Hong Kong Tightens Digital Bank Account Fraud and AML Defences

Hong Kong has outlined how banks should prevent criminals from opening accounts in other people’s names and exploiting them to move illicit funds. Responding to a Legislative Council question on October 21, 2026, the Government described safeguards around remote onboarding, facial recognition and transaction monitoring. Officials also explained why banks will not be granted access to telecom operators’ real-name SIM registration records under the current framework. Instead, the response emphasised stronger in-app authentication, deepfake detection and a trial integrating the government-backed iAM Smart service into digital account opening.

Hong Kong remote account opening controls target identity theft

The Legislative Council question described a specific method of abusing mobile account opening. It said that in a number of money laundering cases, individuals, including foreign domestic helpers and older people, had claimed accounts were created without their knowledge. According to that account, offenders obtained identity cards and personal information, supplied bank applications with telephone numbers under their own control and induced the victims to complete facial recognition under misleading circumstances. The account holders’ claims and the question’s description of criminal methods should not be confused with adjudicated findings against any named bank or individual.

The concern is not merely whether a face matches an identity document. A biometric comparison can be technically successful even when a person misunderstands the purpose of the interaction or is being manipulated by someone nearby. The question therefore asked whether banks would be required to show clearer account-opening messages on facial recognition screens, including accessible language the purpose of the process. That question goes to customer awareness and meaningful consent rather than image-matching accuracy alone.

The Government replied that the Hong Kong Monetary Authority already requires banks to identify and verify applicants effectively. Technologies may include document-authenticity checks and facial recognition to confirm that the applicant corresponds to the presented identity card. Importantly, it pointed to additional HKMA guidance issued in 2023, which called for clear on-screen notices that selfies or liveness checks are being collected for an account opening application. The statement describes an existing expectation, not the announcement of an entirely new duty on October 21.

Authorities also stressed that identity verification must be accompanied by continuing vigilance after onboarding. Banks are required to undertake ongoing due diligence, monitor account activity and report suspicious transactions to law enforcement. These measures are essential because an initially plausible application does not establish that later transfers reflect legitimate use. From a risk-management perspective, the case illustrates why onboarding controls and post-opening activity analysis must reinforce one another rather than operate as separate compliance exercises.

Stooge account risks expose weaknesses beyond facial recognition

The account-opening scenario illustrates how stolen personal information, manipulated biometric checks and control of a mobile number can combine to create an apparent customer relationship. Once access has been established, a third party may be able to receive verification codes or direct transfers through an account held in somebody else’s name. The legislative question identified this as a potential route for stooge accounts to receive or launder criminal proceeds. It did not provide a total number of cases, losses or completed laundering transactions, and none should be inferred from the description.

Such patterns pose a distinct challenge for customer due diligence. Traditional checks establish that identification information is authentic and that a living person matches the document. But those tests alone may not establish who arranged the application, who understands its financial consequences or who will exercise practical control over the account afterward. Banks should therefore interpret successful remote verification within the wider set of evidence available, including device registration, information, account behaviour and unusual changes to customer settings.

The question also sought a stronger link between a banking customer’s identity and the ownership of the telephone number registered to the account. Hong Kong’s real-name SIM scheme was implemented in 2023, yet the Government said that the associated data are retained in the systems of telecommunications operators. Sections 12 and 13 of the relevant regulation permit access by designated law enforcement officers for crime prevention or investigation. They do not empower banks to inspect those records to check that an applicant owns a linked telephone number.

That legal restriction matters for interpreting the official response. The Government expressly said it has no current plan to authorise bank access to the SIM records, particularly as the HKMA is reducing dependence on SMS one-time passwords. It would therefore be inaccurate to describe the as a promise of mandatory phone-number ownership checks through a telecom database. The stated direction is to reduce the value of intercepted or fraudulently controlled SMS messages, while continuing identity assurance and monitoring throughout the customer relationship.

In-app verification and deepfake defences reshape safeguards

Banks have introduced in-app authentication in line with HKMA requirements, according to the Government. For customers who have installed their bank’s application, the approach is used for internet banking access and higher-risk actions, including registering new payees, increasing transfer limits or changing the telephone number used for bank communications. Binding an internet banking profile to a mobile device also requires facial recognition. These arrangements are designed to reduce opportunities for someone holding stolen credentials and SMS codes to initiate unauthorised transactions.

There is a meaningful difference between receiving a code on a telephone number and approving an action through an authenticated banking application. The latter can provide a stronger association with an enrolled device and an established banking session, although it does not eliminate all social engineering or device-compromise risks. This distinction is analytical: the Government’s release describes the controls and their intended preventive effect, not a guarantee that every attack route is closed or that all institutions deploy identical workflows.

The Government linked the response to the HKMA’s August 2025 e-Banking Security ABCD initiative. Its deepfake-detection component shares practices for protecting facial recognition, including remote account opening and high-risk transactions. The published HKMA material covers more robust liveness checks, secure camera capture, image analysis, digital-footprint monitoring, manual review and regular effectiveness assessments. These controls address different failure points, from manipulated video inputs to abnormal behaviour after an apparently valid biometric result.

