@1aboveio/skills 0.20.2 → 0.20.4

package/skills/document-utils/reg-parser/references/checklists/hk-mso-guideline-checklist.json

@@ -0,0 +1,2194 @@
+{
+  "metadata": {
+    "name": "HK CCE Guideline for MSOs — AML/CFT Compliance Checklist",
+    "regulation": "Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Money Service Operators), Commissioner of Customs and Excise, June 2023, issued under section 7 of AMLO (Cap. 615)",
+    "version": "1.0",
+    "scope": "Operational AML/CFT obligations imposed on Money Service Operators (MSOs) in Hong Kong by the CCE Guideline, covering risk-based approach, AML/CFT systems, CDD, ongoing monitoring, TF/financial sanctions/PF, suspicious transaction reporting, record-keeping, staff training, wire transfers, and remittance transactions. Per paragraph 1.6, both 'must' and 'should' in the Guideline denote mandatory requirements.",
+    "date": "2026-05-15",
+    "summary": {
+      "categories": 12,
+      "total_items": 52,
+      "critical": 33,
+      "major": 19,
+      "minor": 0
+    }
+  },
+  "categories": [
+    {
+      "id": "CAT-01",
+      "title": "Risk-Based Approach and Risk Assessment",
+      "item_ids": [
+        "CAT-01-001",
+        "CAT-01-002",
+        "CAT-01-003",
+        "CAT-01-004",
+        "CAT-01-005"
+      ]
+    },
+    {
+      "id": "CAT-02",
+      "title": "AML/CFT Systems and Governance",
+      "item_ids": [
+        "CAT-02-001",
+        "CAT-02-002",
+        "CAT-02-003",
+        "CAT-02-004",
+        "CAT-02-005",
+        "CAT-02-006"
+      ]
+    },
+    {
+      "id": "CAT-03",
+      "title": "Customer Due Diligence — Identification and Verification",
+      "item_ids": [
+        "CAT-03-001",
+        "CAT-03-002",
+        "CAT-03-003",
+        "CAT-03-004",
+        "CAT-03-005",
+        "CAT-03-006",
+        "CAT-03-007",
+        "CAT-03-008",
+        "CAT-03-009",
+        "CAT-03-010",
+        "CAT-03-011",
+        "CAT-03-012",
+        "CAT-03-013"
+      ]
+    },
+    {
+      "id": "CAT-04",
+      "title": "Simplified and Enhanced Due Diligence",
+      "item_ids": [
+        "CAT-04-001",
+        "CAT-04-002",
+        "CAT-04-003",
+        "CAT-04-004",
+        "CAT-04-005",
+        "CAT-04-006"
+      ]
+    },
+    {
+      "id": "CAT-05",
+      "title": "Reliance on Intermediaries",
+      "item_ids": [
+        "CAT-05-001",
+        "CAT-05-002"
+      ]
+    },
+    {
+      "id": "CAT-06",
+      "title": "Pre-existing Customers and Ongoing Monitoring",
+      "item_ids": [
+        "CAT-06-001",
+        "CAT-06-002",
+        "CAT-06-003"
+      ]
+    },
+    {
+      "id": "CAT-07",
+      "title": "Terrorist Financing, Financial Sanctions and Proliferation Financing",
+      "item_ids": [
+        "CAT-07-001",
+        "CAT-07-002"
+      ]
+    },
+    {
+      "id": "CAT-08",
+      "title": "Suspicious Transaction Reporting and Law Enforcement Requests",
+      "item_ids": [
+        "CAT-08-001",
+        "CAT-08-002",
+        "CAT-08-003",
+        "CAT-08-004",
+        "CAT-08-005",
+        "CAT-08-006"
+      ]
+    },
+    {
+      "id": "CAT-09",
+      "title": "Record-keeping",
+      "item_ids": [
+        "CAT-09-001",
+        "CAT-09-002",
+        "CAT-09-003"
+      ]
+    },
+    {
+      "id": "CAT-10",
+      "title": "Staff Training",
+      "item_ids": [
+        "CAT-10-001",
+        "CAT-10-002"
+      ]
+    },
+    {
+      "id": "CAT-11",
+      "title": "Wire Transfers",
+      "item_ids": [
+        "CAT-11-001",
+        "CAT-11-002",
+        "CAT-11-003"
+      ]
+    },
+    {
+      "id": "CAT-12",
+      "title": "Remittance Transactions",
+      "item_ids": [
+        "CAT-12-001"
+      ]
+    }
+  ],
+  "items": [
+    {
+      "id": "CAT-01-001",
+      "title": "Adopt a risk-based approach for AML/CFT Systems",
+      "category": "CAT-01",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must adopt a risk-based approach (RBA) in the design and implementation of its AML/CFT policies, procedures and controls (AML/CFT Systems), so that preventive measures are commensurate with the nature and level of identified ML/TF risks.",
+      "source": "Guideline §2.1; §1.6 (mandatory language)",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "AML/CFT policy explicitly adopts an RBA",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Documented linkage between risk-assessment outputs and the design of preventive controls",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Senior management has approved the RBA framework",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "AML/CFT policy",
+        "Risk-assessment-to-control mapping document",
+        "Senior management approval record"
+      ]
+    },
+    {
+      "id": "CAT-01-002",
+      "title": "Conduct an institutional ML/TF risk assessment",
+      "category": "CAT-01",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must conduct an institutional ML/TF risk assessment to identify, assess and understand its ML/TF risks across its customers; the countries/jurisdictions its customers are from or in; the countries/jurisdictions of its operations; and its products, services, transactions and delivery channels. The assessment must be documented, consider all relevant risk factors, be approved by senior management, kept up-to-date, and be available to the CCE on request.",
+      "source": "Guideline §2.2, §2.3, §2.4, §2.10",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Documented institutional risk assessment exists, covering customers, geographies, products/services/transactions, and delivery channels",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Senior-management approval recorded",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Risk-assessment methodology documented (qualitative and quantitative analysis, sources)",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Mechanism in place to provide the assessment to the CCE on request",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Supporting records retained (risk factors, sources, evaluation of AML/CFT Systems adequacy)",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Institutional ML/TF risk assessment report",
+        "Senior management approval record",
+        "Risk-assessment methodology document"
+      ]
+    },
+    {
+      "id": "CAT-01-003",
+      "title": "Refresh the institutional risk assessment",
+      "category": "CAT-01",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must conduct its institutional ML/TF risk assessment every two years and upon trigger events material to the MSO's business and risk exposure (such as significant AML/CFT Systems breaches, new customer segments or delivery channels, new products/services, or significant operational changes); review results must be documented and approved by senior management.",
+      "source": "Guideline §2.9",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Refresh cadence (≤2 years) embedded in the AML/CFT calendar",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Trigger-event criteria documented and operationalised",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Each refresh signed off by senior management",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Risk-assessment refresh log",
+        "Trigger-event register",
+        "Approval records for each refresh"
+      ]
+    },
+    {
+      "id": "CAT-01-004",
+      "title": "Assess ML/TF risks of new products, practices and technologies",
+      "category": "CAT-01",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must identify and assess the ML/TF risks that may arise in relation to new products and business practices (including new delivery mechanisms), and the use of new or developing technologies for both new and pre-existing products; the risk assessment must be undertaken before launch and appropriate mitigation measures applied.",
+      "source": "Guideline §2.11, §2.12",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Product/process change governance includes pre-launch ML/TF risk assessment",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Mitigation measures documented for each new product/practice/technology",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "New-product/technology launch register",
+        "Pre-launch ML/TF risk-assessment files"
+      ]
+    },
+    {
+      "id": "CAT-01-005",
+      "title": "Conduct customer risk assessment and update over time",
+      "category": "CAT-01",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must assess the ML/TF risks associated with each customer or proposed business relationship (the customer risk assessment), with the assessment determining the extent of CDD measures applied; on the basis of a holistic view of CDD information the MSO must finalise the customer risk profile to determine ongoing monitoring intensity, and must review and update the customer risk assessment over time, particularly during ongoing monitoring. Records of customer risk assessments must be kept so that the MSO can demonstrate to the CCE how it assesses customer ML/TF risk and how CDD/monitoring intensity is calibrated.",
+      "source": "Guideline §2.13, §2.14, §2.15, §2.16 (s.20(1)(b)(ii), Sch. 2, AMLO)",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Customer risk-assessment methodology documented and consistent with the institutional risk assessment",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Risk rating recorded per customer",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Periodic and event-driven update process in place",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Records retained and demonstrable to the CCE",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Customer risk-assessment methodology",
+        "Sample customer files with risk ratings and update history"
+      ]
+    },
+    {
+      "id": "CAT-02-001",
+      "title": "Establish and maintain AML/CFT Systems",
