Approved Manager FAQs · 5/7

Establish workable AML/CFT arrangements based on actual services, customers and risks, covering risk assessment, CDD, ongoing monitoring, internal reporting, training and records. A specific compliance-officer or manual exemption for an Approved Manager does not remove AML obligations. The frequency of board review should be risk-based, rather than presented as a uniform annual requirement.

Risk warning:Mistaking a specific exemption for a blanket exemption from AML obligations.

KYC procedures should specify customer identity verification, BO tracing, information reliability and risk categorization, and retain the basis for verification. It is advisable also to establish procedures for missing, unusual and updated information. Required documents should be proportionate to the customer type and risk; a single document checklist should not be treated as a statutory standard applicable to all customers.

Risk warning:Collecting documents without verifying their contents may result in the actual controller being overlooked.

CDD should cover the identification and verification of the customer and BO, the nature of the business, and the purpose of the relationship or transaction, and should include risk-based inquiry into source of funds and ongoing monitoring. Retain evidence of information, judgments, and handling of unusual matters. The depth and frequency of reviews should reflect risk and changes in information; do not apply the same fixed cycle to all customers.

Risk warning:If customer information is not reconciled with actual transactions, suspicious activity may go unidentified.

For high-risk customers, enhanced verification, source-of-funds analysis and ongoing monitoring should be conducted, and risk-mitigation measures documented. It is advisable to set management escalation and acceptance criteria according to risk. Specific approvals, depth of information and monitoring frequency depend on applicable rules and the case; simply increasing the number of documents does not complete EDD.

Risk warning:EDD that amounts merely to requesting additional documents may fail to resolve concerns about the source of funds.

Unusual or suspicious activity should be reported promptly to the MLRO internally, so that the MLRO can investigate and determine whether a report to the FIA is required. Any external report should set out the relevant facts, grounds for suspicion and supporting material, with access restricted to those who need to know. The applicable rules in force should be followed for the reporting threshold, channel and timing; no fixed deadline should be stated without verification.

Risk warning:Waiting for complete criminal evidence before escalating may delay reporting.

The MLRO’s core responsibilities are to receive internal suspicious-activity reports, investigate them and determine whether to report to the FIA, while retaining records of the assessment and decision. Training, general compliance oversight and liaison with authorities may be allocated under governance arrangements, but the MLRO and CO must not automatically be treated as the same role. Reporting arrangements must not be overlooked because of an Approved Manager exemption.

Risk warning:A nominal appointment without access to information may render reporting mechanisms ineffective.

Records should be retained to support due-diligence review, transaction traceability and regulatory investigations, but SIBA alone should not be taken to establish that all Approved Manager records must be kept for five years. Manage CDD, transaction, internal-reporting and regulatory-filing evidence by category, and confirm the applicable retention period, start date and investigation-related preservation requirements for each under current AML materials.

Risk warning:Applying a single deadline to destroy records may result in a lack of evidence.

Training should be proportionate to roles and risks, covering customer due diligence, unusual-activity identification, internal reporting, sanctions and confidentiality controls. It is advisable to distinguish training for new employees, business personnel, the MLRO and management, and to retain attendance, test and refresher-training records. The update frequency should reflect business changes and identified deficiencies; annual training should not be presented as a uniform statutory requirement.

Risk warning:Attendance records alone may not demonstrate that personnel have the capability to perform their duties.

Restrict access to relevant reporting materials, avoid disclosing reports or investigation information to the customer involved, and retain records of secure handling. Whether a reporter receives legal protection, and the conditions and exceptions to that protection, must be assessed under applicable law; absolute confidentiality or a legal exemption for every report cannot be promised.

Risk warning:Disclosing the fact or status of a report to a client may impede an investigation and breach confidentiality obligations.

Ongoing screening should cover all applicable persons, with lists updated promptly and records kept of alert reviews, escalation and disposition. Screening is recommended when establishing customer relationships, when information changes and when lists are updated, with transaction monitoring calibrated to risk. Automated, real-time and periodic screening should be configured proportionately to the scale of operations; the same system is not universally mandatory.

Risk warning:Even if the list is updated, failing to rescreen existing customers may result in newly sanctioned persons being missed.

