継続的顧客管理に関する海外状況調査報告書※ 本報告書は、全銀協が事務局を務める「AML/CFT 態勢高度化研究会」がKPMG あずさ監査法人に調査を依頼し、取りまとめたものである。12022 年 1 月
AML/CFT 態勢高度化研究会（ 事務局：一般社団法人 全国銀行協会 ）1

本報告書は、AML/CFT 態勢高度化研究会（事務局：一般社団法人全国銀行協会）の委託により有限責任 あずさ監査法人が実施した調査結果を取りまとめたものである。有限責任 あずさ監査法人は、調査時点で入手した情報に基づき本報告書を適時に取りまとめるよう努めているが、本調査報告書の内容は、本調査の対象に含まれない特定の個人や組織が置かれている状況に対応するものとは限らず、また、情報を受け取った時点及びそれ以降において、その情報の正確性や完全性を保証するものではない。また、本報告書は委託者である AML/CFT 態勢
高度化研究会（事務局：一般社団法人全国銀行協会）に対してのみ提出したものであり、本報告書を閲覧あるいは本報告書のコピーを入手閲覧した第三者の本報告書の利用に対して、有限責任 あずさ監査法人は直接ないしは間接の責任を負うものではない。

1

目次
1.

2.

調査の目的等 ....................................................................................................................3
1.1.

目的 ...........................................................................................................................3

1.2.

背景 ...........................................................................................................................3

1.3.

仮説 ...........................................................................................................................3

調査方法 ...........................................................................................................................4
2.1.

調査方法 ....................................................................................................................4

2.2.

調査観点 ....................................................................................................................4

2.3.

調査対象国 ................................................................................................................53.

調査結果概要 ...................................................................................................................64.

今後についての示唆・今後の検討ポイント ..........................................................................14（Appendix 1）情報更新について非協力的な顧客に対する対象国該当規制（抜粋） ...........18（Appendix 2）対象国の一部における SDD 関連規制の抜粋................................................23（Appendix 3）Countering Money Laundering and Terrorist Financing- Education andPublicity- Multimedia ..........................................................................................................32（Appendix 4）ヒアリング記録...............................................................................................32

2

1. 調査の目的等

1.1. 目的
2021 年 7 月開催の AML/CFT 態勢高度化研究会において、研究方針として「実効性のある継続的顧客管理およびリスクベースの取引モニタリングの在り方」に優先的に焦点を当て、継続的顧客管理に関して、例えば海外のマスリテール金融機関における、顧客属性データの取得・更新を効率的に実行する方法の研究等を実施する旨合意された。
継続的顧客管理は、(a)「顧客属性データの取得・更新」、(b)「取得・更新された顧客属性データ等を踏まえた
顧客リスク評価の見直し」、(c)「そうしたリスク評価に基づくリスクベースのモニタリング・顧客対応」の３段階に分けて考えることができる。本調査は、このうち(a)に焦点を当てるものである。
上記(a)の段階で、我が国の銀行が困難な課題に直面していることを踏まえ、それらの課題への対処策を検討する材料を整理することを目的として「海外のマスリテール金融機関における顧客属性データの取得・更新を効率的に実行する方法」について研究することとした。

1.2. 背景
我が国の銀行が、「顧客属性データの取得・更新」の段階で直面している課題は、以下の通りである。
① 郵送しても「あて所に尋ねあたりません」として、返送されてしまう② 届いても回答しない③ 苦情が多く寄せられる④ 回答あったものについても、書類不備などがある⑤ 書類不備確認、顧客応対、入力などの対応（あるいは事務委託のコスト）の負担が重い

1.3. 仮説
海外のマスリテール金融機関は 1.2 で示した課題を抱えていない、もしくは抱えているとしてもその程度が少ないという可能性を想定しながら、以下の仮説を立てた。
仮説１

海外では、顧客との間でのやりとりが電子メールや Web アプリなどが普通。従って、手紙が届かないことによる問題が無い。また電子メールや Web アプリで連絡が取れない顧客との間では、取引の一時停止・中断が広く行われ、また顧客からもそれが受け入れられている。