A further development concerns iAM Smart, Hong Kong’s digital identity service. The HKMA is working with the Digital Policy Office and banks to incorporate step-up authentication into critical banking processes. Facial recognition combined with reading identity-card chips is intended to make impersonation using stolen or false documents more difficult. The Government said that first-phase testing for remote account opening had commenced, with expansion to other areas dependent on assessments of security, stability and customer experience. It did not announce general completion or a mandatory sector-wide launch date.

Why layered identity assurance matters for AML effectiveness

The policy choice is best understood as a combination of identity proofing, authentication and financial-crime surveillance. Identity proofing asks whether the applicant is who the documents say they are and whether the process is authentic. Authentication asks whether subsequent access and high-risk instructions originate from the legitimate user. Transaction monitoring examines whether the account’s actual activity aligns with its expected profile and whether suspicious conduct warrants escalation. A failure in any one of these layers can weaken the combined protection, particularly when criminals exploit both human manipulation and technical vulnerabilities.

For compliance teams, the relevant analytical question is how evidence from these layers is connected. A questionable onboarding session, a newly enrolled device, a rapid change in transfer limits and unusual incoming or outgoing activity could each be relevant to an investigation, depending on context. None of these signals is proof of money laundering by itself. Effective controls require proportionate assessment, escalation criteria, case documentation and safeguards against wrongly treating vulnerable or inexperienced customers as offenders.

The Legislative Council exchange also highlights the importance of accurately distinguishing current rules from proposals. Clear prompts during selfie and liveness checks were discussed as part of the HKMA’s 2023 guidance. In-app authentication and deepfake practices are already features of the regulator’s broader approach. SIM-registration database access for banks was explicitly rejected as a current plan, while iAM Smart’s enhanced account-opening verification remained at the testing stage. Treating all four items as newly enacted requirements would materially misstate the announcement.

The wider AML/CFT lesson is that remote onboarding must be evaluated for its resistance to impersonation, coercion and downstream misuse, not merely for its speed or success rate. Firms can test whether applicants understand what they are authorising, whether suspicious device or identity patterns are detected, and whether monitoring responds when an account behaves like a payment conduit. These are practical analytical considerations, not new obligations created by this particular statement. Hong Kong’s response shows how regulators can address misuse of digital banking through layered controls while remaining within statutory limits on access to personal telecommunications data.

Hong Kong identified risks of stolen identities being used for remote bank account opening and subsequent laundering.

HKMA guidance from 2023 addresses clear prompts during selfie and liveness checks.

Banks are moving toward in-app authentication rather than relying on SMS one-time passwords.

Banks are not authorised to access telecom real-name SIM registration records, and no such access is planned.

iAM Smart step-up authentication for remote account opening is in first-phase testing.

Frequently Asked Questions

What prompted the October 21 statement?

A Legislative Council member asked how banks could prevent accounts being opened without the knowledge of the people named as holders. The question focused on identity theft, deceptive facial recognition and the use of accounts to move illicit funds.

Did Hong Kong announce a new fine or penalty?

No new fine or penalty was announced in the Government . The statement addressed supervisory safeguards and ongoing security initiatives.

Do banks have to explain the purpose of selfie checks?

The Government pointed to HKMA guidance issued in 2023 calling for clear on-screen notices during remote opening. Customers should be made aware that selfies or liveness checks are connected to an account application.

Can banks access real-name SIM registration records?

The Government said current legislation does not authorise banks to access these telecom registration records. It also stated that there are no current plans to grant them that access.

Why is Hong Kong reducing reliance on SMS codes?

SMS one-time passwords can be compromised when criminals obtain credentials or control the relevant phone number. In-app authentication is intended to provide stronger verification for access and high-risk actions.

What is the role of deepfake detection?

The HKMA has published practices for strengthening face verification against manipulated images and video. These include liveness testing, secure image capture and monitoring for suspicious patterns.

Has iAM Smart verification been fully rolled out?

No sector-wide completion was announced. The Government said that a first phase of testing for remote account opening had already started.

What should AML teams take from this case?

Remote identity verification should be assessed alongside device controls and continuing transaction monitoring. An apparently successful biometric check does not, on its own, rule out manipulation or later account misuse.

HKMA: Account Opening and Maintenance

HKMA: E-Banking Security ABCD Circular

HKMA: Good Practices for Countering Deepfake Attacks

Hong Kong Government: Measures to Combat Telephone Scams

Other FinCrime Central Articles on Hong Kong Banking

HKMA, HKPF, and HKAB Unveil Strong Measures to Combat Money Laundering and Mule Accounts

The Rise of Mule Accounts as a Service

DBS Hong Kong Enhances SME Compliance via AI Verification Technology

HKMA Enhances ATM Security with Expanded Suspicious Account Alerts

Source: Hong Kong Government: LCQ1 Improving online bank account opening, October 21, 2026

Some of FinCrime Central’s articles may have been enriched or edited with the help of AI tools. It may contain unintentional errors.

Want to promote your brand, or need some help selecting the right solution or the right advisory firm? Email us at [email protected]; we probably have the right for you.

The Latest Curated Fincrime & AML/CFT News Delivered every Sunday morning at 10am