The Authority conducted an on-site inspection covering the period March 2016 to October 2022. During that inspection it was discovered that the computerised "regtec" or Regulatory Technology system did not perform correctly.

In particular, defects in "the manner in which the Company’s Hong Kong branch had implemented and was using its anti-money laundering system and associated algorithm", as a result of which "not all customers (or the beneficial owners of its customers) who were politically exposed persons (PEPs) had been picked up in the screening “alert” processes.

The Authority has said that no one who should not have been accepted as a customer was, in fact, accepted raising the question as to what, exactly, the Authority is concerned about. The only explanation for that might be that the Authority gave no credence to any fail-safes in the company and considered it to be at best fortuitous that such applications did not proceed. That, it is here opined, is not a fair approach.

So what, specifically, did the Authority decide were the harms?

"The system issues identified resulted in delays in the Company’s Hong Kong branch establishing their source of funds/wealth and obtaining the requisite senior management approval as required by the Anti Money Laundering, etc. Ordinance. Certain customers assessed by the [computerised] system as being “high risk” had also not been subjected to enhanced due diligence in a timely manner and it was identified that improvements were needed in the monitoring processes for suspicious transactions in the Company’s Hong Kong branch."

So the real issues were:

1. RegTech failed; and
2. Exception reports that the tech did in fact identify were not dealt with promptly.

Even though no adverse consequences flowed i.e. no undesirable accounts were opened and no money laundered, etc., the technical regulatory breaches created culpability.

Further Reading:

Full notice - https://www.ia.org.hk/en/infocenter/press_releases/20240802.html