Cap. 615, Hong Kong e-Legislation
The ordinance, with customer due diligence in Schedule 2.
Hong Kong KYC, regulator by regulator.
Hong Kong's AMLO sets customer due diligence, and each regulator applies it through its own guideline; three recognise iAM Smart.
Fill Easy returns iAM Smart data, Companies Registry records and ownership, with source and retrieval time.
A summary, not legal advice: the official text governs, and your compliance team decides what your policies require.
One ordinance, one guideline per regulator.
The Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) sets due diligence duties in Schedule 2. A firm verifies its customer from a government body, a recognised digital identification system or another reliable and independent source, and takes reasonable measures to verify beneficial owners.
Verification through a recognised digital identification system needs no further non-face-to-face measure. The Registrar of Companies is a fifth relevant authority, for trust and company service providers.
At a glance
- Law
- Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), Schedule 2
- Beneficial owner
- More than 25% of shares or voting rights, or ultimate control
- Records
- Throughout the relationship and at least five years after it ends
- Relevant authorities
HKMAHong Kong Monetary Authority
SFCSecurities and Futures Commission
IAInsurance AuthorityC&EDCustoms and Excise Department
CRCompanies Registry (Registrar of Companies)The Companies Registry supervises trust and company service providers.- Digital identity
iAM SmartRecognised by the HKMA, SFC and Insurance Authority.
Choose your sector.
Pick your sector to see what its regulator accepts under AMLO, and what Fill Easy supplies.
HKMAHong Kong Monetary AuthorityAML/CFT Guideline for Authorized Institutions, May 2023 (opens in a new tab)Individuals
Identify and verify the customer
Full name, date of birth, nationality, and identity document number and type, verified from a government body, a recognised digital identification system or another reliable and independent source, such as an HKID, another national identity card or a valid passport (paras 4.3.1 and 4.3.3).
GovVerify · iAM SmartName, HKID number, date of birth and residential address, sent by the government once the customer consents on their phone.Recognised digital identity
The regulator recognises iAM Smart as a digital identification system for verifying natural persons (para 4.3.1, footnote 17).
GovVerify · iAM SmartVerified through a recognised digital identification system, so no further non-face-to-face measure is needed (AMLO Sch. 2 s. 9(2)).Address and photograph
Collect the residential address. Verifying it is not an AML requirement; any other reason for asking must be explained to the customer (para 4.3.5). A photograph is required save in exceptional cases (para 4.3.4).
GovVerify · iAM SmartThe residential address comes from the government record with the identity, so there is nothing to chase.Mainland and overseas customers
Verified from a passport or other identity document, or another reliable and independent source the regulator accepts.
GovVerify · China eIDResident ID checked against official government sources with a face check and consent, returned to Hong Kong under Filing No. 202500031.
Companies
Identify and verify the entity
Name, legal form, current existence and the powers that bind it, from documents such as an independent company registry record or a certificate of incorporation, incumbency or good standing. A certificate of incorporation alone does not prove current existence (para 4.3.7).
CorpVerify · registry searchA Companies Registry search with the company report and statutory filings, showing the company's current status.Beneficial owners
More than 25% of shares or voting rights, or ultimate control; failing that, senior managing officials. Verified with reasonable, risk-proportionate measures, such as public registers or the customer's significant controllers register, which the Registry does not publish (para 4.4).
CorpVerify · UBO tracingOwnership traced through each registry to the natural persons at the top, with each layer's jurisdiction and holding.Ongoing monitoring
Periodic and trigger-event reviews, and at least an annual review of high-risk customers.
Monitoring and remediationThe book re-checked at source from one Excel file, with director, owner, address and status changes flagged.
Non-face-to-face and records
- A customer not physically present needs one of three extra measures, such as further verification or a first payment from a bank account in their name, unless verified through a recognised digital identification system (AMLO Sch. 2 s. 9; para 4.10.2).
- The HKMA circular of 3 September 2026 on remote on-boarding of individual customers, for banks and stored value facilities, answers deepfakes with two principles: identity authentication (the identity document and data are genuine) and identity matching (the customer is incontrovertibly linked to that identity). It replaces the 2019 remote on-boarding circular and the 2021 circular on iAM Smart.