3

仮説２

海外の（一部の）国では、デジタル ID が普及しており、一定期間の経過などで継続的顧客管理が必要となった顧客に対しては、デジタル ID の提示を求め、それとともに当該顧客の最新時点での住所等の情報取得が可能となっている。

仮説３

海外では、消費者は日本のように多くの銀行口座を保有することがない（もしくは銀行口座を保有できない Un-banked 層が相応に多い）。日本では、口座維持手数料徴収が一般的ではないこともあり、あまり使用されないままに、多くの口座を保有し続けるケースが多い。このような口座を対象に継続的顧客管理が行われる場合、利用者は煩わしいと感じ、回答のインセンティブは低くなる。

仮説４

海外では、口座を持つ銀行に自らの最新情報を更新しておかないと口座取引の停止を受けることがむしろ当たり前と考えられており、そのため、顧客が銀行に自らの最新情報を提供することに抵抗や遅滞が生じにくい。（例えば、インドでは RBI の通知の 2.8 で「顧客が非協力的であるために KYC ができないときには、口座閉鎖や取引停止を検討すべきこと」とされており、実際に口座閉鎖や取引停止が頻繁に行われている。）

仮説５

海外では、SDD の範囲（FAQ で示されたリスクに応じた簡素な顧客管理）が日本よりも広く認められており、定期的な CDD に応じなければいけない顧客層が相対的に少ない。

仮説６

国民文化（消費者の考え方、姿勢）の違いということが考えられる。日本では、自らの苗字や住所など基本的な情報についても「なるべく他者」に伝えない傾向が強い。

仮説７

海外では、既存顧客が最新の顧客情報を銀行に提供しやすくする、ないしはせざるを得ないようなイ
ンセンティブを銀行が与えている。

2. 調査方法

2.1. 調査方法
調査は 2021 年８月時点で入手可能な情報を基に実施した。KPMG あずさ監査法人が上記 1.3 の仮説それぞれについて可能な範囲内でデスクトップリサーチを実施し、その後 KPMG 海外メンバーファームに対し、以下の調査観点で彼我の違いとその背景・理由について意見交換を行い、仮説を踏まえながら調査結果をとりまとめ、我が国の継続的顧客管理の課題解消の方向性について整理した。
なお、海外メンバーファームとの意見交換は当該ファームへの再委託費用が発生しない範囲内で実施した。

2.2. 調査観点
調査の観点は次のとおりとした。
1. 既存顧客についての最新の情報の取得について、当該国が難しさを抱えているか42. 既存顧客への連絡手段（手紙・電子メール・Web アプリその他）
3. 情報更新について非協力的な顧客に対する取引制限の中断・停止措置の使われ方、顧客の受け止め方、根拠となる法令・規制当局の指導（指針）・規制状況、銀行と顧客の間の約款の中の条文の存在など（取引制限がかけやすい環境・仕組みの存否）
4. デジタル ID の普及に伴う顧客の最新情報の取得しやすさ
5. 消費者にとっての銀行口座の数の多寡と銀行に対する情報提供の姿勢への影響
6. 口座維持手数料の存否
7. 銀行顧客の最新情報の記録について、顧客自身が銀行の website で upload するなどの方法が広く使われ、銀行にとっての手間の削減につながっているか
8. 取引データから KYC プロセスに必要かつ有益な情報を抽出する仕組み（システム）を構築しているか（例えば給与所得者か、年金生活者かなど）
9. 既存顧客についての最新の情報の取得について、銀行が難しさを抱えている場合の個別銀行や銀行業界としての対処策（金融機関からの更新情報依頼への回答に関する利用者へのインセンティブの有無を含む）

2.3. 調査対象国①グローバルまたは地域的な金融市場としての位置付け、②AML/CFT 遵守体制の成熟度、③CDD のためのデジタル ID の普及を踏まえ、次の 8 ヵ国を調査対象国とした。
米国（米）、英国（英）、ドイツ（独）、スウェーデン（瑞）、オーストラリア（豪）、香港（香）、シンガポ
ール（星）、インド（印）53. 調査結果概要2
2.2 の調査観点それぞれにつき、海外の状況と我が国の状況を比較し、異なる点・共通点を示す。
#

