhanced-monitoring scope (frequency, depth, transaction thresholds) documented
+  - [ ] Former-PEP carve-out only applied after a documented risk assessment finds no high ML/TF risk
+  - [ ] Non-face-to-face carve-out only applied where a recognized digital ID system was used
+- **Evidence:**
+  - Enhanced-monitoring policy
+  - Sample case files for non-face-to-face, PEP, and §15 cases
+  - Risk-assessment memos justifying any former-PEP carve-out
+
+### CAT-03-003: Trigger CDD on pre-existing customers when activity changes
+
+- **Requirement:** For a pre-existing customer (excluding §7 pre-existing respondent banks), carry out CDD measures in addition to §3(1)(d) and (e) when a transaction with the customer is unusual or suspicious or inconsistent with the customer's known profile, or when a material change occurs in the way the customer's account is operated; terminate the relationship if unable to comply.
+- **Source:** Schedule 2, §6(1), §6(2), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Pre-existing-customer population identified and tracked
+  - [ ] Event-driven triggers (unusual/suspicious transaction or material change in account operation) feed CDD workflow
+  - [ ] Termination procedure invoked where CDD cannot be completed
+- **Evidence:**
+  - Pre-existing-customer register
+  - Event-trigger procedure
+  - Triggered CDD case files
+
+### CAT-03-004: Pre-existing respondent banking relationships
+
+- **Requirement:** An authorized institution must terminate a pre-existing correspondent banking relationship with a respondent bank on the commencement date of the Ordinance unless, before that date, it had carried out §14(1) measures and was satisfied with the respondent's AML/CFT controls; had documented the parties' respective responsibilities; and was satisfied as to the respondent's CDD and continuous monitoring of customers who can directly operate payable-through accounts.
+- **Source:** Schedule 2, §7(1), §7(2), Cap. 615
+- **Severity:** major
+- **Verification:**
+  - [ ] Inventory of pre-existing respondent banking relationships maintained
+  - [ ] For each retained relationship, documented §14(1)-style assessment exists
+  - [ ] Responsibilities of both institutions documented
+  - [ ] Direct-operator CDD assurance from the respondent on file
+- **Evidence:**
+  - Respondent bank inventory
+  - Pre-commencement assessment files
+  - Responsibilities matrix
+
+## CAT-04: Special Requirements (Enhanced Due Diligence)
+
+### CAT-04-001: Non-face-to-face customer measures
+
+- **Requirement:** Where the customer has not been physically present for identification purposes, carry out at least one of the §9(1) measures: further verify identity using documents/data not previously used; take supplementary verification measures; or route the first payment through an account opened in the customer's name with an authorised institution or an equivalent foreign institution. Exempt only where identification was performed using a recognized digital identification system.
+- **Source:** Schedule 2, §9(1), §9(2), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Workflow routes non-face-to-face customers to the §9(1) measures
+  - [ ] Selected measure(s) recorded per customer
+  - [ ] Digital-ID exemption applied only when a recognized digital ID system per the relevant authority is used
+- **Evidence:**
+  - Non-face-to-face onboarding procedure
+  - Per-customer record of §9(1) measure applied
+  - Digital ID system approval reference
+
+### CAT-04-002: PEP onboarding and continuation
+
+- **Requirement:** Where the customer or a beneficial owner is known to be a politically exposed person, before establishing the relationship (or before continuing one where PEP status is later identified), obtain senior management approval and take reasonable measures to establish the customer's or beneficial owner's source of wealth and source of funds. Former-PEP carve-out only applies after a documented risk assessment finds no high ML/TF risk.
+- **Source:** Schedule 2, §10(1), §10(2), §10(3), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Screening procedure detects PEP status at onboarding and ongoing
+  - [ ] Senior-management approval recorded for each PEP relationship
+  - [ ] Source-of-wealth and source-of-funds inquiries documented
+  - [ ] Former-PEP carve-out backed by a risk-assessment memo
+- **Evidence:**
+  - PEP screening hit reports
+  - Senior-management approval records
+  - SoW/SoF documentation
+
+### CAT-04-003: Insurance policy beneficiary requirements
+
+- **Requirement:** Whenever a beneficiary (or new beneficiary) is identified or designated under an insurance policy, record the beneficiary's name if identified by name, or obtain sufficient information to be able to establish identity at the time of right-exercise or first payout if designated by description; verify the beneficiary's identity at the earlier of right-exercise or first payout, and where the beneficiary is a legal person or trust, identify its beneficial owners (taking reasonable measures to verify their identity where high ML/TF risk).