PEPs and related association risks may be identified using customer declarations, reliable public information and third-party data, followed by risk-based EDD, source-of-funds checks and ongoing monitoring. We recommend documenting the basis for matches and providing for escalation to management. Confirm the specific definitions and approval requirements under the applicable rules; PEP status must not be treated as equivalent to wrongdoing.

Risk warning:Relying solely on database labels may lead to misidentification or overlooked relationships.

A comprehensive assessment should consider both the institution and its customers, analyse risks relating to customers, geography, products, channels and actual fund flows, and evaluate residual risk after existing controls. We recommend updating it when the business or its risks change significantly and applying the results to CDD, monitoring and training. Do not produce only a scoring report that offers no operational guidance.

Risk warning:If risk assessment is disconnected from actual controls, identified risks may not be mitigated.

Transaction monitoring should be capable of identifying activity inconsistent with a client’s profile or strategy and should support alert review, escalation and evidence traceability. It is advisable to establish explainable rules, handling logs and data-integrity checks. Whether to use real-time alerts or behavioral models depends on risk and scale; a particular technical configuration should not be presented as a uniform statutory requirement.

Risk warning:Missing input data may cause monitoring rules to fail.

An independent compliance review should cover risk assessment, CDD, monitoring, reporting, training, records and remediation of deficiencies, with results reported to the governance body. Frequency and scope should reflect risk, changes in the business and previous deficiencies. Confirm specific statutory requirements against applicable materials; do not prescribe an annual audit for every Approved Manager without verification.

Risk warning:Identifying a deficiency without verifying its remediation may allow the issue to persist.

Before launch, first determine whether the new product remains within the management or advisory scope authorised for the Approved Manager. If it involves virtual-asset exchange, transfer or custody, assess the VASP regime separately. It is also advisable to review clients, AML/CFT, asset control and technology risks and document the launch decision; an existing approval cannot be assumed to cover newly regulated activities.

Risk warning:The new product may fall outside the scope of business permitted under the Approved Manager regime.

Before relying on a third party or introducer, verify its qualifications, due-diligence capability, access to information and ongoing oversight arrangements. It is advisable to define the scope of reliance, document-provision and escalation responsibilities in writing, and sample-check performance. These are practical measures; whether reliance is legally permitted must still be confirmed under the applicable AML/CFT rules, and responsibility cannot be transferred in its entirety.

Risk warning:Missing third-party information may result in customer due diligence being ineffective.

Customer risk ratings should be designed by considering the customer and beneficial owner, geography, product, delivery channel and transaction characteristics, and linked to enhanced due diligence and ongoing monitoring. Record the reasons for the score, manual adjustments and events that trigger review. Automated scoring is a tool, not a uniform statutory requirement; weighting and review arrangements should be proportionate to actual risk.

Risk warning:Mechanical reliance on scores may incorrectly rate high-risk customers as low-risk.

An unusual-transaction process should cover alert records, initial review, evidence gathering, internal escalation and the handling conclusion. Suspicious matters should be referred to the MLRO for investigation and a decision on whether to report to the FIA; management approval should not be made a prerequisite that obstructs reporting. It is advisable to retain the basis for the investigation and an audit trail. Specific reporting obligations should be followed under the applicable rules.

Risk warning:Internal approval bottlenecks may delay suspicious activity reports.

Reduce the risks of disclosure and tipping off through need-to-know access, role-based permissions and controlled communications, rather than promising absolute confidentiality. It is advisable to keep suspicious transaction reports separate from ordinary customer files, log access and train staff to handle customer inquiries. External communications and disclosures to authorities as required by law should be reviewed by appropriate personnel under the applicable rules.

Risk warning:Disclosing investigation or reporting information to a customer may constitute improper tipping-off.

Internal reporting lines should enable front-line staff to report suspicious matters directly and clearly to the MLRO, with an alternate contact and an urgent escalation channel. It is advisable to use a standard reporting form, confirm receipt and retain evidence of handling, with internal response targets set according to risk. Internal targets are not uniform statutory deadlines, and staff should not be required to obtain a business supervisor’s approval first.

Risk warning:Unclear reporting channels may leave suspicious matters stalled within business departments.

Before cross-border sharing, confirm the recipient, purpose, scope of information and lawful basis, and assess the rules applicable in the BVI and the recipient’s jurisdiction separately. It is advisable to use minimum-necessary disclosure, encrypted transmission and access logs; a group agreement does not automatically replace legal authority. Sensitive information, including suspicious activity reports, requires particular review of confidentiality and tipping-off risks.