+      "category": "CAT-02",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must take all reasonable measures to ensure proper safeguards exist to mitigate ML/TF risks and to prevent a contravention of any requirement under Part 2 or 3 of Schedule 2 to AMLO, by implementing AML/CFT Systems approved by senior management, monitoring their implementation, enhancing them as necessary, and taking enhanced measures where higher risks are identified.",
+      "source": "Guideline §3.1, §3.2; s.23, Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "AML/CFT Systems documented and approved by senior management",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Monitoring of implementation evidenced (e.g. compliance MI, KPIs)",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Enhancement actions tracked",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Enhanced measures applied to higher-risk areas",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Approved AML/CFT Systems policy",
+        "Implementation monitoring reports",
+        "Issue/enhancement tracker"
+      ]
+    },
+    {
+      "id": "CAT-02-002",
+      "title": "Senior management oversight of ML/TF risks",
+      "category": "CAT-02",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "The board of directors (or delegated committee) and senior management of an MSO must have a clear understanding of the MSO's ML/TF risks, ensure they are adequately managed, and receive timely, complete, understandable and accurate management information on ML/TF risks and the AML/CFT Systems; senior management is responsible for implementing effective AML/CFT Systems that adequately manage the identified ML/TF risks.",
+      "source": "Guideline §3.6, §3.7",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Governance arrangement defines board/senior management AML/CFT responsibilities",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Regular AML/CFT MI reported to senior management",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Minutes evidence senior-management engagement and decisions",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "AML/CFT governance terms of reference",
+        "Senior management MI packs",
+        "Meeting minutes covering AML/CFT items"
+      ]
+    },
+    {
+      "id": "CAT-02-003",
+      "title": "Appoint Compliance Officer and Money Laundering Reporting Officer",
+      "category": "CAT-02",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must appoint a Compliance Officer (CO) at management level with overall responsibility for the establishment and maintenance of the AML/CFT Systems, and a senior staff as the Money Laundering Reporting Officer (MLRO) to act as the central reference point for suspicious transaction reporting. So far as practicable, the CO and MLRO must be appropriately qualified, independent of operational/business functions (subject to MSO size), normally based in Hong Kong, of sufficient seniority and authority, with direct access to senior management, conversant with statutory/regulatory requirements and ML/TF risks, able to access relevant information on a timely basis, and equipped with sufficient resources and cover for absences.",
+      "source": "Guideline §3.5, §3.7, §3.8, §3.9, §3.10",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Documented CO and MLRO appointments and job descriptions",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Qualifications and independence assessed and recorded",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Alternate/deputy CO and MLRO designated",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Documented direct reporting line to senior management",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Appointment letters and job descriptions",
+        "CO/MLRO qualification records",
+        "Deputy designation documentation"
+      ]
+    },
+    {
+      "id": "CAT-02-004",
+      "title": "Independent audit function for AML/CFT Systems",
+      "category": "CAT-02",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must establish an independent audit function with a direct line of communication to senior management, with sufficient expertise and resources to perform independent reviews of the MSO's AML/CFT Systems; reviews must cover the adequacy of AML/CFT Systems, the ML/TF risk-assessment framework, RBA application, suspicious transaction reporting effectiveness, the compliance function, and staff awareness, with frequency and extent commensurate with the MSO's business and ML/TF risks.",
+      "source": "Guideline §3.11, §3.12, §3.13",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Independent audit charter and reporting line documented",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Audit plan covers all §3.12 review areas",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Audit reports issued and tracked to remediation",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Audit function charter",
+        "AML/CFT audit plan and reports",
+        "Remediation tracker"
+      ]
+    },
+    {
+      "id": "CAT-02-005",
+      "title": "Employee screening procedures",
+      "category": "CAT-02",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must have adequate and appropriate screening procedures to ensure high standards when hiring employees.",
+      "source": "Guideline §3.14",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Pre-employment screening procedure documented",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Screening records retained per hire",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Employee screening policy",
+        "Sample screening records"
+      ]
+    },
+    {
+      "id": "CAT-02-006",
+      "title": "Group-wide AML/CFT Systems for HK-incorporated MSOs",
+      "category": "CAT-02",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "A Hong Kong-incorporated MSO with overseas branches or subsidiary undertakings that carry on the same business as a financial institution must implement group-wide AML/CFT Systems to apply the requirements set out in the Guideline to those branches/subsidiaries wherever applicable, and must ensure they have procedures to comply with CDD and record-keeping requirements similar to those imposed under Parts 2 and 3 of Schedule 2, to the extent permitted by local law. Where the host jurisdiction's laws do not permit the higher requirements, the MSO must inform the CCE of such failure and take additional measures to effectively mitigate ML/TF risks faced by that branch or subsidiary undertaking.",
+      "source": "Guideline §3.15, §3.16, §3.18, §3.19; s.22(1), s.22(2), Sch. 2, AMLO",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Group-wide AML/CFT policy applies Guideline requirements to overseas branches/subsidiaries",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Local-law conflict register maintained",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Notifications to CCE on file for restricted jurisdictions",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Mitigation measures documented for those jurisdictions",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Group AML/CFT policy",
+        "Local-law conflict inventory",
+        "CCE notifications"
+      ]
+    },
+    {
+      "id": "CAT-03-001",
+      "title": "Apply CDD measures at all required trigger points",
+      "category": "CAT-03",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must carry out CDD measures in relation to a customer before establishing a business relationship; before carrying out an occasional transaction of HKD 120,000 or more, a wire transfer of HKD 8,000 or more, or a virtual asset transfer of virtual assets amounting to HKD 8,000 or more (including aggregated linked transactions); when ML/TF is suspected; or when the veracity or adequacy of previously obtained identification information is doubted. The MSO must also be vigilant to series of linked occasional transactions that meet or exceed the thresholds.",
+      "source": "Guideline §4.2.1, §4.2.4, §4.2.5; s.3(1) & (1A), Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Onboarding workflow blocks relationship setup until CDD is complete",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Transaction systems enforce thresholds and aggregate linked transactions",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "STR/SAR workflow triggers re-CDD on suspicion",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Re-verification process exists for doubted information",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "CDD trigger procedure",
+        "System control specifications",
+        "Sample transaction/onboarding audit trails"
+      ]
+    },
+    {
+      "id": "CAT-03-002",
+      "title": "Identify and verify customer that is a natural person",
+      "category": "CAT-03",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must identify a customer that is a natural person by obtaining at least full name, date of birth, nationality, unique identification number and document type; and verify the name, date of birth, unique identification number and document type by reference to documents, data or information from a reliable and independent source (e.g. Hong Kong identity card, valid travel document, or other reliable and independent source). Identification documents should contain a photograph of the customer; exceptions require documented assessment and mitigation of associated risk. Residential address information must be obtained.",
+      "source": "Guideline §4.3.1, §4.3.2, §4.3.3, §4.3.4, §4.3.5; s.2(1)(a), Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Natural-person identification fields captured per §4.3.2",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Verification documents on file per §4.3.3 with source recorded",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Photograph-bearing ID obtained, or documented risk assessment for exception",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Residential address recorded",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Customer onboarding form",
+        "Copy of verified identification document",