観点

日本の状況

海外（意見交換先）の状況

1

既存顧客についての最新の情報の取得について、当該国が難しさを抱えているか 我が国の銀行、「顧客属性データ取得・更新」段階で苦労している点は以下通り。
① 郵送しても「 あて所に尋ねたりません」
として、返送されてしまう② 届いても回答しない③ 苦情が多く寄せられる④ 回答あったものについて、書類不備などがある⑤ 書類不備確認、顧客応対入力などの対応（あるいは事務委託コスト）の負担が重い

 「難しさを抱えていない」とする国が 4 ヵ国（英、瑞、豪、星）、「さほど難しさを抱えていない」とする国が 4 ヵ国（米、独、香、印）だった。
（「難しさを抱えていない」とする国の例）
 英の大多数の銀行は、顧客の情報、例えば氏名・住所・生年月日・国籍について、最新で知り得た情報が記録されているものと違う場合を除き、低リスク顧客に継続的顧客管理を対象としない。さらに、上記の情報を取得するために、銀行は顧客に直接連絡するのではなく、第三者の情報源3に依存して情報を検証する。
 瑞は、「約 5 年前には最新の顧客情報を得るのに苦労していたが、その後状況が大きく変化し、現時点では難しさを抱えていない」とのこと。最近約 5 年間の変化は次の 3 点。①同国や EU 域内で複数の大型 ML スキャンダルが発生する中で規制監督当局の対応厳格化と、この問題と対応の必要性への消費者の理解が進展。②消費者のオンラインバンキング利用の拡大。③消費者によるデジタル ID 使用のさらなる拡大。
（「さほど難しさを抱えていない」とする国の例）

2

各国メンバーファームに対するヒアリング記録は Appendix 2 のとおり。

3

英には（銀行や顧客からみて第三者である）サービスプロバイダー（例えば信用情報会社としての Experion や Equifax、フィンテック会社として Onfido や Jumio）が提供する電子的な「身分証明と確認 (ID&V)」サービスを銀行が使用している。そこでは、政府の記録（例：選挙人名簿、国勢調査データ、裁判所の記録等）、公表されている情報源（例：電話帳情報等）、または参加銀行などから多数のデータセットにアクセスし、名前、住所、生年月日の情報を取得することが可能（同意を事前に得た顧客を対象）。
この方式を用いることにより、銀行は顧客に直接連絡するのではなく、第三者のサービスプロバイダーを通じて得た情報を用いて顧客情報を独立的に検証することが可能。

6

#

観点

日本の状況

海外（意見交換先）の状況
米の顧客は銀行に情報を提供することを抵抗していない。歴史的に、顧客は顧客情報の機密性を維持するために銀行を信頼しており、さらに、9・11 のテロ事件及びの後の対テロ戦争の影響によって、テロ資金供与と戦うことの重要性についての強い国家的な認識がある。
 独は、最新の顧客情報を得ることに一定の課題を抱えているが、①銀行が最新の情報を提供しない顧客の口座を閉鎖することを求める規制要件、②多くの顧客が低リスクに分類され、定期的なレビュースケジュールが緩和されている(7~10 年)、③顧客が銀行からの情報提供依頼に慣れているという信頼の文化によって、この課題は大幅に軽減されている。
 香は、「約 10 年前には顧客の理解を得るのに苦労していたが、HKMA の厳しい規制・指導の下で、銀行が顧客に繰り返し情報提供の必要性を訴えたことが奏功し、現時点では、かなりその問題の程度が小さくなっている」。
 印は、国民デジタル ID が普及しており基本的には課題としてみなされていない
一方、貧困地域に住みデジタルメディアにアクセスできない顧客から銀行が最新情報を入手することが困難とのこと。
― 加えて、これらの国々では、対顧客連絡に手紙ではなくアプリを使っている（下掲2 参照）、情報更新に非協力的な顧客に取引の制限が法律によって求められていることが当然視されている（下掲 3 参照）等が挙げられる。
 顧客とのコミュニケーション（口座開設、その後の更新双方の KYC 含む）の大部分
は銀行のバンキングアプリで行われる（米、英、瑞、豪、星、印）。例示として、星では 80％超の顧客はバンキングアプリを利用している。
 これらの国では、銀行が顧客の最新情報を提供する必要があるタイミングで、顧客がバンキングアプリにログインした後の画面にプロンプトが表示され、当該顧客が自らの最新情報を提供しないと、自分の口座にアクセスすることが出来ない仕組みとする銀行が殆どである。
 バンキングアプリのアラートに加えて銀行は、①電子メール、②サービスセンターの担当
者からの電話、および③郵送による依頼など、多面的なアプローチで既存顧客に連絡を取っている。複数のアプローチを受けた顧客は、顧客自身にとって最も都合のよい