- Licensed stablecoin issuers follow the HKMA's AML/CFT guideline for issuers (August 2025), including due diligence on stablecoin holders.
- Records kept throughout the relationship and for at least five years after it ends (AMLO Sch. 2 s. 20; paras 8.3 to 8.6).
SFCSecurities and Futures CommissionAML/CFT Guideline for LCs and SFC-licensed VASPs, June 2023 (opens in a new tab)Individuals
Identify and verify the customer
Full name, date of birth, nationality, and identity document number and type, verified from a government body, a recognised digital identification system or another reliable and independent source, such as an HKID, another national identity card or a valid passport (paras 4.2.1 and 4.2.3).
GovVerify · iAM SmartName, HKID number, date of birth and residential address, sent by the government once the customer consents on their phone.Recognised digital identity
The regulator recognises iAM Smart as a digital identification system for verifying natural persons (para 4.2.1, footnote 16).
GovVerify · iAM SmartVerified through a recognised digital identification system, so no further non-face-to-face measure is needed (AMLO Sch. 2 s. 9(2)).Address and photograph
Collect the residential address. Verifying it is not an AML requirement; any other reason for asking must be explained to the customer (para 4.2.4). A copy of the identity document or record is kept.
GovVerify · iAM SmartThe residential address comes from the government record with the identity, so there is nothing to chase.Mainland and overseas customers
Verified from a passport or other identity document, or another reliable and independent source the regulator accepts.
GovVerify · China eIDResident ID checked against official government sources with a face check and consent, returned to Hong Kong under Filing No. 202500031.
Companies
Identify and verify the entity
Name, legal form, current existence and the powers that bind it, from documents such as an independent company registry record or a certificate of incorporation, incumbency or good standing. A certificate of incorporation alone does not prove current existence (para 4.2.6).
CorpVerify · registry searchA Companies Registry search with the company report and statutory filings, showing the company's current status.Company search reports
A Hong Kong Companies Registry search for a company report, or a certified true copy, verifies name, legal form and current existence; for an overseas company, a similar search at its registry of incorporation (Appendix C, item 3).
CorpVerify · registry searchThe Hong Kong company report, or the equivalent search at the registry where an overseas company is incorporated.Beneficial owners
More than 25% of shares or voting rights, or ultimate control; failing that, senior managing officials. Verified with reasonable, risk-proportionate measures, such as public registers or the customer's significant controllers register, which the Registry does not publish (para 4.3).
CorpVerify · UBO tracingOwnership traced through each registry to the natural persons at the top, with each layer's jurisdiction and holding.Ongoing monitoring
Periodic and trigger-event reviews, and at least an annual review of high-risk customers.
Monitoring and remediationThe book re-checked at source from one Excel file, with director, owner, address and status changes flagged.
Non-face-to-face and records
- A customer not physically present needs one of three extra measures, such as further verification or a first payment from a bank account in their name, unless verified through a recognised digital identification system (AMLO Sch. 2 s. 9; para 4.10.3).
- Licensed corporations also follow Code of Conduct paragraph 5.1 and the SFC's acceptable account opening approaches, which since 30 May 2025 list iAM Smart beside certification services such as Hongkong Post's iAM Smart-Cert and the designated bank account route (initial deposit of at least HK$10,000).
- In May 2026 the SFC told licensed corporations it has zero tolerance for accepting questionable or forged account opening documents.
- Records kept throughout the relationship and for at least five years after it ends (AMLO Sch. 2 s. 20; paras 8.3 to 8.7).
IAInsurance AuthorityGL3 Guideline on AML/CFT, May 2025 (opens in a new tab)Individuals
Identify and verify the customer
Full name, date of birth, nationality, and identity document number and type, verified from a government body, a recognised digital identification system or another reliable and independent source, such as an HKID, another national identity card or a valid passport (paras 4.3.1 and 4.3.3).
GovVerify · iAM SmartName, HKID number, date of birth and residential address, sent by the government once the customer consents on their phone.Recognised digital identity
The regulator recognises iAM Smart as a digital identification system for verifying natural persons (para 4.3.1, footnote 22).