+- **Source:** Schedule 2, §11(1), §11(2), §11(3), Cap. 615
+- **Severity:** major
+- **Verification:**
+  - [ ] Policy administration captures beneficiary name or sufficient identifying information at designation
+  - [ ] Verification triggered at the earlier of right-exercise or first payout
+  - [ ] Legal-person/trust beneficial-owner identification embedded in the payout workflow
+  - [ ] Risk-based beneficial-owner verification applied to high-risk beneficiaries
+- **Evidence:**
+  - Beneficiary registration records
+  - Payout-time verification records
+  - Beneficial-owner identification for entity beneficiaries
+
+### CAT-04-004: High-risk situations beyond enumerated categories
+
+- **Requirement:** In a situation specified in writing by the relevant authority or regulatory body, and in any other situation that by its nature presents a high ML/TF risk, obtain senior-management approval to establish or continue the relationship; for new relationships either take reasonable measures to establish source of wealth/funds or take additional risk-mitigation measures; for existing relationships, additionally verify any beneficial owner; for occasional transactions, take additional measures to mitigate the risk.
+- **Source:** Schedule 2, §15, Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Procedure identifies §15 high-risk situations (incl. regulator notices and intrinsic high-risk indicators)
+  - [ ] Senior-management approval required for new and continuing high-risk relationships
+  - [ ] SoW/SoF or additional mitigation measures applied as appropriate
+  - [ ] Beneficial-owner verification reinforced for existing high-risk relationships
+- **Evidence:**
+  - High-risk customer policy with regulator-notice register
+  - Senior-management approval records
+  - Mitigation-measure case files
+
+## CAT-05: Wire Transfers, Remittance and Virtual Asset Transfers
+
+### CAT-05-001: Originator and recipient information for wire transfers
+
+- **Requirement:** Before carrying out a wire transfer as ordering institution, record the originator's name; the originator's account number with the institution (or unique reference number assigned to the transfer); the originator's address, customer ID, identification-document number, or (for an individual) date and place of birth (the latter optional below HKD 8,000); the recipient's name; and the recipient's account number with the beneficiary institution (or unique reference number). Apply the §12(2) exceptions only where they strictly apply (e.g. inter-FI on-own-behalf transfers, certain card transactions).
+- **Source:** Schedule 2, §12(2), §12(3), §12(3A), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Wire-transfer system captures the §12(3)(a)–(e) data fields before execution
+  - [ ] HKD 8,000 threshold logic governs collection of originator address/ID per §12(3A)
+  - [ ] §12(2) exception flags applied only with documented basis
+- **Evidence:**
+  - Wire-transfer record specification
+  - Sample transfer audit trail
+  - Exception register
+
+### CAT-05-002: Transmit wire transfer information with the message
+
+- **Requirement:** As ordering institution, must include in the message or payment form accompanying the wire transfer the §12(3) information per the applicable threshold. Where the §12(6) domestic shortcut is used, must supply the omitted §12(3)(a) and (c) information to the receiving institution or relevant authority within 3 business days of request. Where wire transfers are bundled in a batch file to a foreign recipient, must comply with the §12(7) batch-file rules.
+- **Source:** Schedule 2, §12(5), §12(6), §12(7), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Outbound message format carries the required fields per threshold
+  - [ ] Domestic-shortcut workflow can supply §12(3)(a)/(c) information within 3 business days on request
+  - [ ] Batch-file processing carries §12(3)(b) per transfer and §12(3) information at batch level
+- **Evidence:**
+  - Message-format specification
+  - Request-response logs for §12(6) information requests
+  - Batch-file processing documentation
+
+### CAT-05-003: Intermediary and beneficiary obligations for wire transfers
+
+- **Requirement:** Acting as intermediary, transmit all received information with the transfer onward. Acting as beneficiary institution: for domestic transfers missing §12(3)(b) information, obtain it from the sending institution as soon as reasonably practicable, and if it cannot be obtained, consider restricting or terminating the relationship or take reasonable risk-mitigation measures; for non-domestic transfers missing §12(3) information, apply the same obtain-or-mitigate logic; in either case, take risk-mitigation measures where the accompanying information is incomplete or meaningless.