2

既存顧客への連絡手段（手紙・電子メール・
Web アプリその他）

 最新顧客情報提供の依頼は郵送により行われることが多い。

7

#

3

観点

情報更新について非協
力的な顧客に対する取引制限の中断・停止措置の使われ方、顧客の受け止め方、根拠となる法令・規制当局の指導（指針）・規制状況、
銀行と顧客の間の約款の中の条文の存在など（取引制限がかけやす
い環境・仕組みの存

日本の状況

海外（意見交換先）の状況

 AML/CFT ガイドラインでは、CDD に対して次の記載がある。「必要とされる情報の提供を利用者から受けられないなど、自ら定める適切な顧客管理を実施できないと判断した顧客・取引等については、取引の謝絶を行うことを含め、リスク遮断を図ることを検討すること。その際、マネロン・テロ資金供与対策の名目で合理的な理由なく謝絶等を行わないこと6 一方、上記の「取引の遮断」措置は、国民に理解が浸透していないため、実際には広方法で回答できる。4
銀行は可能な限り、顧客との関係の中で生じる自然なコミュニケーションから最新情報を入手する(例えば、自動車ローンの申し込みや、クレジットカードの与信限度額を引き上げるためのマーケティング・コミュニケーション)。そうすれば、顧客は、単に個人情報の提供を強要されていると感じない。
 香のほとんどの銀行は、HKMA の規制を踏まえつつ、高リスクの顧客に絞って情報取得をすることとしており（SDD 対象顧客の範囲が日本比広い5、Appendix 2 を参照）、最新情報を取得するために、その数的には日本比限られた顧客に対して電話で連絡する。電話が郵送による情報の要求と比較して顧客から最も高い応答率を引き出すことを認識し、その結果、郵便は通常使用されない。
 全ての対象国において、顧客が最新情報を提供しない場合、当該国の法律、規制
当局の姿勢、またはその両方に基づき、顧客の口座利用を制限する、または口座を閉鎖する権限を銀行が持つ。当該措置の適用方法や程度は国によって異なる(Appendix 1 を参照)。
 一部の国では、CDD を完了できない場合、銀行は最終的に顧客の口座を閉鎖するように規制上に明確に義務付けられている（独、瑞、星、印）。
 星：社会に規制遵守第一の傾向が強い中、銀行は顧客口座閉鎖に非常に厳しいアプローチを取っている。
 独、瑞、印の銀行は、消費者保護への悪影響を避けるため、段階的なアプロー
チをとっている。例えば、最初に日常生活に必要な取引(電気代など)以外の取引を制限し、次に、すべての取引をブロックし、顧客に何度も連絡を試みた後、

4

例えば、郵送での情報更新の場合、回答率は 5％であり、オンラインなどマルチチャンネルを活用した場合は 90%に回答率が向上する事例は KPMG UK から紹介された。

5

香では、リスクベース・アプローチにおいて個々の銀行が低リスクと判断した先を SDD 対象とすることが可能。

顧客リスク評価において低リスクと判断可能な要素の例（ディスクロージャー要件が適用される上場企業、生命保険の年間保険料が HK$8000 未満の契約等）。
6 令和 3 年 2 月 19 日 金融庁 マネー・ローンダリング及びテロ資金供与対策に関するガイドライン、II II-2（ii）⑪

