Precious Metals Dealer AML Internal Controls

貴金屬 AML 內部監控：香港交易商必須了解的監管框架

在香港，貴金屬及寶石交易商（DPMS）正面臨一套全新的反洗錢（AML）內部監控要求，這套要求自2023年4月1日起全面實施。根據香港海關的監管指引，任何交易商若有意在業務中進行總額為12萬或以上港元的非現金交易，必須註冊為A類註冊人；若同時涉及總額為12萬或以上港元的現金交易及非現金交易，則須註冊為B類註冊人，並須全面遵守《打擊洗錢及恐怖分子資金籌集條例》（第615章）下的打擊洗錢及恐怖分子資金籌集規定。

這項註冊制度由香港海關負責執行，旨在優化香港的AML/CTF監管制度，以履行香港在財務行動特別組織（FATF）的國際義務。對於現有交易商而言，若在2023年4月1日前已開始營運，可享有9個月的過渡期（即2023年4月至2023年12月）申請註冊；在過渡期內，這些交易商會被視為B類註冊人，直至其申請有結果或被撤回為止。

實務上，A類與B類註冊的關鍵差異在於是否涉及現金交易。A類註冊程序相對簡單直接，僅適用於不進行指明現金交易的交易商；而B類註冊則要求申請人通過「適當人選」評定準則，並證明符合附表2所訂的客戶盡職審查及備存紀錄等AML/CTF規定。若交易商未能達到這些要求，則只能申請A類註冊，且不能進行任何指明現金交易。

對於合規負責人及企業管理層而言，理解這套框架是建立有效內部監控的第一步。內部監控文件不僅是註冊的必備條件，更是持續合規的基礎，涵蓋風險評估、政策程序、培訓紀錄及監管通報等範疇。本文將深入剖析這些要求，協助交易商建立穩健的AML合規體系。

Who Should Prioritise AML Internal Controls for Precious Metals Dealers?

Any person or company that holds a valid Business Registration Certificate or a valid licence under the Hawker Regulation (Cap. 132AI) and intends to carry on a business as a dealer in precious metals and stones should assess whether the new AML internal control requirements apply to them. Under the regime administered by the Customs and Excise Department, a dealer that only conducts specified transactions (as defined in the legislation) and does not conduct specified cash transactions may apply for the simpler Category A registration. However, if the dealer conducts or intends to conduct specified cash transactions, it must apply for Category B registration. This distinction is fundamental because Category B registration carries significantly more onerous AML/CTF obligations, including the need to pass the fit and proper person criteria and to demonstrate compliance with the AML/CTF requirements set out in Schedule 2 to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), such as customer due diligence and record-keeping.

Key Planning Decisions for Compliance

Before applying for registration, dealers should make several strategic decisions. First, determine whether the business involves cash transactions that meet the specified threshold. If it does, Category B registration is mandatory, and the dealer must be prepared to implement a full AML internal control framework. Second, assess whether the business can operate under Category A registration by avoiding specified cash transactions altogether, which may reduce the compliance burden. Third, plan for the transition period: dealers that were already operating before the regime took effect on 1 April 2023 were given a nine-month transition period to apply for registration, during which they were deemed to be Category B registrants until their application was determined or withdrawn. This means that even dealers that intend to apply for Category A must initially operate under Category B obligations until their application is approved. Finally, note that any change in the details provided to Customs must be notified in writing within one month of the change, so internal procedures should include a mechanism for tracking and reporting such changes promptly.

Preparing for AML Compliance: Information to Gather Before You Act

Before a precious metals and stones dealer (DPMS) in Hong Kong begins to build or update its AML internal control framework, it must first gather a defined set of business and regulatory details. The Customs and Excise Department (C&ED) administers the registration regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), and the information you collect at this stage determines which registration class you may apply for and what obligations you must meet.

Step 1: Confirm Your Business Structure and Registration Eligibility

Under the C&ED’s guidance, any person or company holding a valid Business Registration Certificate or a valid licence under the Hawker Regulation (Cap. 132AI) may apply for registration as a DPMS. Therefore, before drafting your AML internal control documents, you should confirm that your entity holds the appropriate registration or licence. If you operate multiple premises, note that a “place of business” includes any premises where you carry on the precious metals and stones business, unless you are a hawker under the specific exemption in section 53ZVP of Cap. 615. This definition matters because your AML internal controls must cover every relevant location.

