SFC Fines Crypto Exchange for AML Failures

The Securities and Futures Commission (SFC) has imposed a HK$12 million fine on a licensed virtual asset trading platform for systemic deficiencies in its anti-money laundering (AML) and know-your-customer (KYC) controls, marking one of the most significant enforcement actions against a VASP in Hong Kong to date.

Key Findings

The SFC’s investigation, conducted between January 2023 and June 2025, identified several critical failures:

• Inadequate transaction monitoring: The platform’s automated transaction monitoring system failed to flag over 4,200 transactions that exceeded the reporting threshold, including transfers to known high-risk jurisdictions.
• Weak customer due diligence: Onboarding procedures accepted self-certified source-of-funds declarations without independent verification in approximately 1,800 cases.
• Delayed suspicious activity reports (SARs): Three SARs were filed between 45 and 90 days after the triggering transactions, well beyond the regulatory expectation of timely reporting.
• Sanctions screening gaps: The platform’s sanctions screening tool had not been updated since March 2024, missing additions to the UN Consolidated List and the US OFAC SDN list.

Regulatory Context

This enforcement action aligns with the SFC’s heightened scrutiny of virtual asset service providers following the implementation of the new VASP licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), which came into full effect in June 2023.

“The standards expected of licensed corporations apply equally to VASPs,” an SFC spokesperson noted. “AML controls are not optional — they are fundamental obligations that protect the integrity of Hong Kong’s financial system.”

Implications for Compliance Professionals

The case underscores several priorities for compliance teams operating in the digital asset space:

1. Real-time sanctions list updates must be automated, not manual. Relying on periodic batch updates creates exposure windows.
2. Transaction monitoring thresholds should be calibrated to the specific risk profile of crypto markets, not inherited from traditional banking templates.
3. Source-of-funds verification for high-risk customers should go beyond self-declaration, particularly for accounts receiving transfers from offshore jurisdictions.
4. SAR timeliness is a recurring enforcement theme — compliance teams should have clear escalation triggers and predefined timelines for internal review and external reporting.

Next Steps for Industry Participants

Licensed VASPs and applicants should conduct an immediate review of their AML control framework, with particular attention to:

• Sanctions screening frequency and list source coverage
• Transaction monitoring rule calibration and alert disposition
• Customer risk rating methodology and CDD enhancement triggers
• SAR escalation workflow and internal SLAs

The SFC has indicated that further enforcement actions are anticipated as the regulator completes its second-round thematic review of licensed VASPs in Q1 2026.

Disclaimer: This article is for informational purposes only and does not constitute legal or compliance advice. Readers should consult qualified professionals for guidance specific to their circumstances.