8

#

観点
否）

日本の状況

海外（意見交換先）の状況

く適用されていない。


4デジタル ID の普及に伴う顧客の最新情報の取得しやすさ マイナンバーカードについては、「本人同意に基づく基本４情報等の提供」を認めるべ
く、法改正が進んでおり、この新制度を活用すれば、結婚による変更後の苗字や、転居後の新住所を（本人同意に基づき）JLIS から得られるようになっている。しかしな

口座を閉鎖する。
CDD が完了しない場合に口座を閉鎖するかどうかを銀行自身がリスクベース・アプロ
ーチをとった上で判断することが規制上に規定されている国もある（英、豪、香）。
 英：公共情報から不足している顧客情報を特定しようとした上で、上記と似たような段階的なアプローチをとり、慎重に ML のリスクを計り、銀行の法務部門と相談した後、最終的に口座を閉鎖するかどうかを判断する。
 香：いわゆる「Three Strike Rule」を適用する。顧客への何度も連絡を試みたが成功しない場合または顧客は最新情報の提供を否定する場合、銀行は顧客の AML/CFT リスクに応じて、または STR の対象となっているかどうかに応じて、コンプライアンスレビューを実施する。コンプライアンスレビューの結果によって、銀行は STR を申請するかどうか、顧客のリスク評価を再評価するかどうかを判断する。2 年以内に STR が 3 件申請されると、銀行は当該顧客の口座を閉鎖する。
顧客の口座利用制限等が、約款に規定されている国が多い（英、独、瑞、豪、香、星）。
 口座契約約款では、銀行から要求された最新かつ完全な情報を提供する顧客の要件と、この情報が提供されない場合に顧客口座を閉鎖する銀行の義務が明確に規定されている（独、瑞、星）。香の銀行の口座契約約款では、口座を閉鎖する銀行の権限が規定されている。
 英、豪の口座契約約款では、銀行が取引制限・口座閉鎖する権限を規定している。銀行から要求された最新の完全な情報を提供することを顧客が拒否することもその理由に含まれると解釈される。
デジタル ID が普及している国において、口座開設時および継続的に顧客情報を提供するためのデジタル ID の使用は、通常のプラクティスになっているため、口座開設プ
ロセスと継続的顧客管理の両方が容易になっている（瑞、星、印）。
瑞：民間レベルで独自 ID 基盤を構築することが認められており、民間銀行界主導で BankID と呼ばれるデジタル ID を作り、それを政府のデジタル ID（アンカーID）と連携させている。

9

#

観点

日本の状況
がら、顧客の本人確認のために「公的個人認証の方法」（犯収法施行規則 6 条 1
項 1 号ワ）を使っている銀行は現時点では少ない模様。

5

消費者にとっての銀行口
座の数の多寡と銀行に対する情報提供の姿勢
への影響

 日本の成人は、殆ど使わない（休眠口座に近い）ものも含めて、4 つ、５つ以上の口座を持ち、自分にとって優先順位が低い
口座について最新情報を提供することに消極的な場合がある。