Step 2: Determine Whether You Conduct Specified Cash Transactions

The critical decision point is whether your business conducts specified cash transactions. According to C&ED’s FAQ, if you only conduct specified transactions (as defined in the legislation) and do not conduct specified cash transactions, you may apply for the simpler Class A registration. If you conduct or intend to conduct specified cash transactions, you must apply for Class B registration. This distinction is not merely administrative—it directly affects the depth of your AML internal control documentation. Class B applicants must pass the “fit and proper” criteria under sections 53ZUN and 53ZUO of Cap. 615 and demonstrate compliance with the AML/CTF requirements in Schedule 2, including customer due diligence and record-keeping. If you cannot meet those requirements, you may only apply for Class A and must not conduct any specified cash transactions.

Step 3: Review Your Existing AML/CTF Policies and Gaps

Once you know your class, you should review your current policies against the Schedule 2 requirements. For Class B, you must be able to show that your internal controls meet the statutory standards. This includes having clear procedures for customer due diligence, ongoing monitoring, and record retention. If you are a new applicant, you will need to design these controls from scratch. If you are an existing dealer that began operating before 1 April 2023, you may have benefited from the nine-month transitional period, during which you were deemed a Class B registrant until your application was decided or withdrawn. Now that the regime is fully in force, you must ensure your documentation is current and complete.

Step 4: Prepare for Ongoing Change Notifications

Finally, gather the details you will need to report changes to the C&ED. Under section 53ZVA, a registrant must notify the Customs and Excise Department in writing within one month of any change in the particulars provided at the time of registration or renewal. This means your AML internal control framework should include a mechanism for tracking and reporting changes in your business details, such as new partners, directors, or premises. Having this information organised from the outset will help you maintain compliance and avoid administrative lapses.

Step-by-Step: Building Your Precious Metals AML Internal Control Framework

Once you have gathered the necessary business details, the next step is to design and implement an AML internal control framework that meets the requirements of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) and the expectations of the Customs and Excise Department (C&ED). While the C&ED provides guidance and forms, the actual design of your controls must be tailored to your specific business model, transaction types, and risk profile. Below is a practical, step-by-step approach to building a compliant framework.

Step 1: Determine Your Registration Class and Scope of Obligations

Your first task is to confirm whether you need to register as a Category A or Category B registrant. According to the C&ED, a dealer that intends to conduct non-cash transactions of HK$120,000 or more must register as Category A. If you also intend to conduct cash transactions of HK$120,000 or more, you must register as Category B and comply with the full AML/CTF requirements under Cap. 615. This distinction shapes the depth of your internal controls: Category B registrants must implement comprehensive customer due diligence, record-keeping, and reporting procedures, while Category A registrants may have a narrower set of obligations.

Step 2: Conduct a Business-Wide Risk Assessment

Before writing policies, assess the money laundering and terrorist financing risks inherent in your business. Consider factors such as the types of precious metals and stones you trade, the profiles of your customers, the jurisdictions you deal with, and the payment methods you accept. This risk assessment should be documented and used to inform the design of your controls. The C&ED’s guidance materials and the self-assessment tool on its website can help you evaluate your readiness, but the actual risk assessment must be specific to your operations.

Step 3: Draft Your AML/CTF Policies and Procedures

Your internal control framework should be codified in a written policy document that covers at least the following areas: customer due diligence (including identification and verification of customers and beneficial owners), ongoing monitoring of business relationships, record-keeping, reporting of suspicious transactions, and internal reporting lines. For Category B registrants, these policies must align with the detailed requirements of Cap. 615, Schedule 2. Ensure that your policies are practical and that staff can follow them in day-to-day operations.

Step 4: Implement Operational Controls and Staff Training

Policies are only effective if they are operationalised. This means assigning clear responsibilities to a compliance officer, establishing procedures for verifying customer identities, and setting up systems for monitoring transactions. Regular training is essential to ensure that all staff understand their obligations under your AML/CTF framework and can recognise red flags. The C&ED’s guidance notes emphasise the importance of a robust compliance culture, so training should be documented and refreshed periodically.

Step 5: Maintain Records and Prepare for Inspections

Cap. 615 requires you to keep records of customer due diligence and transactions for a specified period (as set out in the ordinance). Your record-keeping system should allow you to retrieve information quickly in response to a C&ED inspection. The C&ED conducts compliance visits and investigations, so your internal controls must be demonstrable and your records readily accessible.

Step 6: Review and Update Your Framework

AML risks evolve, and so should your controls. Schedule periodic reviews of your AML/CTF framework to ensure it remains effective and up-to-date with any changes in the law or your business activities. The C&ED may also issue new guidance or circulars, so stay informed. A proactive approach to updates will help you maintain compliance and avoid regulatory pitfalls.

Essential Documentation and Evidence for Your Precious Metals AML Internal Control File

To demonstrate compliance with the AML internal control requirements under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), a precious metals and stones dealer (DPMS) must maintain a well-organised documentation file. This file serves as evidence that the dealer has implemented the required controls and can be reviewed by the Customs and Excise Department (C&ED) during inspections. The following checklist outlines the key documents and evidence categories that should be in place.

