Common Deficiencies Identified in Tier 2 AML Examinations HONG KONG MONETARY AUTHORITY Common Deficiencies Identified in Tier 2 AML Examinations 12 May 2009

General CDD Failure to verify nationality of non-permanent HKID holders Acceptance of expired passports Failure to record the identity of 3rd parties making large cash deposits Address proof : failure to obtain or acceptance of out of date documents Inadequate follow-up on outstanding CDD documentation 3rd party payments from accounts with outstanding CDD

General CDD No periodic review of CDD of lower risk accounts in absence of trigger event Incoming cross border remittance transactions containing incomplete originator information – inadequate monitoring No periodic re-screening of client list against SFC Alert List Intermediaries - no assessment of the ‘fit and proper’ standing

Corporate Customers Failure to identify beneficial owner Failure to obtain up to date company search documents (incorporated in jurisdiction with public registries) & COI (from regulated parties in non-public registry jurisdictions) Bearer shares - failure to immobilize or obtain annual declarations from shareholders

Corporate Customers Failure to properly identify and screen connected parties (i.e. directors, principal shareholders, signatories) Details of connected parties are not included in AI’s core banking system - resulting in no periodic re-screening against Terrorist/Sanction/PEP lists

PEPs Excluding known close associates & family members from PEP definition No regular review of identified PEP accounts No periodic re-screening of client lists to identify clients whose status may have changed Failure to screen connected parties to corporate customer

Suspicious Transaction Reporting No review of the risks associated with reported accounts Undue reliance on “consent” and the former “Low Risk Classification” STR provides statutory defense to ML – does not address the legal, reputational, regulatory risks associated with accounts’ continued operation

Correspondent Banking Exchange of Swift Keys ‘deemed’ establishment of correspondent activity Failure to obtain sufficient information to assess the adequacy and effectiveness of the respondent's AML controls and risk. AI must satisfy itself respondent subject to appropriate regulatory oversight does not maintain relations with shell banks payable through accounts (special measures required).

Private Banking Account booked offshore but managed in HK – ‘deemed’ shared relationship CDD conducted to standard required by HKMA (minimum) HKMA access to CDD/transaction information upon request

Questions