Why the HKMA’s September 2026 Remote Onboarding Circular Turns Account Limits Into a Monitoring Control

The HKMA remote onboarding circular reads as an anti-fraud and monitoring document as much as an identity one. On 3 September 2026 the Hong Kong Monetary Authority wrote to all authorised institutions and stored value facility (SVF) licensees to update its expectations for remote onboarding of individual customers. The circular supersedes the HKMA’s circulars of 1 February 2019 and 24 May 2021.

Its premise is that remote onboarding is now an integral part of AML/CFT controls, and that AI-driven automation and deepfake technology have raised the potential for impersonation, online fraud and the mule-account networks that follow, at much greater scale. The circular sets no deadline, but it asks for a comprehensive review of remote onboarding solutions and of the systems and oversight around them.

For a monitoring team the notable sentence is not about identity. It says a tiered approach lets account features, functionality and transaction limits be scaled dynamically and adjusted to actual usage and ongoing customer behaviour. That is a monitoring decision made at product level, and it needs an owner.

The circular’s two principles feed a tiering decision, and ongoing behaviour feeds the tiers back, so onboarding and monitoring work as one chain.

What the circular changes for remote onboarding

The circular sets two core principles that remote onboarding solutions must stay effective and compliant with through a continual programme of updates and recalibration. Identity authentication means taking appropriate measures so that the document, data or information obtained is reliable, including using technology to ascertain the genuineness of the identity document. Identity matching means using technology to link the customer incontrovertibly to that identity.

The circulars on remote onboarding of corporate customers (24 September 2020) and on feedback from thematic reviews of remote onboarding controls (3 June 2020) continue to apply and are to be read with it. It is a letter setting out the HKMA’s regulatory expectations, not legislation.

Why onboarding evidence becomes a monitoring signal

The HKMA’s June 2026 report on AI in fighting financial crime shows what this looks like in practice. It notes that remote account opening reached 74% of all accounts opened in the fourth quarter of 2025. In one case study a digital bank found the same unknown individual in the facial images of several fraudulent account holders, added images of the suspected controller to an internal watch list, and reported cutting transaction monitoring alerts by 25% because bad actors were stopped at the door. In another a large bank built an application engine that returns pass, reject or review at onboarding and used review outcomes to tune its models.

These outcomes are reported by the banks in the HKMA publication and have not been independently verified.

Tiered limits as a control that moves with behaviour

The circular’s tiering example treats limits as a live setting. A customer opens an account at a tier set from the assessed ML/TF risk profile, behaviour is observed, and limits widen or tighten. The circular does not say who decides, how quickly, or how the reason is recorded. Those are matters for the bank’s own policy, and they are the points at which onboarding, fraud and AML teams share a decision.

Mule networks sit across fraud and AML

The circular links deepfakes to mule-account networks. In the June 2026 report a large bank describes a business-led ‘Two Masters Model’ in which prevention tools freeze payments in near real time while investigation teams support, and in which a customer risk score can trigger a due diligence review, an unusual activity report or payment controls. The report says a machine learning model re-rated 42% of customers from medium to high risk, and that 70% of these customers were escalated and 40% exited. The bank reported these figures itself.

Four questions for the review the HKMA has asked for

The circular asks authorised institutions and SVF licensees to review their remote onboarding solutions and the systems and oversight around them, taking account of the latest intelligence shared by the HKMA and the Hong Kong Police Force. Four questions turn that into evidence.

How Nexiant supports onboarding-to-monitoring design

FraudShield, Nexiant’s specialist transaction-monitoring brand, is built around real-time detection, configurable rule logic and case-management workflows. For onboarding-to-monitoring design, the useful tests are whether onboarding outcomes can be attached to the customer record that monitoring uses, whether a limit change can be driven by a documented rule, and whether investigation outcomes can return to rule configuration. Nexiant brings these questions together across identity, fraud and anti-money laundering as a design discipline, not as a claim about one integrated system.

Frequently Asked Questions

This article was accurate at the time of publication in October 2026 and is intended for general informational purposes only. It does not constitute legal, regulatory or compliance advice. Organisations should seek qualified professional guidance in relation to their specific obligations.