1. Registration and Licensing Records

Your file should include proof of your registration status with the C&ED. For a B-class registrant, this includes the application form and any correspondence with the C&ED. If you are applying for registration, keep copies of the self-assessment results and the online application submission confirmation. The C&ED provides a self-assessment tool that takes approximately 5 to 10 minutes to complete, and the results indicate whether you need to apply for A-class or B-class registration. Retain these records to show that you have correctly determined your registration obligations.

2. Fit and Proper Person Declarations

For B-class registrants, the application must satisfy the “fit and proper” criteria under sections 53ZUN and 53ZUO of Cap. 615. Therefore, your file should contain the relevant declarations for individuals and corporations, such as Form 3A (Fit and Proper Person Declaration for Individual) and Form 3B (Fit and Proper Person Declaration for Corporation). These forms are part of the application process and demonstrate that the key persons behind the business meet the regulatory standards.

3. Customer Due Diligence (CDD) Records

Under Schedule 2 of Cap. 615, B-class registrants must conduct customer due diligence. Your file should include copies of identification documents, beneficial ownership information, and the purpose of the business relationship. For each customer, retain the CDD records and any updates made when changes occur. This evidence shows that you have implemented the required CDD measures.

4. Transaction Records and Cash Transaction Reports

For B-class registrants, it is mandatory to keep records of all specified transactions, including cash transactions of HK$120,000 or more. Your file should include detailed transaction logs, and if applicable, the cash transaction reports submitted to the C&ED through the designated online system. These records are critical for demonstrating that you are monitoring and reporting as required.

5. Internal Policies, Procedures, and Training Logs

Your AML internal control framework should be documented in a written policy manual. This manual should outline your risk assessment approach, CDD procedures, record-keeping practices, and reporting mechanisms. Additionally, maintain training logs that show your staff have received AML training. These documents prove that your controls are not just on paper but are actively implemented and communicated.

6. Notification and Change Records

Under section 53ZVA, if there are any changes to the details provided to the C&ED, you must notify them in writing within one month. Therefore, your file should include copies of any notifications submitted, such as changes in directors, partners, or business premises. This demonstrates your ongoing compliance with the reporting obligations.

Maintaining a complete and current documentation file is not just a regulatory requirement; it is a practical tool for managing your AML risks. By keeping these records organised, you can respond efficiently to C&ED inspections and ensure that your business remains in good standing.

Common Compliance Gaps and How to Address Them in Your Precious Metals AML Internal Control Framework

Even after a precious metals and stones dealer (DPMS) has registered with the Customs and Excise Department (C&ED) and built an AML internal control framework, practical gaps often remain. Understanding these gaps helps you strengthen your controls before an inspection or before a transaction triggers a review. Below are common scenarios and decision points that Hong Kong dealers face under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615).

Gap 1: Treating A-Class Registration as a Lower Compliance Burden

A common misconception is that A-Class registration means fewer AML obligations. In reality, A-Class is only available to dealers who do not conduct specified cash transactions. If your business later decides to accept cash for a transaction of HK$120,000 or more, you must upgrade to B-Class registration and meet the full AML/CTF requirements under Schedule 2 of Cap. 615. The C&ED’s FAQ clarifies that a dealer who fails to meet these requirements can only apply for A-Class and cannot conduct any specified cash transactions. Therefore, your internal controls should include a trigger mechanism to reassess your registration class whenever your business model changes.

Gap 2: Overlooking the One-Month Notification Obligation

Under section 53ZVA of Cap. 615, a registered person must notify the C&ED in writing within one month of any change in the details provided during registration or renewal. This is a frequent compliance gap because dealers may change business addresses, add new branches, or alter their business structure without realising the notification duty. Your internal control framework should assign responsibility for tracking such changes and include a checklist to ensure timely notification.

Gap 3: Inadequate Record-Keeping for Non-Cash Transactions

While cash transactions often receive more attention, non-cash transactions of HK$120,000 or more also trigger registration and AML obligations. Dealers may fail to keep sufficient records for wire transfers, bank drafts, or other non-cash payments. The C&ED’s guidance requires all specified transactions to be properly documented. Your internal controls should cover both cash and non-cash transactions, with clear procedures for recording customer due diligence (CDD) information and transaction details.

Gap 4: Failing to Update the AML Framework After the Transition Period

The transition period for existing dealers ended in December 2023. Dealers who were deemed B-Class registrants during that period must now have their applications fully processed. If your application was approved, you must ensure your ongoing AML controls are fully operational. If it was refused, you must stop conducting specified cash transactions immediately. Your internal control framework should include a review step to confirm your current registration status and align your operations accordingly.