+- **Source:** Schedule 2, §12(8), §12(9), §12(10), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Intermediary pass-through preserves all received originator/recipient fields
+  - [ ] Beneficiary-side procedure escalates missing-information cases for follow-up and risk decision
+  - [ ] Documented thresholds/criteria for restricting or terminating sender relationships
+- **Evidence:**
+  - Intermediary message specification
+  - Missing-information case log
+  - Sender-restriction decision register
+
+### CAT-05-004: Licensed money service operator remittance information
+
+- **Requirement:** A licensed money service operator carrying out a remittance transaction (other than a wire transfer) at or above HKD 8,000 must, before carrying it out, identify the originator, verify the originator's identity against an identification document, and record the originator's name; ID document number (and place of issue for travel documents); address; currency and amount; date and time of receipt of instructions; recipient's name and address; and method of delivery.
+- **Source:** Schedule 2, §13(1), §13(2), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] MSO transaction system enforces verification before execution at or above HKD 8,000
+  - [ ] All §13(2)(c)(i)–(v) data fields captured
+  - [ ] Document-based verification step recorded
+- **Evidence:**
+  - MSO remittance record specification
+  - Sample transaction file with §13(2) fields populated
+
+### CAT-05-005: Virtual asset transfer information (Travel Rule)
+
+- **Requirement:** Before carrying out a virtual asset transfer as ordering institution, obtain and record the originator's name; originator's account number with the institution (or unique reference number); originator's address, customer ID, identification-document number or (for an individual) date and place of birth (the latter optional below HKD 8,000); recipient's name; and recipient's account number with the beneficiary institution (or unique reference number); submit the required information to the beneficiary institution per published codes/guidelines; as beneficiary, obtain and record the submitted information; as intermediary, transmit all received information onward.
+- **Source:** Schedule 2, §13A(2), §13A(3), §13A(4), §13A(5), §13A(6), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] VA transfer system captures the §13A(2) fields before execution
+  - [ ] HKD 8,000 threshold logic governs collection of originator address/ID
+  - [ ] Information submitted to beneficiary institution per applicable codes/guidelines
+  - [ ] Beneficiary and intermediary roles preserve the received information set
+- **Evidence:**
+  - VA transfer record specification
+  - Sample submission to beneficiary institution
+  - Intermediary pass-through documentation
+
+### CAT-05-006: Missing-information handling for virtual asset transfers
+
+- **Requirement:** As beneficiary or intermediary institution in a virtual asset transfer, if the instructing institution does not submit the §13A(2) information, obtain the missing information as soon as reasonably practicable; if it cannot be obtained, consider restricting or terminating the business relationship with the instructing institution or take reasonable ML/TF risk-mitigation measures; where accompanying information is incomplete or meaningless, take risk-mitigation measures.
+- **Source:** Schedule 2, §13A(7), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Beneficiary/intermediary procedure escalates missing-information cases
+  - [ ] Decision criteria documented for restricting or terminating instructing-institution relationships
+  - [ ] Risk-mitigation actions recorded for incomplete/meaningless cases
+- **Evidence:**
+  - Missing-information case log
+  - Restriction/termination register
+  - Risk-mitigation action records
+
+## CAT-06: Correspondent Banking and Prohibited Relationships
+
+### CAT-06-001: Pre-establishment correspondent banking due diligence
+
+- **Requirement:** Before establishing a correspondent banking relationship with an institution outside Hong Kong carrying on a business similar to an authorised institution, collect sufficient information to fully understand the proposed respondent's business; determine from publicly available information its reputation and the quality of supervision in its place; and assess its AML/CFT controls. The relationship must not be established unless senior-management approval has been obtained, the AML/CFT controls have been judged adequate and effective, respective responsibilities have been documented, and the institution is satisfied as to the respondent's CDD of customers who can directly operate payable-through accounts.