+        "Risk-assessment record for any non-photo exception"
+      ]
+    },
+    {
+      "id": "CAT-03-003",
+      "title": "Identify and verify customer that is a legal person",
+      "category": "CAT-03",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must identify a customer that is a legal person by obtaining at least full name; date of incorporation/establishment/registration; place of incorporation/establishment/registration (including registered office address); unique identification number (e.g. incorporation number, business registration number) and document type; and principal place of business (if different); and verify name, legal form, current existence and powers that regulate and bind the legal person by reference to documents from a reliable and independent source (e.g. certificate of incorporation, company registry record, certificate of incumbency/good standing, partnership agreement, constitutional document).",
+      "source": "Guideline §4.3.6, §4.3.7, §4.3.8, §4.3.9; s.2(1)(a), Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Legal-person identification fields captured per §4.3.6",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Verification documents on file per §4.3.7",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Current existence verified at the time of verification",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "For associations/clubs/etc., legitimate purpose evidenced (e.g. constitution)",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Certificate of incorporation or registry extract",
+        "Constitutional documents",
+        "Onboarding memo evidencing current-existence check"
+      ]
+    },
+    {
+      "id": "CAT-03-004",
+      "title": "Identify and verify customer that is a trust or similar legal arrangement",
+      "category": "CAT-03",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "For a trust or other similar legal arrangement customer, an MSO must obtain at least name of the trust/legal arrangement, date of establishment, governing jurisdiction, unique identification number (if any) and document type, and address of registered office (if applicable); and must verify name, legal form, current existence and powers that regulate and bind the trust by reference to a reliable and independent source (e.g. trust deed, register record, written confirmation from a professional trustee or lawyer who has reviewed the instrument). Where the trustee enters into the relationship on behalf of the trust, the trustee must also be identified and verified per natural- or legal-person requirements.",
+      "source": "Guideline §4.3.10, §4.3.11, §4.3.12; s.2(1)(a), Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Trust identification fields captured per §4.3.11",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Verification documents on file per §4.3.12",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Trustee identified and verified where applicable",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Trust deed or equivalent",
+        "Trustee identification record"
+      ]
+    },
+    {
+      "id": "CAT-03-005",
+      "title": "Ensure currency and integrity of identification documents",
+      "category": "CAT-03",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must ensure that documents, data or information used to verify the identity of a customer are current at the time they are provided to or obtained by the MSO; must apply anti-fraud procedures commensurate with the risk profile of the person being verified; for in-person CDD must generally have sight of the original identification document and retain a copy (and where original cannot be produced, take appropriate measures to ensure reliability); and where documents are in a foreign language must take appropriate steps to be reasonably satisfied of identity.",
+      "source": "Guideline §4.3.14, §4.3.15, §4.3.16, §4.3.17",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Onboarding procedure mandates current-at-time-of-receipt check",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Anti-fraud controls (document authenticity checks) applied",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Original-sighting procedure for in-person onboarding",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Foreign-language handling procedure (translation/independent review)",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Onboarding procedure",
+        "Document-authentication tooling/process",
+        "Sample foreign-language CDD case file"
+      ]
+    },
+    {
+      "id": "CAT-03-006",
+      "title": "Identify connected parties of legal persons and trusts",
+      "category": "CAT-03",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "Where the customer is a legal person, trust or other similar legal arrangement, an MSO must identify all connected parties of the customer by obtaining their names — namely, directors of a corporation, partners of a partnership, trustees (or equivalents) of a trust, or natural persons holding senior management/executive authority in other cases.",
+      "source": "Guideline §4.3.18, §4.3.19",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Connected-party register maintained per entity customer",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Onboarding form captures connected-party names",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Connected-party listing per customer file"
+      ]
+    },
+    {
+      "id": "CAT-03-007",
+      "title": "Identify and verify beneficial owners",
+      "category": "CAT-03",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must identify any beneficial owner in relation to a customer (using the AMLO definitions and the >25% ownership/voting/control thresholds) and take reasonable measures to verify the beneficial owner's identity. For a customer that is a legal person, the MSO must identify any natural person ultimately holding a controlling ownership interest and any natural person exercising control, and where no such natural person can be identified, must identify natural persons holding senior managing official positions. For a customer that is a trust, identify the settlor, trustee, protector, enforcer, beneficiaries (or class) and any natural person exercising ultimate control. The MSO must understand the ownership and control structure of any legal person or trust customer.",
+      "source": "Guideline §4.4.1, §4.4.6, §4.4.7, §4.4.8, §4.4.9, §4.4.10, §4.4.11, §4.4.13, §4.4.14; s.2(1)(b), Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Beneficial-owner identification procedure applies AMLO thresholds and senior-managing-official fallback",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Ownership/control structure mapped (e.g. ownership chart)",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Reasonable verification measures applied to each beneficial owner",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "For complex structures, MSO obtains sufficient information to satisfy itself of the legitimate reason for the structure",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Beneficial-ownership declaration",
+        "Ownership-structure chart",
+        "Verification records for each beneficial owner"
+      ]
+    },
+    {
+      "id": "CAT-03-008",
+      "title": "Bearer-share and nominee-shareholder customers",
+      "category": "CAT-03",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "Where a customer's ownership structure involves bearer shares, the MSO must adopt procedures to establish the identities of beneficial owners of such shares and ensure it is notified of any change of beneficial owner; where bearer shares are deposited with an authorised/registered custodian, the MSO must seek independent evidence of this, including custodian identity and the person entitled, and reconfirm this in periodic review; where not so deposited, the MSO must obtain declarations from each beneficial owner before account opening and annually thereafter, and require the customer to notify any ownership change immediately. For customers with nominee shareholders, the MSO must obtain satisfactory evidence of nominee identities, the persons on whose behalf they act, and the arrangement details, to determine the beneficial owner.",
+      "source": "Guideline §4.4.15, §4.4.16, §4.4.17, §4.4.18",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Procedure addresses bearer-share customers (custodian vs non-custodian routes)",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Annual declaration captured for non-custodian bearer-share customers",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Nominee-shareholder arrangements documented per customer",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Bearer-share/nominee policy",
+        "Annual declarations and custodian confirmations",
+        "Nominee-arrangement records"
+      ]
+    },
+    {
+      "id": "CAT-03-009",
+      "title": "Identify and verify persons purporting to act on behalf of the customer (PPTA)",
+      "category": "CAT-03",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "If a person is a PPTA, an MSO must identify the person and take reasonable measures to verify the person's identity using documents, data or information from a governmental body, the CCE or another relevant authority, an equivalent foreign authority, or another reliable and independent source recognised by the CCE; and must verify the person's authority to act on behalf of the customer by appropriate documentary evidence (e.g. board resolution or similar written authorisation). The MSO must implement clear policies and procedures for determining who is a PPTA.",
+      "source": "Guideline §4.5.1, §4.5.2, §4.5.3, §4.5.4; s.2(1)(d), Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "PPTA-identification policy in place",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "PPTA identity and authority records on file",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Authority document (POA/resolution/letter) collected and assessed",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "PPTA policy",
