Anti-Money Laundering and Counter-Terrorist Financing Ordinance and Guideline (GL3) 《打擊洗錢及恐怖分子資金籌集條例》及《打擊洗錢及恐怖分子資金籌集指引》（指引 3）
Schedule 2 to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) sets customer due diligence and record-keeping requirements. The IA's GL3 helps insurance institutions and intermediaries conducting or advising on long-term business establish suitable systems. Departures and their reasons should be recorded and justifiable to the regulator. Failure to follow GL3 does not itself create liability to judicial or other proceedings, but GL3 is admissible in AMLO proceedings and courts must consider relevant provisions. Non-compliance may also affect fitness and properness and lead to disciplinary action. [IA: GL3](https://www.ia.org.hk/en/legislative_framework/files/GL3_ENG.pdf)
Money laundering seeks to conceal the criminal origin of proceeds. Its three common stages are placement, introducing criminal cash into the financial system; layering, obscuring its source and audit trail through complex transactions; and integration, making criminal wealth appear to come from legitimate business. Single-premium contracts, returned premiums and premium overpayments can be exploited, although their presence alone does not prove crime. Terrorist financing involves supporting terrorist acts, terrorists or terrorist associates, and the funds may have legitimate or illegitimate origins.
The risk-based approach requires enhanced measures for higher risks; simplified measures may be used for lower risks where applicable requirements permit, alongside ongoing monitoring. Systems should include management oversight, a Compliance Officer and Money Laundering Reporting Officer, independent audit, employee screening and ongoing training. Individual agents who pass documents to an insurer remain responsible for compliant record-keeping and regulatory access without delay. If local law prevents a Hong Kong-incorporated institution's overseas branches or subsidiaries conducting the same business from meeting similar due diligence and record-keeping requirements, it must inform the IA and take additional risk-mitigation measures.
Institutions should update databases of terrorist suspects and designated parties, screen customers and payments on an ongoing basis, and record results. Restrictions on funds or property under the United Nations Sanctions Ordinance and United Nations (Anti-Terrorism Measures) Ordinance may have exceptions authorised by the appropriate licence. Once knowledge or suspicion of money laundering, terrorist financing or terrorist property arises, disclosure to the Joint Financial Intelligence Unit should be made as soon as reasonably practicable, even without a completed transaction. Staff should follow internal reporting procedures and avoid tipping off, including revealing a report or investigation through enquiries to customers.
Personal Data (Privacy) Ordinance (PDPO) 《個人資料（私隱）條例》 (PDPO)
The PDPO protects living individuals' privacy in relation to personal data, and the Privacy Commissioner for Personal Data monitors and supervises compliance. Personal data must satisfy three conditions: it relates directly or indirectly to a living individual; that individual can practicably be identified directly or indirectly from it; and it exists in a form that can practicably be accessed or processed. A data user controls its collection, holding, processing or use, while the data subject is the individual concerned. Electronic medical records identifying a living policyholder therefore qualify. [PCPD: Ordinance at a Glance](https://www.pcpd.org.hk/english/data_privacy_law/ordinance_at_a_Glance/ordinance.html?f=478)
Schedule 1 to the PDPO contains six data protection principles. Principle 1 governs collection: the purpose must be lawful and directly related to the data user's functions or activities; collection must be necessary or directly related to that purpose, and the data adequate but not excessive. Collection must also be lawful and fair. Individuals should be told the purposes, classes of possible recipients, and access and correction rights. Principle 2 requires accurate, up-to-date data retained only as long as necessary, rather than indefinitely merely because it has been collected.
Principle 3 distinguishes the original purpose, or a directly related purpose, from a new purpose. Unless a statutory exemption applies, a new purpose generally requires the data subject's prescribed consent: express consent given voluntarily, rather than consent inferred merely from silence. Principle 4 requires all practicable steps to protect data against unauthorised or accidental access, processing, erasure or other use. Keeping information secure does not give permission to change its purpose freely.
Principle 5 requires openness about personal data policies and practices, including the kinds of data held and their uses; it does not require public disclosure of customer records. Principle 6 gives individuals access to their own data and correction of inaccuracies. A data processor acts on another's behalf without using the data for its own purposes. Whether that processor is in Hong Kong or overseas, the data user must use contractual or other means to prevent excessive retention and safeguard security; outsourcing does not remove these responsibilities. [PCPD: Data Protection Principles](https://www.pcpd.org.hk/english/data_privacy_law/code_of_practices/files/PCPD_HR_Booklet_Eng_AW07_Web.pdf)
Practice
8 practice questions · Progress is shared with full-paper practiceLoading questions…
Keys: 1–4 to choose, Enter to check / next, ← → to move