LCQ1: Improving online bank account opening
*******************************************
Question:
It is learnt that in a number of money laundering cases in recent years, the account holders involved (including foreign domestic helpers and elderly persons) claimed that their bank accounts were opened via mobile applications without their knowledge and used as stooge accounts, where lawbreakers typically first obtain victims' identity cards and personal data, enter the information into bank mobile applications without authorisation, register and link the accounts with mobile phone numbers prepared in advance, and then deceive the victims into "taking photos" on screens lacking prompts to pass facial recognition verification. Once the accounts have been opened, the lawbreakers immediately receive one-time passwords via the linked numbers to carry out money laundering transactions. In this connection, will the Government inform this Council:
(1) whether the Hong Kong Monetary Authority will require banks to clearly display the words "bank" and "account opening application" on the facial recognition screens for online account opening, and to remind the applicants in a familiar language that they are opening an account;
(2) given that the Real-name Registration Programme for Subscriber Identification Module Cards was fully implemented in 2023, whether the Government will mandate banks to verify that the mobile phone numbers used by applicants for account registration and linkage are under the names of the applicants or their specified relatives; if not, of the reasons for that; and
(3) whether the Government will empower banks to access the real-name registration data, so as to verify that the registered users of the linked numbers are the applicants or their specified relatives; if not, of the reasons for that?
Reply:
President,
The Government attaches great importance to preventing the illicit opening of bank accounts, and is particularly concerned about the risk of fraudsters stealing others' identities to open bank accounts remotely. The Hong Kong Monetary Authority (HKMA) has set out relevant regulatory requirements and provided guidance to banks, requiring them to implement appropriate identity verification and risk management measures for remote account opening. Banks are also required to continuously review and enhance their systems and controls to protect bank customers, while preventing bank accounts (including those opened through illicit means) from being used as stooge accounts to receive, transfer, or launder crime proceeds.
Having consulted the Commerce and Economic Development Bureau and the HKMA, my reply to the three parts of the question is as follows:
(1) The HKMA has maintained continuous supervision of the banking sector, requiring banks to put in place multi-layered controls to verify customers' identities and prevent fraud. The HKMA also shares the latest modus operandi of fraudsters with banks to help the industry defend against fraud. When processing account opening applications, banks must effectively identify and verify customer identities, such as using technology solutions to verify the authenticity of identity cards and using facial recognition technology to confirm that the customer is the holder of the identity card. At the same time, banks must continuously improve these technological solutions to address evolving fraud tactics. After bank accounts are opened, ongoing due diligence and transaction monitoring must also be conducted, with suspicious transactions reported to law enforcement agencies to assist their investigations.
To address scams involving bank accounts being opened without customers' knowledge, the HKMA issued further guidance to banks in 2023 reminding them to adopt appropriate measures during remote account opening process. These include displaying clear on-screen messages to remind customers that the selfies collected or liveness tests being conducted are for account opening purposes, so that customers are aware that they are undergoing the relevant procedures.
(2) and (3) Under the existing regulatory framework, regulated financial institutions (including banks) must establish effective and appropriate anti-money laundering and counter-financing of terrorism controls, covering customer due diligence, transaction monitoring, and suspicious transaction reporting.
In fact, to address the potential risks associated with bank customers using SMS One-Time Passwords (OTPs) for transaction authentication, banks have implemented "In-app Authentication" in accordance with the HKMA's requirements. For customers who have installed a bank's mobile application on their mobile phones, they are required to authenticate via that mobile application when logging into internet banking and conducting high-risk transactions (such as adding new payees, raising transfer limits, or changing the phone number for receiving bank messages). This helps reduce the risk of fraudsters stealing internet banking login credentials and SMS OTPs to carry out unauthorised transfers. In addition, when binding their internet banking accounts to mobile devices, customers are also required to complete facial recognition, reducing the reliance on SMS OTPs.
Currently, under the Real-name Registration Programme for SIM cards, users' registration data are collected and kept by the systems and databases established by the respective telecommunications operators. Pursuant to sections 12 and 13 of the Telecommunications (Registration of SIM Cards) Regulation (Cap. 106AI) (the Regulation), telecommunications operators are only authorised to provide user records to law enforcement officers of designated agencies for the purpose of investigating or preventing crimes. The Regulation does not authorise other organisations (including banks) to access the user registration data under the Real-name Registration Programme. As banks are progressively reducing their reliance on SMS OTPs as required by the HKMA, the Government currently has no plans to authorise banks to access the user registration data of the Real-name Registration Programme.
Nevertheless, in respect of the more common criminal modus operandi and emerging risks relating to the use of stolen identities for remote opening of bank accounts, the Government has, through cross-departmental collaboration, jointly launched a series of countermeasures together with the banking sector.
Among them, the HKMA announced in August 2025 new measures to enhance internet banking security, namely "e-Banking Security ABCD", and through the "Deepfake Detection" measure therein, shared with banks good practices for defending against deepfake attacks. These good practices apply to all processes involving facial recognition, including remote account opening applications and high-risk online transactions.
Furthermore, the HKMA is working closely with the Digital Policy Office and the banking sector to progressively integrate the Step-up Authentication function of "iAM Smart" into critical processes. Leveraging the function to conduct facial recognition and read identity card chips can prevent fraudsters from using fake or stolen identity documents. This will provide another layer of protection to the customer identity authentication process. The first phase of testing for remote account opening has already commenced. The HKMA will assess the security, stability, and customer experience of the overall process and gradually expand it to other business areas on a risk-based approach. We expect this measure to further combat crimes involving account opening with stolen identities.
The Government will continue to monitor the risks and relevant trends associated with remote opening of bank accounts, as well as review and optimise countermeasures, so as to better protect the property of the general public and mitigate potential money laundering risks.
Thank you, President.
Ends/Wednesday, October 21, 2026
Issued at HKT 15:10
Issued at HKT 15:10
NNNN