SFC & HKMA "May 22 Circular" Decoded: Complete Guide to Mainland Client Onboarding Compliance, Source of Funds Declaration, and Dormant Account Cleanup
SFC and HKMA jointly issued a circular on May 22, 2026, comprehensively strengthening onboarding and operational monitoring for Mainland clients, requiring internal re-verification of onboarding documents, cleanup of zero-balance dormant accounts, and mandatory acquisition of a Source of Funds Declaration. Rigorously implementing the 522 Circular Onboarding Guidelines is an imperative for Licensed Corporations (LCs) and Authorized Institutions (AIs) to maintain regulatory compliance and prevent cross-border money laundering and financial fraud risks. Responsible Officers (ROs), Managers-in-Charge (MICs), and Money Laundering Reporting Officers (MLROs) across financial institutions must act swiftly to address the stringent requirements of the SFC Mainland Client Onboarding Circular by conducting comprehensive compliance reviews and system upgrades.
III. Practical Compliance & Governance Framework for Financial Institutions
-
Executing 522 Circular Onboarding Guidelines & Technological Verification
When executing the 522 Circular Onboarding Guidelines, management must re-examine the onboarding system. For Mainland clients onboarding via non-face-to-face remote channels, financial institutions must be equipped with technical tools featuring Optical Character Recognition (OCR) and anti-counterfeiting feature matching to rigorously verify Mainland Resident Identity Cards and Exit-Entry Permits for Travelling to and from Hong Kong and Macao. If settlement statements from other institutions are accepted as proof of address, an independent verification mechanism must be established to prevent false documents generated in batches by photo-editing software.
-
Enforcing Source of Funds Declaration Requirement & Criminal Liabilities
Enforcing the Source of Funds Declaration Requirement goes beyond a routine administrative check. Financial institutions must ensure the declaration contains explicit legal notices warning clients that submitting false statements or forged financial proofs constitutes an offense under Section 73 or Section 74 of the Hong Kong Crimes Ordinance (Cap. 200) regarding the use of false instruments, punishable by up to 14 years' imprisonment. MLROs must integrate source of funds checks into transaction monitoring systems; if capital flow routes contradict declarations (e.g., funds routed via unauthorized underground money shops), a Suspicious Transaction Report (STR) must be filed immediately with the Joint Financial Intelligence Unit (JFIU).
-
Implementing SFC Dormant Account Cleanup Standard Operating Procedures (SOPs)
When carrying out SFC Dormant Account Cleanup mandates, operations managers and compliance officers must establish standardized offboarding SOPs. Financial institutions should establish a baseline date to audit all Mainland investor accounts possessing zero balances and zero client-initiated orders over the preceding 12 months. Prior to system termination, at least two documented notification attempts (via encrypted email, SMS, or app notifications) must be retained. Re-opening a closed account requires clients to complete a full CDD and source of funds review under the updated 522 Circular Onboarding Guidelines.
IV. Q&A: How Should Legacy Mainland Clients (Existing Accounts) Complete Remedial KYC & Source of Funds Declarations?
Q: For legacy Mainland clients who opened accounts prior to May 22, 2026, how should financial institutions organize remedial KYC and execute the Source of Funds Declaration?
A: Management at financial institutions should adopt a four-step framework: "Inventory & Risk Assessment, Notification & E-Signing, Tiered Restrictions, and Offboarding & Audit Trail":
-
1. Inventory & Risk Assessment
Operations and compliance teams must immediately extract lists of all legacy Mainland accounts, prioritizing high-risk accounts opened via non-face-to-face remote channels, third-party referrals, or those with outdated CDD records.
-
2. Notification & E-Signing of Source of Funds Declarations
Deploy supplemental agreements aligning with the Source of Funds Declaration Requirement via encrypted e-signature platforms or mobile apps. The agreement must require clients to formally confirm in writing: "All funds utilized for investment activities and settlements originate from lawful sources outside Mainland China." Updated proof of identity and residential address must also be submitted.
-
3. Tiered Restrictions & Freeze
Financial institutions must set a reasonable remediation grace period (e.g., 30 to 60 days). If legacy clients fail to complete remedial KYC or refuse to sign the declaration within the timeframe:
-
Stage 1 (Buy-Order & Deposit Restriction): Suspend account purchasing capabilities and new deposit intake; allow only sell-orders and funds withdrawals to same-name bank accounts.
-
Stage 2 (Total Account Freeze): If non-compliance persists past the deadline, freeze all trading capabilities (including sell-orders and asset transfers) until full compliance clearance is granted.
-
4. Offboarding & Audit Trail Archiving
If a legacy account holds a zero balance and remains unresponsive after multiple notifications, financial institutions must transition the account into the SFC Dormant Account Cleanup workflow, execute system termination, and archive all communication logs, system notifications, and closure records for future regulatory inspection.
Action Plan for Senior Management (ROs / MICs / MLROs)
-
Board of Directors & ROs: Formally review and approve the "522 Circular Compliance Implementation Plan", allocating adequate resources for independent internal document re-verification and submitting a summary report to regulators within 3 months.
-
MIC of Compliance & MLRO: Revise internal AML/CFT Policies and Onboarding SOPs, update red-flag indicators for suspicious transactions, and provide mandatory staff training on recognizing fraudulent identity documents.
-
Operations & IT Heads: Upgrade front-end onboarding platforms and fund transfer validation modules to hard-code mandatory "Same-Name Bank Account Verification" and "Source of Funds Declaration" gates.
Conclusion
Conclusion
Confronted with the most stringent regulatory enforcement project on Mainland client onboarding history jointly launched by the SFC and HKMA, licensed institutions must demonstrate an exceptional level of compliance execution. ComplianceOne Consulting Limited ("ComplianceOne") possesses extensive advisory experience in navigating the May 22 New Regulatory Guidelines for Client Onboarding, executing independent account document re-verifications (the 3-month specialized audit project), and managing legacy account remediation. We deliver one-stop advisory services tailored to regulatory standards across both Hong Kong and Mainland jurisdictions for Boards of Directors, Responsible Officers (ROs), and Heads of Compliance of Licensed Corporations.