@1aboveio/skills 0.20.2 → 0.20.3

package/skills/document-utils/reg-parser/references/checklists/hk-fi-corporate-onboarding-cdd-checklist.md

@@ -0,0 +1,233 @@
+```yaml
+name: "HK FI Corporate Onboarding — CDD Checklist"
+regulation: "Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), Hong Kong — Schedule 2 (CDD)"
+version: "1.0"
+scope: "Customer due diligence obligations under Schedule 2 of Cap. 615 applicable to a financial institution at the point of onboarding a corporate (legal-person) client. Derived from hk-amlo-checklist.md; trimmed to onboarding-time CDD only — ongoing monitoring, wire/remittance/virtual-asset transfer operations, correspondent banking, insurance beneficiary, group-wide application, and record-retention periods beyond initial record creation are out of scope."
+date: "2026-05-15"
+summary:
+  categories: 6
+  total_items: 15
+  critical: 10
+  major: 5
+  minor: 0
+```
+
+## CAT-01: Customer Identification and Verification
+
+### CAT-01-001: Apply CDD before establishing the business relationship
+
+- **Requirement:** Before establishing a business relationship with a corporate customer, the financial institution must carry out CDD measures; verification may be completed during or after establishment only where it is necessary not to interrupt the normal conduct of business and the ML/TF risk of deferral is effectively managed, with verification completed as soon as reasonably practicable.
+- **Source:** Schedule 2, §3(1)(a), §3(2), §3(3), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Onboarding workflow blocks relationship setup until CDD is complete (subject to §3(2) deferral)
+  - [ ] Where deferral is used, conditions of §3(2) are documented per case
+  - [ ] Verification is completed as soon as reasonably practicable, tracked against a defined SLA
+- **Evidence:**
+  - Onboarding control documentation
+  - Deferred-verification case files
+  - Verification SLA tracker
+
+### CAT-01-002: Identify and verify the corporate customer
+
+- **Requirement:** The financial institution must identify the corporate customer and verify the customer's identity using documents, data, or information from a governmental body, the relevant authority/regulator, an equivalent foreign authority, a recognized digital identification system, or another reliable and independent source recognized by the relevant authority.
+- **Source:** Schedule 2, §2(1)(a), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Certificate of incorporation (or equivalent registration/re-domiciliation document) obtained
+  - [ ] Company-registry extract or constitutional document obtained, current at time of verification
+  - [ ] Source of each identifying document falls within an approved source class
+  - [ ] Verification date, method, and source recorded in the customer file
+- **Evidence:**
+  - Certificate of incorporation / registration
+  - Company-registry extract
+  - Constitutional documents (articles, bylaws)
+  - Onboarding form with verification source and date
+
+### CAT-01-003: Refusal and termination when CDD cannot be completed
+
+- **Requirement:** If unable to comply with §3(1) or the deferred-verification completion duty under §3(3), the financial institution must not establish the business relationship or carry out the occasional transaction; if a relationship has already been established under deferral, it must be terminated as soon as reasonably practicable.
+- **Source:** Schedule 2, §3(4), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Documented refusal/termination procedure for CDD-failure cases
+  - [ ] Refused applicants and terminated relationships logged
+  - [ ] STR-assessment performed and recorded on termination
+- **Evidence:**
+  - Refusal/termination procedure
+  - Refused-applicant log
+  - Termination case files
+
+## CAT-02: Beneficial Ownership and Control Structure
+
+### CAT-02-001: Identify and verify beneficial owners
+
+- **Requirement:** The financial institution must identify each beneficial owner of the corporate customer (individuals who, directly or indirectly, own or control more than 25% of issued share capital, are entitled to exercise or control more than 25% of voting rights, or exercise ultimate control over management; or, where the corporation acts on behalf of another person, that other person), and take reasonable measures to verify each beneficial owner's identity.
+- **Source:** Schedule 2, §1(1), §2(1)(b), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Beneficial ownership declaration obtained from the customer
+  - [ ] Beneficial owners identified using the >25% ownership/voting threshold and "ultimate control" test
+  - [ ] Reasonable measures applied to verify each beneficial owner's identity
+  - [ ] Verification records retained per beneficial owner
+- **Evidence:**
+  - Signed beneficial-ownership declaration
+  - Identification and verification records for each beneficial owner
+
+### CAT-02-002: Understand the ownership and control structure
+
+- **Requirement:** Where the corporate customer is a legal person (or has a beneficial owner that is a trust within the ownership chain), the financial institution must take measures to understand the ownership and control structure of the customer.
