HKMA rewrites remote on-boarding rules for individual customers, citing deepfake fraud
The HKMA has updated its expectations for remotely on-boarding individual customers, replacing two earlier circulars. It restates two core principles for identity authentication and matching, warns specifically about deepfake-enabled impersonation and mule accounts, and tells authorized institutions and stored value facility licensees to review their systems against intelligence shared with the Hong Kong Police Force.
- The circular supersedes the HKMA's remote on-boarding circulars of 1 February 2019 and 24 May 2021 for individual customers.
- The 2020 corporate on-boarding circular and the June 2020 thematic-review feedback circular remain applicable and should be read alongside this letter.
- Firms must satisfy two core principles: verifying the genuineness of identity documents and incontrovertibly linking the customer to that identity.
- The HKMA cites deepfake technology, AI-driven automation and mule-account networks as escalating ML/TF threats to remote on-boarding.
- AIs and SVF licensees are told to conduct a comprehensive review of remote on-boarding solutions, systems and oversight.