Risk warning:Transmitting sensitive information without appropriate authorisation may breach confidentiality or data requirements.

Monitoring systems should support reliable data, traceable alerts and controlled access. We recommend configuring permissions, encryption, logs, backup and recovery, and supplier reviews according to risk, and testing data integrity and fault handling. These are operational recommendations, not uniform technical specifications; specific security and retention requirements must be confirmed for the actual activities and applicable documents.

Risk warning:Omissions in data or loss of access control may lead to missed monitoring alerts and data leaks.

AML policies should clearly assign responsibility for drafting, approval, implementation and updates, and appropriate governance records should be retained. It is advisable for the compliance function to coordinate preparation and submit the policy to the board for review, but this should not be stated as an identical signature requirement for all entities. An Approved Manager’s specific CO and manual exemptions do not remove AML/CFT obligations.

Risk warning:Mistaking a handbook exemption for an exemption from AML obligations may create compliance gaps.

First verify the identity, scope and applicable authority for the request from the FSC or FIA, then provide accurate information as required and retain submission and communication records. We recommend appointing a coordinator, controlling document versions and following up on remediation. The functions and procedures of the two authorities differ; response deadlines are determined by the actual request and applicable documents, and cooperation does not guarantee immunity from penalties.

Risk warning:Submitting inaccurate or incomplete information may trigger further regulatory action.

The allocation of responsibilities between two managers should be designed around actual investment decisions, execution, marketing and oversight activities; it should not be assumed that the BVI party handles all compliance while the Hong Kong party only executes. The management agreement should specify authority, fees, reporting and conflict management. The BVI party must operate within its approved scope, while Hong Kong qualifications and cross-border distribution boundaries require separate case-specific review.

Risk warning:If contractual responsibilities do not match the actual location of decision-making, business may be conducted without authorization.

Focus on investment capability, staff competence, governance and ongoing compliance record, and verify the FSC registration status and permitted business scope. It is advisable to review biographies, the basis for performance calculations, disclosures of regulatory sanctions, and internal-control and outsourcing-oversight materials. Approved Manager approval is not equivalent to a full investment business licence; eligibility cannot be determined from the name alone.

Risk warning:A mismatch between regulatory status and actual management activities may result in operating beyond the authorised scope.

A manager should ensure that its equity strategy complies with the fund’s investment mandate and its own approved business scope. As an operational matter, it is advisable to specify permissions for leverage and short selling, order execution, counterparty screening, valuation and asset control, and to retain transaction and conflict records. The specific conduct requirements depend on the activity and client; BVI status does not automatically resolve compliance requirements in the trading or marketing location.

Risk warning:Actual transaction activities that exceed the permitted scope of business may constitute operating beyond the authorised scope.

Under a dual-manager framework, first confirm separately the actual activities and licensing boundaries of the BVI and Hong Kong entities, then use agreements to specify investment decision-making, delegation oversight, AML and reporting responsibilities. A BVI Approved Manager covers only management or advisory activities within the statutory scope and cannot replace Hong Kong licensing. Information sharing must also be arranged in accordance with applicable rules.

Risk warning:Approval in one jurisdiction does not mean that business in another jurisdiction is authorised.

A management agreement and responsibility matrix can allocate investment decisions, execution, valuation support, compliance and investor reporting, and specify each party’s rights to obtain information and oversee delegated work. Each party’s regulatory filings should be managed according to its own entity status. Joint audits or routine exchanges may be practical arrangements, but are not uniform statutory requirements and do not transfer the manager’s responsibility.

Risk warning:Overlapping or omitted responsibilities may result in missing regulatory reports.

An investment management agreement should specify the service recipients, investment powers and restrictions, fees, allocation of valuation responsibilities, reporting, conflicts of interest, termination and dispute resolution. If functions are outsourced, it should also identify the service provider, oversight arrangements and rights to access information. An Approved Manager application must include the relevant management or advisory agreements and outsourcing information; the agreement’s scope must match the actual authority.

Risk warning:Contractual authority exceeding the permitted scope may constitute unauthorised business activity.