+        "PPTA file with identity and authority records"
+      ]
+    },
+    {
+      "id": "CAT-03-010",
+      "title": "Understand purpose and intended nature of business relationship",
+      "category": "CAT-03",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must understand the purpose and intended nature of the business relationship; the information obtained must be commensurate with the customer's risk profile and the nature of the relationship; where the customer is not a natural person, the MSO must also understand the nature of the customer's business.",
+      "source": "Guideline §4.6.1; s.2(1)(c), Sch. 2, AMLO",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Onboarding captures purpose and intended nature",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "For non-natural-person customers, nature of business recorded",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Onboarding questionnaire"
+      ]
+    },
+    {
+      "id": "CAT-03-011",
+      "title": "Timing of verification — deferral conditions",
+      "category": "CAT-03",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must verify the identity of a customer and any beneficial owner before or during the course of establishing a business relationship or conducting transactions for occasional customers. Verification may be completed after relationship establishment only where the risk of ML/TF can be effectively managed, it is necessary not to interrupt normal business conduct, and verification is completed as soon as reasonably practicable. Where deferred verification is permitted, the MSO must adopt risk management policies covering: a reasonable timeframe and follow-up if exceeded; appropriate transaction limits; monitoring of large/complex out-of-norm transactions; periodic senior-management updates on pending completions; and a prohibition on third-party payouts (with conditional carve-outs requiring no suspicion, low risk, senior management approval and watch-list screening).",
+      "source": "Guideline §4.7.1, §4.7.2, §4.7.3; s.3(2), (3), Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Deferral policy enumerates the §4.7.1 conditions",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Documented limits, monitoring, escalation and third-party-payout controls",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Pending-completion reporting to senior management",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Deferred-verification procedure",
+        "Sample deferral cases with controls evidenced"
+      ]
+    },
+    {
+      "id": "CAT-03-012",
+      "title": "Refusal and termination when CDD cannot be completed",
+      "category": "CAT-03",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "Where an MSO is unable to comply with the CDD requirements (including deferred verification not completed within the policy timeframe) and ongoing due diligence requirements, it must not establish a business relationship or carry out any occasional transaction with the customer and must terminate the existing business relationship as soon as reasonably practicable (where applicable), refraining from carrying out further transactions except, as far as possible, to return funds/assets in their original form; the MSO must also assess whether the failure provides grounds for ML/TF knowledge or suspicion and consider filing an STR with the JFIU.",
+      "source": "Guideline §4.7.4, §4.13.1; s.3(1) & (4), Sch. 2, AMLO; s.25A, DTROP/OSCO; s.12, UNATMO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Refusal/termination workflow documented and operational",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Cases logged of refused/terminated relationships",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "STR-assessment performed and recorded on termination",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Refusal/termination procedure",
+        "Termination case files",
+        "STR-assessment records"
+      ]
+    },
+    {
+      "id": "CAT-03-013",
+      "title": "Prohibition on anonymous or fictitious-name accounts",
+      "category": "CAT-03",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must not open or maintain any anonymous account or account in a fictitious name for any customer; confidential numbered accounts must be subject to the same CDD and control measures as all other business relationships, and the customer's CDD record must be available to the CCE, other competent authorities, the CO, auditors and other staff with appropriate authority.",
+      "source": "Guideline §4.14.1; s.16, Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "System controls prevent anonymous/fictitious-name account opening",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Confidential numbered accounts (if any) subject to full CDD",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "CDD records accessible to authorised parties",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Account-opening control documentation",
+        "Numbered-account control procedure"
+      ]
+    },
+    {
+      "id": "CAT-04-001",
+      "title": "Apply SDD only where eligibility is established",
+      "category": "CAT-04",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO applying simplified due diligence (SDD) must do so only after a documented determination that the business relationship or transaction presents a low ML/TF risk; SDD must not be applied or continue to be applied where the risk assessment changes, ML/TF is suspected, or there are doubts about previously obtained information. The MSO is still required to continuously monitor the business relationship (ongoing CDD and transaction monitoring) when applying SDD. Where the MSO chooses not to identify or verify the beneficial owner of a qualifying customer or product (§4.8.9 to §4.8.20), the qualifying category, product, or solicitor's client-account criteria must be evidenced.",
+      "source": "Guideline §4.8.1–§4.8.20; s.4, Sch. 2, AMLO",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "SDD eligibility test applied and documented before applying simplified measures",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Documentary basis for qualifying customer/product category recorded",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Ongoing monitoring still applied to SDD customers",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "SDD discontinuation triggers operational",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "SDD eligibility memos",
+        "Periodic re-eligibility review",
+        "Monitoring evidence on SDD customers"
+      ]
+    },
+    {
+      "id": "CAT-04-002",
+      "title": "Apply EDD in high-risk situations",
+      "category": "CAT-04",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must apply enhanced due diligence (EDD) measures to mitigate and manage high ML/TF risks in any situation that by its nature presents a high ML/TF risk (taking into account the §4.9.5 risk factors) or in any situation specified by the CCE in writing; the extent of EDD must be commensurate with the risk and justifiable to the CCE. Senior-management approval must be obtained to establish a high-risk relationship or continue one subsequently assessed as high-risk, and enhanced ongoing monitoring of that relationship must be conducted. Where applicable EDD measures cannot fully mitigate the risks, the MSO must take other measures to mitigate residual risks.",
+      "source": "Guideline §4.9.1, §4.9.2, §4.9.3, §4.9.4, §4.9.5, §4.9.6; s.10 & s.15, Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "High-risk identification process operational",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Senior-management approval recorded for high-risk relationships (new and continuing)",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "EDD measures applied and documented proportionate to risk",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Enhanced ongoing monitoring evidenced",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Residual-risk mitigation documented where EDD does not fully mitigate",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "High-risk customer policy",
+        "Senior-management approval records",
+        "EDD case files"
+      ]
+    },
+    {
+      "id": "CAT-04-003",
+      "title": "Detect and apply EDD to non-Hong Kong PEPs",
+      "category": "CAT-04",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must establish and maintain effective procedures (e.g. publicly available information and/or commercially available databases) for determining whether a customer or a beneficial owner is a non-Hong Kong PEP; when such status is known, before establishing or continuing a business relationship the MSO must obtain senior-management approval, take reasonable measures to establish source of wealth and source of funds, and conduct enhanced ongoing monitoring. For former non-Hong Kong PEPs, the EDD carve-out may be applied only with senior-management approval and based on a documented risk assessment that the PEP no longer presents a high ML/TF risk.",
+      "source": "Guideline §4.9.7, §4.9.8, §4.9.9, §4.9.10, §4.9.11, §4.9.12; s.19(1), s.5(3)(b), s.10(1) & (2), s.10(3), Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "PEP-detection procedure documented (sources, screening cadence, escalation)",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Senior-management approval and SoW/SoF records on file for each PEP",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Enhanced monitoring applied to PEP relationships",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Former-PEP carve-out supported by risk-assessment records",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "PEP-detection procedure",
+        "PEP case files with approvals and SoW/SoF documents",
+        "Former-PEP risk-assessment memos"
+      ]
+    },
+    {
+      "id": "CAT-04-004",
+      "title": "Detect and apply EDD to Hong Kong and international organisation PEPs",