GovVerify · iAM SmartVerified through a recognised digital identification system, so no further non-face-to-face measure is needed (AMLO Sch. 2 s. 9(2)).Address and photograph
Collect the residential address. Verifying it is not an AML requirement; any other reason for asking must be explained to the customer (para 4.3.5). The identity document must carry a photograph (para 4.3.4).
GovVerify · iAM SmartThe residential address comes from the government record with the identity, so there is nothing to chase.Mainland and overseas customers
Verified from a passport or other identity document, or another reliable and independent source the regulator accepts.
GovVerify · China eIDResident ID checked against official government sources with a face check and consent, returned to Hong Kong under Filing No. 202500031.
Companies
Identify and verify the entity
Name, legal form, current existence and the powers that bind it, from documents such as an independent company registry record or a certificate of incorporation, incumbency or good standing. A certificate of incorporation alone does not prove current existence (para 4.3.7).
CorpVerify · registry searchA Companies Registry search with the company report and statutory filings, showing the company's current status.Beneficial owners
More than 25% of shares or voting rights, or ultimate control; failing that, senior managing officials. Verified with reasonable, risk-proportionate measures, such as public registers or the customer's significant controllers register, which the Registry does not publish (para 4.4).
CorpVerify · UBO tracingOwnership traced through each registry to the natural persons at the top, with each layer's jurisdiction and holding.Ongoing monitoring
Periodic and trigger-event reviews, and at least an annual review of high-risk customers.
Monitoring and remediationThe book re-checked at source from one Excel file, with director, owner, address and status changes flagged.
Non-face-to-face and records
- A customer not physically present needs one of three extra measures, such as further verification or a first payment from a bank account in their name, unless verified through a recognised digital identification system (AMLO Sch. 2 s. 9; para 4.12).
- High-risk customers are reviewed at least once a year (para 5.4).
- Records kept throughout the relationship and for at least five years after it ends (AMLO Sch. 2 s. 20; chapter 8).
C&EDCustoms and Excise DepartmentAML/CFT Guideline for Money Service Operators, June 2023 (opens in a new tab)Individuals
Identify and verify the customer
Full name, date of birth, nationality, and identity document number and type, verified from a government body, a recognised digital identification system or another reliable and independent source, such as an HKID, another national identity card or a valid passport (paras 4.3.1 and 4.3.3).
GovVerify · iAM SmartName, HKID number, date of birth and residential address, sent by the government once the customer consents on their phone.Recognised digital identity
The guideline accepts a digital identification system recognised by the Commissioner (para 4.3.1(d)) but names none. Non-residents not present may be verified by passport, national identity card or national driving licence with a photograph (Appendix A).
iAM Smart is not named in this guideline; confirm with Customs before relying on it.
Address and photograph
Collect the residential address. Verifying it is not an AML requirement; any other reason for asking must be explained to the customer (para 4.3.5). A photograph is required save in exceptional cases (para 4.3.4).
GovVerify · iAM SmartThe residential address comes from the government record with the identity, so there is nothing to chase.Mainland and overseas customers
Verified from a passport or other identity document, or another reliable and independent source the regulator accepts.
GovVerify · China eIDResident ID checked against official government sources with a face check and consent, returned to Hong Kong under Filing No. 202500031.
Companies
Identify and verify the entity
Name, legal form, current existence and the powers that bind it, from documents such as an independent company registry record or a certificate of incorporation, incumbency or good standing. A certificate of incorporation alone does not prove current existence (para 4.3.7).
CorpVerify · registry searchA Companies Registry search with the company report and statutory filings, showing the company's current status.Company search reports
A money service operator may identify and verify a corporate customer with a full company search report from the registry in its place of incorporation (Appendix A, para 5).
CorpVerify · registry searchThe Hong Kong company report, or the equivalent search at the registry where an overseas company is incorporated.Beneficial owners
More than 25% of shares or voting rights, or ultimate control; failing that, senior managing officials. Verified with reasonable, risk-proportionate measures, such as public registers or the customer's significant controllers register, which the Registry does not publish (para 4.4).
