Hong Kong fines WeChat Pay HK for AML/CFT breaches

The company was fined HK$875K by the Hong Kong Monetary Authority, in an effort to send a strong warning to the industry

WeChat Pay HK was fined HK$875,000 by the Hong Kong Monetary Authority (HKMA) due to breaches in anti-money laundering (AML) and counter-financing terrorism (CTF) laws.

With this fine, the HKMA is sending a strong message to the industry that it is taking AML / CTF risk mitigation measures seriously. The authority did take into account WeChat Pay’s remedial measures and its cooperation with the investigation.

What happened?

The HKMA began investigating WeChat Pay after a self-report. It found that between August 2016 and October 2021, the company did not have adequate systems of controls in place to allow it to comply with AML/CFT guidelines.

These deficiencies were found to impact the company in two areas. The first was in its ability to conduct customer due diligence (CDD) reviews when needed. The second was in its application of enhanced due diligence (EDD) measures in high-risk situations to mitigate and manage the situation that could indicate a high money laundering and terrorist financing risk.

The shortcomings were specifically related to the requirements set out in the Payment Systems and Stored Value Facilities Ordinance (PSSVFO).

Raymond Chan, executive director of the HKMA, stated, “SVF [Stored Value Facility] licensees should apply enhanced due diligence measures on their customers in situations involving potentially high risk of money laundering and terrorist financing. These enhanced due diligence measures should be effective in ensuring that the associated money laundering and terrorist financing risks are properly managed.”

Importantly, the company has no previous disciplinary record and was cooperative in resolving the issues. But the fine underscores the critical importance of maintaining effective AML/CFT controls.

The VinciWorks Training Suite for Hong Kong is accredited by the Law Society of Hong Kong.

Learn more about VinciWorks Hong Kong Training Suite

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”