+      "category": "CAT-04",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must take reasonable measures to determine whether a customer or beneficial owner is a Hong Kong PEP or international organisation PEP, and must apply the EDD measures in §4.9.10 in any of the following: before establishing a high-risk relationship with such a PEP customer/beneficial owner; when continuing an existing relationship with such a PEP that subsequently becomes high-risk; or when continuing an existing high-risk relationship where the MSO subsequently learns the customer/beneficial owner is such a PEP. The former-PEP carve-out for these PEP types is subject to senior-management approval and a documented risk assessment.",
+      "source": "Guideline §4.9.13, §4.9.14, §4.9.15, §4.9.16, §4.9.17, §4.9.18; s.15, Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "PEP-detection procedure covers HK and international organisation PEPs",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "EDD trigger conditions per §4.9.17 operationalised",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Former-PEP carve-out supported by risk-assessment records",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "PEP-detection procedure",
+        "HK/IO PEP case files with approvals and SoW/SoF documents"
+      ]
+    },
+    {
+      "id": "CAT-04-005",
+      "title": "Non-face-to-face customer additional measures",
+      "category": "CAT-04",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "Where a customer has not been physically present for identification purposes, an MSO must carry out at least one of: further verification using documents/data not previously used; supplementary measures to verify obtained information; or routing the first payment through an account opened in the customer's name with an authorised institution or an equivalent foreign institution. This requirement does not apply where the MSO has verified the customer's identity based on data from a digital identification system recognised by the CCE. The MSO must demonstrate to the CCE that the supplementary measure(s) adequately guard against impersonation risk, and should mitigate increased risk where non-natural-person customers establish a relationship via a non-face-to-face channel.",
+      "source": "Guideline §4.10.1, §4.10.2, §4.10.3, §4.10.4, §4.10.5; s.9(1), s.9(2), Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Non-face-to-face onboarding workflow applies at least one §4.10.1 measure",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Selected measure(s) recorded per customer",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Digital-ID-system exemption applied only where CCE-recognised",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Demonstrable case for adequacy of supplementary measures",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Non-face-to-face onboarding procedure",
+        "Sample case files",
+        "Digital ID system approval reference"
+      ]
+    },
+    {
+      "id": "CAT-04-006",
+      "title": "Jurisdictions subject to FATF call and CCE notices",
+      "category": "CAT-04",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must apply EDD measures, proportionate to the risks, to business relationships and transactions with natural and legal persons (including FIs) from jurisdictions for which this is called for by the FATF; where mandatory EDD or countermeasures are called for by FATF, or in circumstances independent of any FATF call but considered higher risk, the MSO must comply with general obligations under section 15 of Schedule 2 or specific countermeasures specified by the CCE in writing. The MSO must also document its assessment of jurisdictional equivalence and review such assessments on a regular basis and upon trigger events.",
+      "source": "Guideline §4.15.1, §4.15.2, §4.16.1, §4.16.2, §4.16.3; s.15, s.4(3)(b)(i), s.4(3)(d)(iii), s.4(3)(f), s.9(1)(c)(ii), s.18(3)(c), Sch. 2, AMLO",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "FATF-call register maintained and applied in onboarding/monitoring",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "CCE notice handling procedure documented",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Jurisdictional-equivalence assessments documented and reviewed",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "FATF-call and CCE-notice register",
+        "Jurisdictional-equivalence assessment records"
+      ]
+    },
+    {
+      "id": "CAT-05-001",
+      "title": "Reliance on intermediaries — formal requirements",
+      "category": "CAT-05",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "When an MSO relies on an intermediary to perform any part of CDD measures specified in section 2 of Schedule 2, the MSO must obtain written confirmation from the intermediary that it agrees to act as the MSO's intermediary and which part of the CDD measures it will perform, and must be satisfied that the intermediary will on request provide copies of any document, or a record of any data or information, obtained in the course of CDD without delay. Immediately after the intermediary has carried out a measure, the MSO must obtain the data or information collected; the MSO must ensure the intermediary will, if requested within the §20 retention period, supply copies of underlying documents/records as soon as reasonably practicable. The ultimate responsibility for ensuring CDD requirements are met remains with the MSO.",
+      "source": "Guideline §4.11.1, §4.11.3, §4.11.4, §4.11.5, §4.11.6, §4.11.7; s.18(1), s.18(4)(a), s.18(4)(b), Sch. 2, AMLO",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Written intermediary consent on file",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Information-on-demand workflow operational",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Sample testing of intermediary's CDD information supply",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Procedure for intermediary review/termination on reliability concerns",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Intermediary register",
+        "Signed intermediary consents",
+        "Sample-test records"
+      ]
+    },
+    {
+      "id": "CAT-05-002",
+      "title": "Intermediary eligibility — domestic, overseas and related foreign FIs",
+      "category": "CAT-05",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO may rely only on intermediaries that fall within the eligible categories: domestic intermediaries (intermediary FI, accounting professional, estate agent, legal professional, or TCSP licensee — with the further satisfaction that an accounting professional/estate agent/legal professional/TCSP licensee has adequate ML/TF procedures and is required to comply with relevant Schedule 2 requirements with respect to the customer); overseas intermediaries that fall within the §4.11.10 categories, are registered/licensed/regulated in an equivalent jurisdiction, have measures in place to ensure compliance with requirements similar to Schedule 2, and are supervised for compliance by an authority performing functions similar to those of any of the RAs; or related foreign FIs satisfying the §4.11.12 group, group-policy and group-level supervision tests. The MSO must take appropriate measures to ascertain eligibility for each intermediary type.",
+      "source": "Guideline §4.11.8, §4.11.9, §4.11.10, §4.11.11, §4.11.12, §4.11.13, §4.11.14; s.18(3)(a), (3)(b), (3)(c), (3)(d), (3A), (7), Sch. 2, AMLO",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Eligibility category and qualifying basis documented for each intermediary",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Evidence retained of supervision and AML/CFT compliance for overseas intermediaries",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "For related-FI reliance, group policy and group-level supervision documented",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Intermediary onboarding due-diligence files",
+        "Group-policy documentation",
+        "Supervision-evidence references"
+      ]
+    },
+    {
+      "id": "CAT-06-001",
+      "title": "Pre-existing customer event-driven CDD",
+      "category": "CAT-06",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must perform CDD measures in respect of pre-existing customers (with whom the business relationship was established before AMLO came into effect on 1 April 2012) when a transaction is unusual/suspicious or inconsistent with the MSO's knowledge of the customer; when a material change occurs in the way the customer's account is operated; when ML/TF is suspected; or when the veracity or adequacy of previously obtained identification information is doubted. Trigger events include dormant-account reactivation or a change in beneficial ownership/control. Ongoing monitoring under section 5 of Schedule 2 also applies to pre-existing customers.",
+      "source": "Guideline §4.12.1, §4.12.2, §4.12.3; s.5, s.6, Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Pre-existing-customer inventory maintained",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Event-driven CDD workflow operational",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Ongoing monitoring applied to pre-existing customers",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Pre-existing-customer register",
+        "Triggered-CDD case files"
+      ]
+    },
+    {
+      "id": "CAT-06-002",
+      "title": "Ongoing monitoring — CDD record refresh and transaction monitoring",
+      "category": "CAT-06",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must continuously monitor its business relationship with each customer through ongoing CDD (periodic and trigger-event reviews to ensure documents, data and information are up-to-date and relevant) and transaction monitoring (appropriate scrutiny against the customer's known profile, risk profile and source of funds, and identification of complex, unusually large or unusual-pattern transactions with no apparent economic or lawful purpose, with findings recorded in writing). High-risk customers must be subject to a minimum of annual review (more frequent if necessary), and findings of monitoring steps and rationale of decisions must be documented and available to the CCE and auditors.",