Effective oversight begins with due diligence on the service provider’s qualifications, capabilities, compliance record and conflicts of interest, followed by contractual reporting, information-access and remediation mechanisms. Periodic reviews and inspection rights may be designed according to risk and are practical recommendations, not uniform inspection frequencies. After outsourcing, the director or general partner remains responsible for the business scope and compliance judgements.

Risk warning:Insufficient outsourcing oversight may prevent the manager from obtaining key records.

Q301: What must the annual return contain? It must confirm continuing compliance with eligibility requirements and the fitness of directors, officers and significant interest holders, and report information as of 31 December of the preceding year on clients served, assets under management for each client, investor numbers and material complaints, among other matters. Use the prescribed form; do not assume that proof of fee payment is necessarily a statutory attachment.

Risk warning:An incorrect basis for measuring assets under management may result in inaccurate annual returns.

Q302: Common deadlines for annual returns? The Approved Manager regulatory annual return must be submitted to the FSC by 1 31 each year; financial statements are generally due within six months after the financial year-end. Check the notice in force for AML/CFT returns; do not apply a historical annual date indefinitely or confuse these returns with the company’s annual financial filing to its registered agent.

Risk warning:Mixing up different filing deadlines may result in missed or late filings.

Q303: What are the consequences of filing late? A late filing means that an ongoing filing obligation has not been met as required. The filing should be made as soon as possible, and the reason should be explained to the FSC. Whether a fine or other regulatory measure applies, and the relevant procedure, must be verified against the filing in question, the latest applicable documents and any case-specific notice. It cannot be asserted that a late filing necessarily results in suspension of Approved Manager status.

Risk warning:Continued failure to file may increase the risk of regulatory action.

Q304: How is the annual licence fee paid? An Approved Manager is liable for an annual renewal fee. The verified amount is 1,800 US dollars, not the annual fee for a full SIBA licence. Confirm the payment channel, due-date arrangements and transaction reference details in accordance with the FSC’s current instructions, and retain the receipt. Registered-agent and professional-service charges must be distinguished separately.

Risk warning:Paying the wrong fee item may mean the renewal payment is not recorded correctly.

Q305: May unaudited financial statements be submitted? Whether unaudited statements are acceptable cannot be determined solely by business size or internal approval. An Approved Manager generally must submit financial statements within six months after the financial year-end. Audit requirements, available exemptions and the form of statements should be verified against the latest applicable documents and the entity’s approval conditions; they must not be waived unilaterally.

Risk warning:Submitting non-compliant unaudited financial statements may fail to satisfy filing obligations.

Q306: What elements should financial reports include? Financial reports should clearly present the entity’s financial position and operating results. In practice, you can prepare information on assets and liabilities, income and expenses, significant accounting policies and material related-party transactions. These are preparation recommendations; the specific statement components, signing and accounting requirements must be confirmed under the applicable documents. Management discussion is not automatically a mandatory filing item.

Risk warning:Omitting material transactions may mean that financial reports do not fairly reflect business operations.

Q307: What must an Approved Manager do in relation to CRS/FATCA? First determine whether CRS/FATCA registration, due diligence or reporting obligations apply based on the actual activities and entity classification. Do not assume that approval as an Approved Manager alone means that reporting is always required. The relevant authority, channel and deadlines must be verified against the latest applicable tax documents; do not assume that filings should be made to the FSC.

Risk warning:Incorrect entity classification may result in under-reporting of tax information.

Q308: Common CRS/FATCA reporting risks and penalties? Common practical risks include misclassification of an entity or customer, missing information and failure to report by the applicable deadline. Whether a supplemental filing is required, a penalty applies and what the specific penalty standard is must be verified against the actual obligations and the latest applicable tax documents. These consequences must not be presented as uniform penalties under the Approved Manager regime.

Risk warning:Incomplete client tax information may result in incorrect filings.

Q309: What indicators are included in scale monitoring? The core requirements are to monitor separately that the aggregate assets under management of private/professional funds do not exceed 4 US dollars, and that the aggregate capital commitments of closed-ended funds do not exceed 10 US dollars, and to verify the eligibility of service recipients. Client numbers and risk exposures may be monitored internally, but a general fund-number limit should not be invented.

Risk warning:Treating committed capital as net assets may result in an excess-limit breach being overlooked.

Q310: What should be done if the size limit is exceeded? After exceeding the applicable threshold, the FSC must be notified within seven days. Generally, the qualifying size must be restored or a SIBA licence application submitted within three months; otherwise, the entity will no longer qualify as an Approved Manager. Act on the actual calculation and applicable documents; do not assume a temporary exemption or automatic upgrade.