+- **Source:** Schedule 2, §2(1)(b), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Group/ownership structure chart obtained, current at time of onboarding
+  - [ ] Intermediate holding entities mapped through to ultimate beneficial owners
+  - [ ] Trust arrangements in the chain identified (settlor, trustee, protector/enforcer, beneficiary class, ultimate controller per §1(1))
+- **Evidence:**
+  - Ownership structure chart
+  - Trust documentation for any trust in the chain
+
+## CAT-03: Authorised Representatives
+
+### CAT-03-001: Verify persons purporting to act on behalf of the customer
+
+- **Requirement:** Where a person purports to act on behalf of the corporate customer (directors, authorised signatories, account operators), the financial institution must identify that person, take reasonable measures to verify the person's identity using documents/data/information from the approved source classes, and verify the person's authority to act on behalf of the customer.
+- **Source:** Schedule 2, §2(1)(d), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Identity of each authorised representative captured and verified per §2(1)(d)(i)
+  - [ ] Documentary evidence of authority obtained (board resolution, power of attorney, authorisation letter, signatory mandate)
+  - [ ] Authorised-signatory register updated and approved
+- **Evidence:**
+  - Representative identification records
+  - Authorisation documents (board resolution, POA, letter)
+  - Authorised-signatory mandate
+
+## CAT-04: Purpose, Nature and Customer Risk Profile
+
+### CAT-04-001: Obtain purpose and intended nature of the business relationship
+
+- **Requirement:** The financial institution must obtain information on the purpose and intended nature of the business relationship at onboarding, unless the purpose and intended nature are obvious.
+- **Source:** Schedule 2, §2(1)(c), Cap. 615
+- **Severity:** major
+- **Verification:**
+  - [ ] Onboarding questionnaire captures purpose and expected nature
+  - [ ] Expected transaction types, volumes, and counterparties documented
+  - [ ] Source of funds and (where relevant) source of wealth captured
+  - [ ] Where the purpose is deemed "obvious" and the measure omitted, the determination is recorded
+- **Evidence:**
+  - Completed onboarding questionnaire
+  - Account-opening memo with expected activity profile
+
+## CAT-05: Enhanced and Simplified Due Diligence at Onboarding
+
+### CAT-05-001: Apply SDD only where the corporate customer or product qualifies
+
+- **Requirement:** A financial institution applying Simplified CDD (limited to measures §2(1)(a), (c) and (d)) to a corporate customer must do so only where it has reasonable grounds to believe the customer falls within §4(3) (e.g. another financial institution, a corporation listed on any stock exchange, a supervised investment vehicle, the Government or a public body in Hong Kong, or the government/qualifying body of an equivalent jurisdiction) or the product falls within §4(5).
+- **Source:** Schedule 2, §4(1), §4(3), §4(4), §4(5), Cap. 615
+- **Severity:** major
+- **Verification:**
+  - [ ] SDD eligibility test applied and documented before applying simplified measures
+  - [ ] Documentary basis for the qualifying customer/product category recorded (e.g. listing confirmation, regulator licence, public-body status)
+  - [ ] SDD discontinuation triggers documented (e.g. ML/TF suspicion, doubt about prior information)
+- **Evidence:**
+  - SDD eligibility memo
+  - Listing/regulator confirmation
+  - Product specification with §4(5) basis
+
+### CAT-05-002: Enhanced due diligence when the customer or beneficial owner is a PEP
+
+- **Requirement:** Where, at onboarding, the corporate customer or any beneficial owner is known to be a politically exposed person, the financial institution must, before establishing the business relationship, obtain approval from senior management and take reasonable measures to establish the customer's or beneficial owner's source of wealth and source of funds. The former-PEP carve-out applies only after a documented risk assessment finds no high ML/TF risk.
+- **Source:** Schedule 2, §10(1), §10(3), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] PEP screening run on the corporate customer and all beneficial owners at onboarding
+  - [ ] Senior-management approval recorded before relationship setup
+  - [ ] Source-of-wealth and source-of-funds inquiries documented
+  - [ ] Former-PEP carve-out, if invoked, backed by a risk-assessment memo
+- **Evidence:**
+  - PEP screening hit reports
+  - Senior-management approval record
+  - SoW/SoF documentation
+
+### CAT-05-003: EDD for high-risk corporate onboarding cases
+
+- **Requirement:** In a situation specified in writing by the relevant authority, or in any other situation that by its nature presents a high ML/TF risk (e.g. complex/opaque ownership structures, jurisdictions of higher risk, anonymising delivery channels), the financial institution must obtain senior-management approval to establish the business relationship and either take reasonable measures to establish source of wealth/source of funds or take additional measures to mitigate the ML/TF risk.