+      "source": "Guideline §5.1, §5.2, §5.3, §5.10, §5.11, §5.12, §5.13, §5.14; s.5(1), s.5(3), (4), (5), s.19(3), Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Periodic-review policy with risk-rated cadence (≤1 year for high-risk)",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Transaction-monitoring system scrutinises against customer profile, risk profile and source of funds",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Written records of unusual-pattern transaction findings",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "STR-assessment process when no satisfactory explanation obtained",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Periodic-review procedure",
+        "Transaction-monitoring alert and investigation records",
+        "Written findings memos"
+      ]
+    },
+    {
+      "id": "CAT-06-003",
+      "title": "Transaction monitoring systems and processes",
+      "category": "CAT-06",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must establish and maintain adequate systems and processes to monitor transactions, with design, automation and sophistication appropriate to its size and complexity, ML/TF risks, controls, and product/service mix; the monitoring must provide relevant staff with timely and sufficient information, support a relationship-based (rather than transaction-by-transaction) approach where practicable, take into account transaction characteristics (nature/type, series patterns, counterparties, geography, customer norms), and the parameters/thresholds must be properly documented, regularly reviewed and independently validated.",
+      "source": "Guideline §5.4, §5.5, §5.6, §5.7, §5.8, §5.9; s.5(3), (4), (5), s.19(3), Sch. 2, AMLO",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Transaction-monitoring system specification documented",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Parameters and thresholds documented and independently validated",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Periodic effectiveness review",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "System specification and parameter documentation",
+        "Independent validation reports",
+        "Effectiveness review records"
+      ]
+    },
+    {
+      "id": "CAT-07-001",
+      "title": "Maintain a screening database of designated parties",
+      "category": "CAT-07",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must establish and maintain effective policies, procedures and controls to comply with TF, financial sanctions and PF regulations and legislation; must maintain (or subscribe to with sample-testing assurance) a consolidated database of names and particulars of terrorists and designated parties — including (a) the lists published in the Gazette or on the website of the Commerce and Economic Development Bureau and (b) the lists the CCE draws to MSOs' attention from time to time — kept timely-updated and easily accessible by relevant staff. Countries, individuals and entities included in UNSCRs/sanctions lists must be added as soon as practicable after promulgation, regardless of Hong Kong implementation status.",
+      "source": "Guideline §6.12, §6.13, §6.14, §6.15",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Screening database in place and timely-updated",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Sample-testing performed where third-party database used",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Update process documented and operational",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Screening database documentation",
+        "Sample-test records",
+        "Update procedure"
+      ]
+    },
+    {
+      "id": "CAT-07-002",
+      "title": "Sanctions screening at onboarding and on database updates",
+      "category": "CAT-07",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "To avoid establishing business relationships with or providing financial services to terrorist suspects and possible sanctioned parties, an MSO must implement an effective screening mechanism that includes: screening customers and any beneficial owners against the current database at the establishment of the relationship; screening customers and beneficial owners against all new and updated designations as soon as practicable; and screening all relevant parties in cross-border/cross-boundary wire transfers (including remittance transactions) against the current database before executing the transfer. Screening must be carried out irrespective of customer risk profile and must extend to connected parties and PPTAs using an RBA. When possible name matches are identified, the MSO must conduct enhanced checks to determine whether the matches are genuine hits, and where suspicions of TF/PF/sanctions violations arise, must report to the JFIU; enhanced-checking and screening records must be documented or recorded electronically.",
+      "source": "Guideline §6.16, §6.17, §6.18, §6.19; s.8 & s.8A, UNATMO; s.4, WMD(CPS)O; applicable UNSO Regulations",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Screening performed at onboarding for customers and beneficial owners",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Ongoing screening on database updates",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Pre-execution screening on cross-border wire/remittance parties",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Connected-party and PPTA screening based on RBA",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Enhanced-checking and hit-disposition records retained",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "STR-filing on confirmed/suspected matches",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Screening procedure and logs",
+        "Hit-disposition records",
+        "STR filings linked to sanctions hits"
+      ]
+    },
+    {
+      "id": "CAT-08-001",
+      "title": "STR obligation and timing",
+      "category": "CAT-08",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "Where a person knows or suspects that any property (i) wholly or partly represents proceeds of an indictable offence/drug trafficking, (ii) was used in connection with, or (iii) is intended to be used in connection with drug trafficking or an indictable offence; or that any property is terrorist property, the person must as soon as it is reasonable to do so file an STR with the JFIU together with the matter on which the knowledge or suspicion is based — irrespective of whether a transaction was actually conducted and regardless of amount. The STR must be made as soon as reasonably practical after the suspicion was first identified.",
+      "source": "Guideline §7.1, §7.5; s.25A(1) & (7), DTROP & OSCO; s.12(1) & 14(5), UNATMO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "STR procedure documented and operational",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Sample STRs filed in line with timing requirements",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Audit trail of suspicion-identification-to-STR-filing time",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "STR procedure",
+        "STR register/log",
+        "Sample STR filings"
+      ]
+    },
+    {
+      "id": "CAT-08-002",
+      "title": "AML/CFT Systems for STR — MLRO, procedures, records",
+      "category": "CAT-08",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must implement AML/CFT Systems to fulfil its statutory reporting obligations and manage post-reporting risks, including appointment of an MLRO; clear policies and procedures over internal reporting, reporting to the JFIU, post-reporting risk mitigation and prevention of tipping off; and keeping proper records of internal reports and STRs. The MSO must have measures in place to check, on an ongoing basis, that these AML/CFT Systems comply with relevant legal/regulatory requirements and operate effectively. The MSO must establish and maintain records of all ML/TF reports made to the MLRO and all STRs made to the JFIU, including dates, handlers, results of assessments, and information to locate underlying papers.",
+      "source": "Guideline §7.7, §7.8, §7.29, §7.30",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "MLRO appointment evidenced",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Internal reporting and JFIU-reporting procedures documented",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Tipping-off prevention controls in place",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Internal-report register maintained",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "STR register maintained",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Internal reporting procedure",
+        "Internal-report register",
+        "STR register"
+      ]
+    },
+    {
+      "id": "CAT-08-003",
+      "title": "Identify suspicious transactions and avoid tipping off",
+      "category": "CAT-08",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must provide sufficient guidance to staff (and agents where applicable) to enable them to form suspicion and recognise the signs of ML/TF/PF, including red-flag indicators relevant to its operations, and must establish and maintain clear policies and procedures ensuring all staff know the MLRO's identity and the internal-reporting procedure, that internal reports reach the MLRO without undue delay and are not filtered out by non-compliance supervisors, and that staff who report suspicion are acknowledged and reminded of the tipping-off prohibition. Tipping off (revealing information that might prejudice an investigation) is a statutory offence, including where suspicion has been raised internally but not yet reported.",