Risk warning:Failure to take the required action after exceeding the limit may result in loss of Approved Manager status.

Q311: What is the seven-day change-notification obligation? Seven days should not be treated as a universal post-event notification deadline for all changes. A verified express case is that the FSC must be notified within seven days after scale exceeds the applicable limit. Other changes, including those to directors, business or ownership, require a separate check of notification or prior-approval requirements. Filing an application at least seven days before commencement is a separate rule.

Risk warning:Treating a change requiring prior approval as one requiring only subsequent notification may result in non-compliance.

Q312: Which matters must be reported within seven days? The matter that can be clearly identified is notification to the FSC within seven days after the applicable cap on assets under management is exceeded. Changes to directors, senior officers, registered address, shareholdings and authorised representatives cannot all be listed as matters subject to a uniform seven-day reporting requirement. The deadlines and approval procedures for other matters should be confirmed individually based on the actual change and the latest applicable documents.

Risk warning:Relying on a uniform deadline that has not been verified may result in missing prior approvals.

Q313: What does an FSC on-site inspection usually examine? Preparation may focus on evidence of continued eligibility, client scope and size calculations, regulatory filings, AML/KYC records, internal controls and directors’ performance of their duties. The actual scope is set out in the FSC’s notice and is not a fixed, uniform checklist. Exemption from specific compliance requirements does not waive AML/CFT responsibilities.

Risk warning:Policies that exist only on paper, without implementation records, may not demonstrate that controls are effective.

Q314: How should you prepare for an FSC on-site inspection? You can begin by organising the approval documents, service recipients, scale calculations, filing evidence and AML records in line with the inspection notice; sampling data to check that calculations can be reproduced; and arranging for key personnel to explain actual procedures. Electronic backups, self-assessment and remediation of issues are practical preparation recommendations, not inspection procedures uniformly prescribed for all entities.

Risk warning:Inconsistent information may prompt further regulatory enquiries.

Q315: How frequently should compliance reviews be conducted? Set the frequency according to business risk, scale, changes and regulatory requirements. In practice, an overall annual review may be scheduled, with more frequent checks for high-risk matters and a targeted review after a material change. This is management advice, not a uniform statutory annual, quarterly or semi-annual frequency, and it does not replace fixed filing obligations.

Risk warning:A review frequency that is not commensurate with risk may mean that breaches of limits or control deficiencies are not detected promptly.

Q316: Must an external auditor be appointed? The requirement to appoint one cannot be determined solely by the size of the business. An Approved Manager has financial statement filing obligations. Whether an external audit is required, an auditor must be retained on an ongoing basis, or an exemption may apply should be confirmed under the latest applicable documents and the specific approval conditions. Even if an exemption applies, this does not mean that financial statements need not be prepared or filed.

Risk warning:Incorrectly assuming that no external audit is required may delay compliant financial filings.

Q318: Compliance steps for changing the scope of business? First determine whether the new business remains within the Approved Manager’s statutory service scope and scale limits. Then check notification, approval or separate licensing requirements, and update risk controls. Changes to management business do not automatically authorise insurance, banking, money services or virtual-asset services.

Risk warning:Treating a new business as falling within the scope of an existing approval may result in unlicensed operations.

Q319: How should a change of director be notified to the FSC? Prepare identity, CV and fit-and-proper materials for the incoming director, and confirm the FSC notification or approval process under the latest regulations and approval conditions; do not retain a blanket seven-day notification conclusion. A corporate Approved Manager must at all times have two directors, at least one of whom is a natural person. The company’s filing of its director register must also be handled separately.

Risk warning:A vacancy resulting from a change of directors may mean that the entity no longer meets ongoing eligibility requirements.

Q320: What is the procedure for suspension and resumption of a licence? Approved Manager is an approval route and should not be subjected to a single, uniform licence suspension-and-resumption procedure. If an FSC restriction, cessation-of-business notice or other direction is received, the relevant activities should be stopped as instructed, remedial action taken and the conditions for resumption checked. Resumption cannot be based solely on submitting a remediation report; the specific procedure depends on the applicable instruments and the individual case.

Risk warning:Resuming restricted business without confirmation may breach the regulatory decision.