Decision Point: When to Seek Professional Assistance

Building and maintaining a compliant AML internal control framework is not a one-time task. If you are unsure whether your controls meet the C&ED’s expectations, or if you are preparing for a B-Class application, professional assistance can help you review your policies, identify gaps, and prepare the necessary documentation. Given the legal consequences of non-compliance—including fines and imprisonment for unlicensed operation—it is prudent to invest in a robust framework from the start.

Common Mistakes in Precious Metals AML Internal Controls and How to Avoid Them

Even after a Hong Kong precious metals and stones dealer (DPMS) has registered with the Customs and Excise Department (C&ED) and implemented an AML internal control framework, certain recurring mistakes can undermine compliance. Recognising these pitfalls helps you strengthen your controls before an inspection or before a transaction triggers a review.

Mistake 1: Treating A-Class and B-Class Registration as Interchangeable

A frequent error is assuming that a single set of AML controls suffices for both registration classes. Under the regime, a dealer that only conducts specified transactions (i.e., non-cash transactions of HK$120,000 or more) may apply for the simpler A-Class registration. However, if the dealer conducts or intends to conduct specified cash transactions, B-Class registration is mandatory, and the dealer must meet the full AML/CTF requirements under Schedule 2 of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), including customer due diligence and record-keeping. Dealers that fail to meet these requirements may only apply for A-Class and cannot conduct any specified cash transactions. Therefore, your internal controls must be calibrated to the class you hold or seek.

Mistake 2: Overlooking the Fit and Proper Person Assessment

For B-Class applicants, the Customs and Excise Department applies the fit and proper person criteria under sections 53ZUN and 53ZUO of Cap. 615. Some dealers focus solely on transaction monitoring and neglect to ensure that all partners, directors, and ultimate owners meet these criteria. This oversight can delay or jeopardise registration. Your AML internal control framework should include a process for assessing and documenting the fitness of all relevant individuals, and for notifying the C&ED of any changes within one month, as required under section 53ZVA.

Mistake 3: Incomplete Record-Keeping for Cash Transactions

B-Class registrants must maintain robust records for all specified cash transactions. A common gap is failing to capture sufficient detail to demonstrate compliance during an inspection. Your internal controls should specify what records to keep, how long to retain them, and who is responsible for their accuracy. The C&ED’s guidance emphasises that dealers must be able to show they have met the statutory record-keeping obligations.

Practical Next Steps for Strengthening Your AML Internal Controls

To avoid these mistakes, take the following practical steps:

• Conduct a self-assessment using the C&ED’s online tool, which takes approximately 5–10 minutes, to determine whether you need A-Class or B-Class registration and to gauge your readiness. The tool will indicate if you are “well prepared and eligible,” “moderately prepared and eligible,” or “less prepared/not eligible.”
• Review your business activities to confirm whether you conduct any specified cash transactions. If you do, ensure your AML controls fully align with B-Class obligations.
• Establish a documented process for fit and proper person assessments, and update the C&ED within one month of any change in registration particulars.
• Maintain a compliance file that includes your AML policy, risk assessment, customer due diligence records, and staff training logs. This file will be your first line of defence during a C&ED inspection.

By addressing these common mistakes and following these next steps, your precious metals AML internal controls will be better positioned to meet the expectations of the Customs and Excise Department and to support your registration status under Cap. 615.

Conclusion: Building a Durable Precious Metals AML Internal Control Framework

Establishing a robust AML internal control framework is not a one-off exercise but an ongoing commitment for precious metals and stones dealers in Hong Kong. The Customs and Excise Department (C&ED) administers the registration regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), and the distinction between A and B registration is central to your obligations. As the C&ED’s FAQs clarify, if you only conduct specified transactions without specified cash transactions, you may apply for the simpler A registration. However, if you conduct or intend to conduct specified cash transactions, you must apply for B registration, which requires passing the fit and proper person criteria and demonstrating compliance with the AML/CTF requirements in Schedule 2, including customer due diligence and record-keeping.

For dealers who cannot meet these Schedule 2 requirements, the C&ED notes that they may only apply for A registration and cannot conduct any specified cash transactions. This reinforces the need to assess your business model honestly and choose the correct registration class from the outset. Additionally, remember that any changes to the details you provided to the C&ED must be notified in writing within one month of the change, as required under section 53ZVA. Keeping your registration information current is a simple yet critical part of maintaining compliance.

Ultimately, a well-designed AML internal control framework protects your business from regulatory risk and contributes to the integrity of Hong Kong’s financial system. By understanding the registration requirements, implementing appropriate controls, and maintaining thorough documentation, you position your firm to operate confidently within the legal framework.