+      "source": "Guideline §7.6, §7.10, §7.12, §7.13, §7.14, §7.15, §7.16; s.25A(5), DTROP & OSCO; s.12(5), UNATMO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Red-flag indicator guidance issued to staff",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Internal-reporting workflow documented (short, unfiltered route to MLRO)",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Tipping-off training delivered and acknowledged",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "MLRO acknowledgement/reminder process operational",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Red-flag indicator guidance",
+        "Internal-reporting workflow chart",
+        "Training records",
+        "MLRO acknowledgement log"
+      ]
+    },
+    {
+      "id": "CAT-08-004",
+      "title": "MLRO review and reporting to JFIU",
+      "category": "CAT-08",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "When evaluating an internal report, the MLRO must take reasonable steps to consider all relevant information, including CDD and ongoing monitoring information available to or within the MSO concerning the entities involved; the review process must be documented. If after the review the MLRO decides there are grounds for knowledge or suspicion, the MLRO must disclose the information to the JFIU as soon as it is reasonable to do so, together with the basis for the knowledge or suspicion. For urgent reporting (e.g. imminent fund movement, account closure), the MSO must indicate the urgency in the STR and may consider an initial telephone notification. The MSO must maintain STR quality having regard to feedback from the JFIU and CCE.",
+      "source": "Guideline §7.17, §7.18, §7.19, §7.20, §7.21, §7.22, §7.23",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "MLRO review process documented (information considered, conclusion, rationale)",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "STR-to-JFIU filing timeliness tracked",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Urgent-reporting protocol in place",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "STR quality reviewed against JFIU/CCE feedback",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "MLRO review files",
+        "STR filings and filing-time metrics",
+        "Urgent-reporting procedure"
+      ]
+    },
+    {
+      "id": "CAT-08-005",
+      "title": "Post-STR review and continuing reporting",
+      "category": "CAT-08",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must conduct an appropriate review of the business relationship upon filing an STR with the JFIU (irrespective of subsequent JFIU feedback), apply appropriate risk-mitigation measures, and escalate to senior management where necessary. The MSO must remain aware that filing an STR does not remove the need to file further STRs in respect of the same customer; further suspicious transactions or events, whether of the same nature or different, must continue to be reported to the MLRO who must make further reports to the JFIU if appropriate.",
+      "source": "Guideline §7.26, §7.27, §7.28",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Post-STR review procedure documented and operational",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Continuing-report procedure operational for re-suspicion cases",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Senior-management escalation path defined",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Post-STR review case files",
+        "Senior-management escalation records"
+      ]
+    },
+    {
+      "id": "CAT-08-006",
+      "title": "Handling law-enforcement court documents and intelligence requests",
+      "category": "CAT-08",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must establish clear policies and procedures to handle court documents from law enforcement (search warrants, production orders, restraint orders, confiscation orders) effectively and timely, with provision of accurate information, sufficient resources and a designated main point of contact; it must respond to any search warrant and production order within the required time limit and contact the officer-in-charge at the earliest opportunity if compliance with the timeframe is difficult. It must ensure that property subject to a restraint order can be withheld, and when served with a court document or law-enforcement intelligence request, must timely assess the risks and the need to review the customer or business relationship to determine whether suspicion exists.",
+      "source": "Guideline §7.31, §7.32, §7.33, §7.34, §7.35; s.10 & 11, DTROP; s.15 & 16, OSCO; s.6, UNATMO; s.3, DTROP; s.8, OSCO; s.13, UNATMO",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Court-document handling procedure documented with named point of contact",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Sample responses meet timeframes",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Restraint-order operationalisation evidenced",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Law-enforcement handling procedure",
+        "Sample-response case files",
+        "Restraint-order action log"
+      ]
+    },
+    {
+      "id": "CAT-09-001",
+      "title": "Records of CDD, transactions and related analyses",
+      "category": "CAT-09",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must keep: the original or a copy of documents and records of data and information obtained in the course of identifying and verifying the customer, beneficial owners, beneficiaries, PPTAs and other connected parties; other documents and records obtained throughout CDD and ongoing monitoring (including SDD and EDD); records on purpose and intended nature of the business relationship; account-opening and business-correspondence records (at least those material to CDD or significant account-operation changes); and the results of any analyses (e.g. inquiries into complex/unusual transactions). Records of each transaction (domestic and international) must be sufficient to permit reconstruction of individual transactions to provide evidence for prosecution.",
+      "source": "Guideline §8.2, §8.3, §8.5; s.20(1)(a), s.20(1)(b)(i), s.20(1)(b)(ii), s.2(1)(c), Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Records inventory documents all required record classes",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Customer files contain identification, BO, PPTA, connected-party records",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Transaction records can be reconstructed end-to-end",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Records inventory",
+        "Sample customer file",
+        "Transaction reconstruction sample"
+      ]
+    },
+    {
+      "id": "CAT-09-002",
+      "title": "Retention periods for records",
+      "category": "CAT-09",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "All documents and records relating to a customer (per §8.3) must be kept throughout the continuance of the business relationship and for at least five years after the end of the business relationship; for occasional transactions at or above the CDD threshold (HKD 8,000 for wire transfers or virtual asset transfers, HKD 120,000 for other types), the related records must be kept for at least five years after the date of the occasional transaction. Transaction records must be kept for at least five years after completion of the transaction, regardless of whether the business relationship ends during that period. Where the CCE specifies a longer retention period by notice, the MSO must keep the relevant records for that longer period.",
+      "source": "Guideline §8.4, §8.6, §8.8; s.20(2), (3), (3A), (4), Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Retention schedule encodes 5-year minimums",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Process exists to extend retention on CCE §20(4) notice",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Disposal controls prevent early deletion",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Retention schedule",
+        "CCE-notice register",
+        "Disposal controls"
+      ]
+    },
+    {
+      "id": "CAT-09-003",
+      "title": "Manner of keeping records and intermediary-held records",
+      "category": "CAT-09",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "Document-form records must be kept either as the original document or as a copy on microfilm or in the database of a computer; data or information records must be kept on microfilm or in the database of a computer. Where customer identification and verification documents are held by an intermediary, the MSO remains responsible for compliance with all record-keeping requirements and must ensure the intermediary has systems to comply and will produce documents on demand without undue delay; the MSO must immediately obtain data/information the intermediary collected, and must ensure the intermediary passes documents and records to the MSO upon termination of the intermediary services.",
+      "source": "Guideline §8.7, §8.10, §8.11, §8.12; s.21, s.18(4)(a), (b), Sch. 2, AMLO",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Approved storage media documented",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Intermediary records-handling procedure operational, including termination handover",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Records-management policy",
+        "Intermediary records-handling procedure"
+      ]
+    },
+    {
+      "id": "CAT-10-001",
+      "title": "Provide ongoing AML/CFT staff training",
+      "category": "CAT-10",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must provide adequate training for its staff to implement its AML/CFT Systems, with scope and frequency tailored to the MSO's specific risks and pitched to staff job functions, responsibilities and experience. New staff must attend initial training as soon as possible after hiring/appointment, and refresher training must be provided regularly; the MSO must implement a clear and well-articulated policy ensuring relevant staff receive adequate AML/CFT training. Training must cover statutory obligations and consequences for failure under AMLO, DTROP, OSCO, UNATMO, UNSO, WMD(CPS)O; the MSO's policies and procedures; and new ML/TF techniques, methods and trends relevant to staff roles.",