CorpVerify · UBO tracingOwnership traced through each registry to the natural persons at the top, with each layer's jurisdiction and holding.Ongoing monitoring
Periodic and trigger-event reviews, and at least an annual review of high-risk customers.
Monitoring and remediationThe book re-checked at source from one Excel file, with director, owner, address and status changes flagged.
Non-face-to-face and records
- A customer not physically present needs one of three extra measures, such as further verification or a first payment from a bank account in their name, unless verified through a recognised digital identification system (AMLO Sch. 2 s. 9; para 4.10.2).
- Records kept throughout the relationship and for at least five years after it ends (AMLO Sch. 2 s. 20; chapter 8).
Read the source
The official text.
HKMA circular, 3 September 2026
Remote on-boarding of individual customers.
SFC: acceptable account opening approaches
Including iAM Smart and the designated bank account route.
Companies Registry: significant controllers registers
Who keeps the register and who may see it.
Questions about Hong Kong KYC and AML
Not covered here? Ask our team
Can we rely on the data Fill Easy returns?
Yes, as verification evidence. AMLO lets you verify a customer from a governmental body, a recognised digital identification system or another reliable and independent source (Schedule 2, section 2). iAM Smart is recognised by the HKMA, SFC and Insurance Authority, and Companies Registry records come from the government itself. Fill Easy passes the data on unaltered, with its source and retrieval time. You rely on the source, not on Fill Easy as an intermediary, and the decision stays with your firm.
Does Fill Easy make us compliant with Hong Kong AML rules?
No. The due diligence duty sits with your firm under Hong Kong AML rules, and your policies decide what is enough. Fill Easy supplies the evidence those policies rely on: records from the government or registry source, each showing where and when it was retrieved.
Do we still need a copy of the HKID if the customer uses iAM Smart?
The guidelines ask you to keep a copy of the identity document or a record of the verification. Fill Easy returns each iAM Smart verification as a record of the government-confirmed fields, the time and your reference, to keep for five years after the relationship ends.
Do we have to verify the customer's address?
Not for AML. The HKMA and SFC guidelines ask you to collect the residential address, and to verify it only where another rule or policy requires it, explaining why to the customer. iAM Smart returns the address from the government record anyway.
What if the customer is not physically present?
AMLO asks for one extra measure, such as further verification or a first payment from an account in the customer's name with a bank. None is needed when identity was verified through a recognised digital identification system such as iAM Smart (Schedule 2, section 9).
What does the HKMA's September 2026 circular change?
It replaces the 2019 remote on-boarding circular and the 2021 circular on iAM Smart, and covers stored value facilities as well as banks. Against deepfakes, it asks for identity authentication (document and data are genuine) and identity matching (customer linked to that identity beyond doubt), with account features scaled to risk.
Is a Companies Registry search enough to verify a Hong Kong company?
The SFC's guideline accepts a Companies Registry company report for name, legal form and current existence; the MSO guideline accepts a full company search report; the HKMA and Insurance Authority list an independent company registry record. A certificate of incorporation alone does not prove current existence.
Does iAM Smart remove the HK$10,000 deposit for investment accounts?
Yes. iAM Smart is one of the SFC's acceptable account opening approaches, so a client who verifies with it does not need the designated bank account route.
How do we verify beneficial owners?
Identify anyone with more than 25% of the shares or voting rights, or ultimate control, and verify them with reasonable, risk-proportionate measures. The company keeps its significant controllers register and the Registry does not publish it, so ask the customer for it and compare it with the ownership Fill Easy traces.
How do we verify a company incorporated outside Hong Kong?
With the equivalent record from its registry of incorporation: the SFC's guideline accepts a similar registry search there, or a certificate of incumbency. Fill Easy searches registries across 60+ jurisdictions, including the BVI and Cayman Islands, and returns each document with an English summary.
Can we onboard Mainland customers remotely?
Yes, from a passport or other identity document, or another reliable and independent source your policy accepts. Fill Easy verifies Mainland residents through China eID with a face check and their consent, returning the result to Hong Kong under its Standard Contract (Filing No. 202500031).
How long must we keep the records?
Throughout the business relationship and for at least five years after it ends; transaction records for five years after the transaction (Schedule 2, section 20). A regulator can ask for longer.