+- **Source:** Schedule 2, §14(1), §14(2), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Correspondent due-diligence file covers business, reputation, supervision, and AML/CFT controls
+  - [ ] Senior-management approval recorded before activation
+  - [ ] Responsibilities matrix signed by both institutions
+  - [ ] Direct-operator/payable-through arrangements assessed
+- **Evidence:**
+  - Respondent due-diligence file
+  - Senior-management approval record
+  - Signed responsibilities matrix
+
+### CAT-06-002: Prohibition on anonymous or fictitious-name accounts
+
+- **Requirement:** Do not open or maintain any anonymous account or account in a fictitious name for any customer.
+- **Source:** Schedule 2, §16, Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] System controls prevent account opening without an identified customer
+  - [ ] Periodic sweep confirms no anonymous/fictitious-name accounts remain
+- **Evidence:**
+  - Account-opening control documentation
+  - Periodic account-population audit report
+
+### CAT-06-003: Prohibition on correspondent banking with shell banks
+
+- **Requirement:** An authorised institution must not establish or continue a correspondent banking relationship with a corporation incorporated outside Hong Kong that is authorised to carry on banking business in that place but has no physical presence there and is not an affiliate of a corporation with a physical presence in that jurisdiction.
+- **Source:** Schedule 2, §17(1), §17(2), §17(3), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Onboarding due diligence confirms physical presence and qualifying affiliation per §17(2)–(3)
+  - [ ] Annual reconfirmation that existing respondent banks are not shell banks
+- **Evidence:**
+  - Shell-bank screening procedure
+  - Annual recertification records
+
+## CAT-07: Intermediaries and Internal Procedures
+
+### CAT-07-001: Use of intermediaries for CDD
+
+- **Requirement:** Where CDD is carried out by an intermediary specified in §18(3), the intermediary must consent in writing to act, must be a permitted category (HK accounting/estate-agent/legal professional, TCSP licensee, certain FIs, equivalent-jurisdiction professionals/institutions meeting the §18(3)(c) tests, or a qualifying related foreign FI under §18(3)(d) and (3A)); the institution must immediately obtain the data/information collected and ensure the intermediary will supply copies of documents on request within the §20 retention period; in §18(3)(d) cases, take reasonable risk-mitigation measures. The institution remains liable for any CDD failure by the intermediary or any agent it uses.
+- **Source:** Schedule 2, §18(1)–(7), Cap. 615
+- **Severity:** major
+- **Verification:**
+  - [ ] Written consent on file for each intermediary
+  - [ ] Intermediary category and qualifying basis documented (incl. group policy and supervision tests for §18(3)(d))
+  - [ ] Process to obtain underlying documents on request within the retention period
+  - [ ] Liability allocation acknowledged in internal policy
+- **Evidence:**
+  - Intermediary register with categories
+  - Signed intermediary consent letters
+  - Document-request workflow documentation
+
+### CAT-07-002: Procedures for PEP detection and wire/VA transfer screening
+
+- **Requirement:** Establish and maintain effective procedures for: (a) determining whether a customer or beneficial owner is a politically exposed person; (b) for FIs carrying out wire transfers, identifying and handling wire transfers where §12(5) has not been complied with; (c) for FIs carrying out virtual asset transfers, identifying and handling VA transfers where §13A(4) has not been complied with; and (d) for each kind of customer, relationship, product, and transaction, procedures (consistent with the Ordinance) for carrying out duties under §§3, 4, 5, 9, 10 and 15 of Schedule 2.
+- **Source:** Schedule 2, §19(1), §19(2), §19(2A), §19(3), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Documented PEP-detection procedure (lists, screening cadence, escalation)
+  - [ ] Wire transfer non-compliance handling procedure in place where applicable
+  - [ ] VA transfer non-compliance handling procedure in place where applicable
+  - [ ] CDD procedures cover each customer/relationship/product/transaction type
+- **Evidence:**
+  - PEP-detection procedure document
+  - Non-compliant wire/VA transfer handling procedure
+  - Product-specific CDD procedure set
+
+## CAT-08: Record-keeping
+
+### CAT-08-001: Records of transactions and customers
+
+- **Requirement:** Keep the original or a copy of documents and a record of data and information obtained in connection with each transaction carried out, and for each customer keep the original or a copy of identification and beneficial-owner verification documents/data, account files, and business correspondence with the customer and any beneficial owner.