+      "source": "Guideline §9.2, §9.3, §9.4, §9.5",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Training policy documented",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Initial- and refresher-training schedules implemented",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Curriculum covers §9.4 statutory obligations and §9.5 role-specific topics",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Training policy and curriculum",
+        "Training attendance records"
+      ]
+    },
+    {
+      "id": "CAT-10-002",
+      "title": "Monitor and record training effectiveness",
+      "category": "CAT-10",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "An MSO must maintain records of who has been trained, when the training was received and the type provided, kept for a minimum of 3 years; must monitor training effectiveness through staff understanding tests, monitoring staff compliance and the quality/quantity of internal reports, and monitoring attendance with follow-up of unjustified absences. Training materials must be demonstrably up-to-date and in line with current requirements and standards.",
+      "source": "Guideline §9.6, §9.7, §9.8",
+      "severity": "major",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Training-records database maintained per §9.7",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Effectiveness measurement (tests, internal-report metrics) in place",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Curriculum currency reviewed periodically",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Training-records database",
+        "Effectiveness assessments",
+        "Curriculum review log"
+      ]
+    },
+    {
+      "id": "CAT-11-001",
+      "title": "Ordering institution — required information per threshold",
+      "category": "CAT-11",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "As ordering institution, an MSO must ensure a wire transfer of HKD 8,000 or more (or equivalent) is accompanied by the originator's name, account number with the ordering institution (or unique reference number permitting traceability), originator's address/customer identification number/identification document number or (for an individual) date and place of birth, the recipient's name, and the recipient's account number with the beneficiary institution (or unique reference number); for a wire transfer below HKD 8,000, the address/ID/DoB element is not required but all other elements remain. The ordering institution must ensure that the originator information accompanying a wire transfer of HKD 8,000 or more is accurate. For occasional wire transfers of HKD 8,000 or more, the MSO must verify the originator's identity (extending to below-threshold transfers where they are linked or there is ML/TF suspicion).",
+      "source": "Guideline §10.5, §10.6, §10.7, §10.8, §10.9; s.12(3), (3A), (5), s.3(1)(d) & (1A), Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Wire-transfer record specification captures all §10.5/§10.6 fields per threshold",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Originator-information accuracy controls in place for ≥HKD 8,000 transfers",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Linked-transaction aggregation triggers identity verification",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Wire-transfer specification",
+        "Sample transfer audit trail",
+        "Linked-transaction monitoring records"
+      ]
+    },
+    {
+      "id": "CAT-11-002",
+      "title": "Ordering institution — batch and domestic-shortcut handling",
+      "category": "CAT-11",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "Where the ordering institution bundles a number of wire transfers from a single originator into a batch file for transmission to recipients outside Hong Kong, each transfer may carry only the originator's account/unique reference number provided the batch file contains required and accurate originator information and required recipient information fully traceable within the recipient country. For a domestic wire transfer, the ordering institution may omit complete originator information and include only the originator's account number/unique reference number provided traceability is preserved; if it does so, on request from the receiving institution or the CCE it must provide the complete required originator information within 3 business days, and such information must be made available to law enforcement agencies immediately upon request.",
+      "source": "Guideline §10.10, §10.11, §10.12; s.12(6), s.12(7), Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Batch-processing specification carries §12(3) information at batch level",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Domestic-shortcut workflow can supply complete originator information within 3 business days",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "LEA-on-request workflow can provide information immediately",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Batch-processing specification",
+        "Request-response logs for §12(6) information requests"
+      ]
+    },
+    {
+      "id": "CAT-11-003",
+      "title": "Ordering, intermediary and beneficiary missing-information procedures",
+      "category": "CAT-11",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "As ordering institution, an MSO must establish and maintain effective procedures to prevent carrying out outgoing wire transfers without the required originator/recipient information, including reasonable measures (e.g. regular review or audit testing) to identify deficient transfers and risk-based policies for handling them, with timely rectification of control deficiencies. As intermediary institution, an MSO must ensure that all originator and recipient information accompanying the wire transfer is retained and transmitted onward, must establish procedures for identifying and handling deficient incoming wire transfers, must obtain missing information from the sending institution as soon as reasonably practicable for cross-border transfers (or consider restricting/terminating the sender relationship or take reasonable mitigation measures if it cannot be obtained), and must take reasonable mitigation measures where accompanying information is incomplete or meaningless; where technical limitations prevent the required information being carried with a related domestic-cross-border or cross-border-domestic wire transfer, the intermediary must keep a record for at least five years of all information received. As beneficiary institution, an MSO must establish procedures to identify and handle deficient wire transfers (including post-event monitoring), obtain missing information as soon as reasonably practicable, consider restricting/terminating the sender relationship or take reasonable mitigation measures if missing information cannot be obtained, and take reasonable mitigation measures where accompanying information is incomplete or meaningless; for a wire transfer of HKD 8,000 or more, the beneficiary institution must verify the recipient's identity if not previously verified.",
+      "source": "Guideline §10.13, §10.14, §10.15, §10.16, §10.17, §10.18, §10.19, §10.20, §10.21, §10.22; s.12(8), s.12(9), s.12(10), s.19(2), s.3(1) & (1A), Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Outgoing-transfer pre-execution checks for required information",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Intermediary pass-through preserves all received fields",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Beneficiary post-event monitoring identifies deficient transfers",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Missing-information escalation/mitigation procedures documented",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Recipient identity verified for ≥HKD 8,000 incoming transfers",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "5-year retention for technical-limitation records",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Ordering/intermediary/beneficiary procedures",
+        "Deficient-transfer case log",
+        "Recipient-verification records"
+      ]
+    },
+    {
+      "id": "CAT-12-001",
+      "title": "Remittance — originator identification, verification and recording",
+      "category": "CAT-12",
+      "risk_domain": null,
+      "risk_sub_domain": null,
+      "risk_statement": null,
+      "parent_control": null,
+      "requirement": "Before carrying out a remittance transaction (other than a wire transfer) of HKD 8,000 or more (or equivalent in any other currency), an MSO must identify the originator and verify the originator's identity by reference to the originator's identification document, and must record (a) the originator's name; (b) the originator's identification document number and, if the document is a travel document, the place of issue; (c) the originator's address; (d) the currency and amount involved; and (e) the date and time of receipt of the instruction, the recipient's name and address and the method of delivery; the MSO must keep these records per the record-keeping requirements so the information is available to the CCE on request.",
+      "source": "Guideline §11.1, §11.2, §11.3, §11.4, §11.5, §11.6; s.13, s.13(1), s.13(2)(a), (b), (c), s.13(3), Sch. 2, AMLO",
+      "severity": "critical",
+      "verification": [
+        {
+          "prefix": null,
+          "text": "Remittance system enforces identification and verification at or above HKD 8,000",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "All §11.6 data fields captured per transaction",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Document-based verification step recorded",
+          "children": [],
+          "section": "mandatory"
+        },
+        {
+          "prefix": null,
+          "text": "Retention aligned to record-keeping requirements",
+          "children": [],
+          "section": "mandatory"
+        }
+      ],
+      "evidence": [
+        "Remittance record specification",
+        "Sample transaction file with §11.6 fields populated"
+      ]
+    }
+  ]
+}