+- **Source:** Schedule 2, §15, Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] High-risk identification procedure in place, covering regulator notices and intrinsic high-risk indicators (e.g. shell-vehicle features, nominee structures, bearer shares, high-risk geography)
+  - [ ] Senior-management approval recorded for high-risk onboarding cases
+  - [ ] SoW/SoF measures or alternative mitigation documented
+- **Evidence:**
+  - High-risk customer policy with regulator-notice register
+  - Senior-management approval records
+  - Mitigation-measure case files
+
+### CAT-05-004: Non-face-to-face onboarding additional measures
+
+- **Requirement:** Where the corporate customer has not been physically present for identification purposes (e.g. remote onboarding of the entity, or where its authorised representatives complete onboarding through a non-face-to-face channel), the financial institution must carry out at least one of the §9(1) measures: further verification using documents/data not previously used; supplementary measures to verify obtained information; or routing the first payment through an account in the customer's name with an authorised institution or qualifying foreign institution. The requirement does not apply where identification was performed using a recognized digital identification system.
+- **Source:** Schedule 2, §9(1), §9(2), Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] Non-face-to-face onboarding workflow applies at least one §9(1) measure
+  - [ ] Selected measure(s) recorded per customer
+  - [ ] Digital-ID-system exemption applied only where the system is recognised by the relevant authority
+- **Evidence:**
+  - Non-face-to-face onboarding procedure
+  - Per-customer record of §9(1) measure applied
+  - Digital ID system approval reference
+
+## CAT-06: Prohibitions, Intermediaries, Procedures and Records
+
+### CAT-06-001: Prohibition on anonymous or fictitious-name accounts
+
+- **Requirement:** The financial institution must not open or maintain any anonymous account or account in a fictitious name for any customer.
+- **Source:** Schedule 2, §16, Cap. 615
+- **Severity:** critical
+- **Verification:**
+  - [ ] System controls prevent account opening without an identified customer
+  - [ ] Numbered or codename accounts (if any) are subject to full CDD
+- **Evidence:**
+  - Account-opening control documentation
+  - Numbered-account control procedure
+
+### CAT-06-002: Use of intermediaries for CDD at onboarding
+
+- **Requirement:** Where CDD on the corporate customer is carried out by an intermediary specified in §18(3), the intermediary must consent in writing to act; must be a permitted category (Hong Kong accounting/estate-agent/legal professional, TCSP licensee, qualifying domestic financial institution, qualifying equivalent-jurisdiction professional/institution, or qualifying related foreign financial institution under §18(3)(d) and (3A)); and the financial institution must immediately obtain the data/information collected and ensure the intermediary will supply copies of underlying documents on request within the §20 retention period. The financial institution remains liable for any CDD failure by the intermediary.
+- **Source:** Schedule 2, §18(1), §18(2), §18(3), §18(3A), §18(4), Cap. 615
+- **Severity:** major
+- **Verification:**
+  - [ ] Written intermediary consent on file
+  - [ ] Eligible-category and qualifying-basis documented per intermediary
+  - [ ] Information-on-demand workflow operational, with retention-period commitment
+- **Evidence:**
+  - Intermediary register
+  - Signed intermediary consents
+  - Document-request workflow
+
+### CAT-06-003: Procedures for PEP detection at onboarding
+
+- **Requirement:** The financial institution must establish and maintain effective procedures for determining whether a customer or a beneficial owner of a customer is a politically exposed person; the procedures must be operative at the point of onboarding and capable of producing a determination before the business relationship is established.
+- **Source:** Schedule 2, §19(1), Cap. 615
+- **Severity:** major
+- **Verification:**
+  - [ ] Documented PEP-detection procedure (lists used, screening cadence, escalation)
+  - [ ] PEP determination produced for the customer and each beneficial owner before relationship setup
+- **Evidence:**
+  - PEP-detection procedure document
+  - Screening logs covering customer and beneficial owners
+
+### CAT-06-004: Records of onboarding identification and verification
+
+- **Requirement:** For each corporate customer, the financial institution must keep the original or a copy of the documents and a record of the data and information obtained in the course of identifying and verifying the customer and any beneficial owner, together with the original or a copy of the files relating to the customer's account and business correspondence with the customer and any beneficial owner.
+- **Source:** Schedule 2, §20(1)(b), Cap. 615
+- **Severity:** major
+- **Verification:**
+  - [ ] Customer file holds identification and verification records for the customer and each beneficial owner
+  - [ ] Account-opening records and onboarding correspondence retained
+  - [ ] Records are retrievable within authority-response timelines
+- **Evidence:**
+  - Customer file inventory
+  - Sample onboarding file
+  - Retrieval-time test record