Bank Negara Malaysia (BNM) had imposed an Administrative Monetary Penalty (AMP) amounting to a total of RM3,264,000 on HSBC Bank Malaysia Berhad (HBMY) for non-compliances in relation to customer due diligence (CDD) and sanctions screening requirements, and HSBC Amanah Malaysia Berhad (HBMS) for non-compliances in relation to sanctions screening requirement:

A. Non-compliance in relation to the customer due diligence requirements

On 13 March 2025, Bank Negara Malaysia (BNM) imposed an AMP^[1] of RM324,000 on HBMY for non-compliances with paragraph 48(1)(a) of the Financial Services Act 2013 (FSA), read together with paragraphs 14A.1(h), 14A.3(c) and 14A.9.6 of the Anti-Money Laundering, Countering Financing of Terrorism and Targeted Financial Sanctions for Financial Institutions Policy Document (AML/CFT and TFS for FIs 2019 PD).^[2]

Under the AML/CFT and TFS for FIs 2019 PD, reporting institutions (RIs) are required to identify and take reasonable measures to verify the identities of natural persons who are beneficial owners (BOs) of the customers. This allows RIs to assess their exposures to money laundering/terrorism financing risks and take appropriate mitigation measures. In addition, these measures aim to prevent individuals from misusing corporate vehicles to conceal illegal assets by maintaining a legitimate front in the financial system.

 BNM identified the non-compliances during an on-site examination of HBMY. The examination revealed a lack of understanding regarding the requirements for BOs as outlined in the AML/CFT and TFS for FIs 2019 PD. In response, HBMY has taken remedial measures, including strengthening its compliance monitoring processes and providing refresher training programmes to improve staff’s understanding of BO requirements.

In determining the imposition of the AMP, BNM considered the relevant aggravating and mitigating factors, including HBMY’s:

1. lack of reasonable care in ensuring compliance with requirements on the identification of BOs;
2. past compliance record and history of formal actions imposed; and
3. remedial actions taken to rectify the gaps.

 More information on CDD requirements for RIs is available at the AML/CFT microsite.

B. Non-compliance in relation to the sanctions screening requirement

On 13 March 2025, BNM imposed a total AMP^[3] of RM2,940,000 on HBMY and HBMS (collectively referred to as HSBC), for non-compliances with paragraph 48(1)(a) of the FSA and paragraph 58(1)(a) of the Islamic Financial Services Act 2013 (IFSA), read together with paragraphs 27.4.1 and 28.3.1 of the AML/CFT and TFS for FIs 2019 PD and paragraphs 27.4.1 and 28.3.1 of the Anti-Money Laundering, Countering Financing of Terrorism, Countering Proliferation Financing and Targeted Financial Sanctions for Financial Institutions Policy Document (AML/CFT/CPF and TFS for FIs 2024 PD).

Under the AML/CFT and TFS for FIs 2019 PD and AML/CFT/CPF and TFS for FIs 2024 PD, RIs are required to conduct sanctions screening on new customers against the Domestic List^[4] and United Nations Security Council Resolutions (UNSCR) List^[5]. This is essential to protect RIs and the broader financial system from being abused for terrorism or proliferation financing.

HSBC identified the non-compliances during a review in 2023. It was discovered that customers were onboarded without proper sanctions screening due to staff oversight, ineffective maker-checker functions, and inadequate system capabilities. The remedial measures implemented by HSBC were insufficient, resulting in similar breaches of failure to conduct sanctions screening during customer onboarding, which recurred in 2024. Nonetheless, there were no specified entities^[6] being onboarded and no transactions of specified entities being facilitated by HSBC.

HSBC has since enhanced its system capabilities to prevent account openings until all sanctions screening processes have been completed.

In determining the imposition of the AMP, BNM considered the relevant aggravating and mitigating factors, including HSBC’s:

1. lack of reasonable care in ensuring compliance with the sanctions screening requirement;
2. inadequate control measures, including system incapabilities, ineffective dual control functions and staff oversight; and
3. past compliance record and history of formal actions imposed.

HSBC paid a total of RM3,264,000 for the AMP imposed by BNM on 24 March 2025.

The enforcement actions taken are in line with the approach and processes outlined in the Enforcement Approach.

^[1] BNM imposed the AMP pursuant to subparagraph 234(3)(b)(i) of the FSA.

^[2] The AML/CFT and TFS for FIs 2019 PD was in effect from 1 January 2020 to 5 February 2024 and has since been superseded by the AML/CFT/CPF and TFS for FIs 2024 PD, which took effect on 6 February 2024. These requirements are preserved under paragraphs 14A.1(h), 14A.3(c) and 14A.9.6 of the AML/CFT/CPF and TFS for FIs 2024 PD.

^[3] BNM imposed the AMP pursuant to subparagraph 234(3)(b)(i) of the FSA and subparagraph 245(3)(b)(i) of the IFSA.

^[4] Domestic List is a list of names and particulars of specified entities declared by the Minister of Home Affairs under the relevant subsidiary legislation made under section 66B(1) of AMLA.

^[5] UNSCR List is a list of names and particulars of persons as designated by the United Nations Security Council (UNSC) or its relevant Sanctions Committee pursuant to the relevant UNSCR and are deemed:

1. specified entities by virtue of section 66C(2) of the AMLA for TFS-TF, and
2. designated persons under the relevant Strategic Trade Act 2010 (STA) subsidiary legislation for TFS-PF.

^[6] Individuals or entities listed in the Domestic List and UNSCR List.