+- **Source:** Schedule 2, §20(1), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Transaction-record set captures source documents, data, and information per Part 2
+  - [ ] Customer file holds identification/verification records, account files, and correspondence
+- **Evidence:**
+  - Records inventory
+  - Sample customer file showing required record classes
+
+### CAT-08-002: Minimum retention periods
+
+- **Requirement:** Keep transaction records for at least 5 years from the date the transaction is completed, regardless of whether the business relationship ends during that period; keep customer records throughout the relationship and for at least 5 years after it ends; for triggering occasional transactions (§3(1)(b), (1A), (1B)), keep customer records for at least 5 years from completion. Where a relevant authority or regulatory body specifies a longer period by notice, keep the relevant records for that longer period.
+- **Source:** Schedule 2, §20(2), §20(3), §20(3A), §20(4), §20(5), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Retention schedule encodes 5-year minimums for transaction and customer records
+  - [ ] Process exists to extend retention on receipt of a §20(4) notice
+  - [ ] Disposal controls prevent early deletion
+- **Evidence:**
+  - Records-retention schedule
+  - Authority-notice register
+  - Disposal control documentation
+
+### CAT-08-003: Manner of keeping records
+
+- **Requirement:** Keep document records as the original document, on microfilm, or in a computer database; keep data or information records on microfilm or in a computer database.
+- **Source:** Schedule 2, §21, Cap. 615
+- **Severity:** minor
+- **Verification:**
+  - [ ] Approved storage media (original, microfilm, or database) documented
+  - [ ] System controls ensure integrity and retrievability of stored records
+- **Evidence:**
+  - Records-management policy
+  - Storage-media specification
+
+## CAT-09: Group-wide Application and General Safeguards
+
+### CAT-09-001: Branches and subsidiaries outside Hong Kong
+
+- **Requirement:** An FI or DNFBP incorporated in Hong Kong or that is a re-domiciled entity must ensure its overseas branches and same-business overseas subsidiary undertakings have procedures to ensure compliance, to the extent permitted by local law, with requirements similar to Parts 2 and 3 of Schedule 2 that apply to the FI or DNFBP. Where local law does not permit such application, inform the relevant authority (and, where applicable, the relevant regulatory body) and take additional measures to mitigate the resulting ML/TF risk.
+- **Source:** Schedule 2, §22(1), §22(2), §22(2A), §22(2B), Cap. 615
+- **Severity:** major
+- **Verification:**
+  - [ ] Group AML/CFT policy applies equivalent Parts 2 and 3 requirements to overseas branches and same-business subsidiaries
+  - [ ] Conflicts-of-law review identifies jurisdictions where requirements cannot be applied
+  - [ ] Notifications to relevant authority/regulatory body on file for restricted jurisdictions
+  - [ ] Additional mitigation measures documented for those jurisdictions
+- **Evidence:**
+  - Group AML/CFT policy
+  - Conflicts-of-law inventory
+  - Authority/regulator notifications
+
+### CAT-09-002: Reasonable measures to prevent contravention
+
+- **Requirement:** Take all reasonable measures to ensure that proper safeguards exist to prevent a contravention of any requirement under Part 2 or Part 3 of Schedule 2, and to mitigate ML/TF risks.
+- **Source:** Schedule 2, §23, Cap. 615
+- **Severity:** major
+- **Verification:**
+  - [ ] AML/CFT control framework documented with named owners
+  - [ ] Independent assurance (internal audit, compliance testing) reviews Part 2/3 controls on a defined cycle
+  - [ ] Training programme covers staff in AML/CFT roles
+- **Evidence:**
+  - AML/CFT control framework
+  - Internal audit reports on Part 2/3 controls
+  - Training records