海外（意見交換先）の状況
 星：デジタル ID(MyInfo)を利用する継続的顧客管理プロセスは以下のとおり。
 トリガーイベントで銀行が最新顧客情報を取得する必要がある場合、顧客が銀行アプリにログインすると、画面が表示され、銀行が MyInfo を銀行にアクセス付
与することを顧客に要求する。
 銀行は、顧客から同意を得た後、顧客から提供された MyInfo 情報を登録されている顧客情報と比較する。
 顧客は政府に対して MyInfo 情報を常に最新の状態に保つよう要求されている(但し、顧客が MyInfo を適時に更新しない場合もある)。
 印：デジタル ID(Aadhaar)が銀行口座の殆どと紐づけ済であり、それを利用した継続的顧客管理が以下のプロセスで行われている。
 銀行は、情報更新が必要な顧客に、その旨をアプリで通知。
 顧客は、アプリで銀行に「更新情報」を返信。
 銀行は、再度の顧客同意を得て、政府認証機関から本人が登録済の最新情報（名前、住所、生年月日等）を入手。
 銀行は、その情報と顧客からアプリで受信した情報の一致を確認し、継続的顧客管理を完了。
 銀行は、顧客にアプリでその旨を通知。
 英、独、香の 3 ヵ国では、デジタル ID を使った継続的顧客管理の実務はみられていない（英は、デジタル ID 関連の検討の段階。独は、デジタル ID 実用化は行われているものの、国民の多くが当該機能を利用可能な状態にしていない。香は、昨
年 12 月に任意加入の制度を導入済だが普及率は低い）。
 調査対象国の多くでは、顧客が複数の口座を保有していても、自らの最新情報の提供に消極的な場合は少ないと考えている。その理由は以下の通り。
① 【法規制環境等から対銀行情報提供は当然と捉えられていること】多くの国では、法律上保有した銀行口座について KYC は定期的に求められ、それに応じなければ取引制限、凍結、契約解除になるということを国民が理解している（上掲 3 参照）。
② 【口座維持手数料から「無駄な」口座を持たない傾向があること】金融機関も経

10

#

観点

日本の状況

海外（意見交換先）の状況







6

口座維持手数料の存否 銀行口座は日本国民について必要不可
欠な生活インフラであるとの理解が長年定着しているため、維持手数料の徴求は国民の理解が得られにくい状況の中、今まで
は銀行が銀行口座の維持費を請求する事
例は多くなかった。最近、大手行は新規に開設口座に対して維持手数料を適用し始めており、地域金融機関でも「未利用口座
管理手数料」の導入が広がっている。今年9～10 月には全 99 行中の過半数（55行）が導入済となる見込み（9 月 3 日ニッキンによる）。








済合理性等の観点から、採算の低い（残高が少ない）口座については一定の手数料を課している。
上記の下、国民は利用しなくなった口座については放置せずに解約するため、結果的に実際に利用する（本来の目的が明確である）口座のみが存在する。
英：多くの顧客は、従来型の大手銀行口座ひとつとチャレンジャーバンクの口座ひとつ、の計２つ程度としていて、４つも５つも口座をもつケースは比較的少ない。
独：ECB のマイナス金利の政策の下で、預金者の銀行口座保有には手数料（事実上「マイナス金利の適用」が課される。このため顧客は、真に必要以上の数の銀行口座を設けるインセンティブは無い。
星：預金保険制度は 1 つの銀行口座当たり一定額までしかカバーしないため、資産を多く持つ顧客はリスクを分散するために多数の銀行口座を持つことが珍しくなく、
それら複数の口座については、それぞれに「相応の預金残高」を持つこととなる。ただし、その地の法規制の厳しさの影響もあって、預金者は銀行に対する情報提供に積極的に応じている。
瑞：大手銀行が同じようなサービス・価格設定を提供している状況の中で、顧客は
通常 1 つの銀行口座しか持たないことが一般的。
口座維持手数料の有無とその適用範囲は国によって異なる。口座維持手数料を課すことによって不要な口座は解約するインセンティブの一つとなる。
銀行が、一定の残高を下回る口座について、毎月の口座維持手数料を請求する国が 4 か国（米、豪、星、印）。
口座維持手数料が課されない国が 2 か国（英、瑞）。
独の銀行はすべての口座に対して年間口座維持手数料を請求する。また、顧客の口座残高が一定の残高を超える場合、ECB のマイナス金利のため、顧客は銀行にお金を支払わなければならない。
香の銀行は、ネットバンキングとの競争力を維持するため、口座維持手数料を廃止しているという動向がある。

11

#

観点

日本の状況

海外（意見交換先）の状況

7

銀行顧客の最新情報の記録について、顧客自身が銀行の website で
upload するなどの方法が広く使われ、銀行にとっての手間の削減につながっているか ほとんどの顧客最新情報の取得が郵送並びに回答の入力・検証に手作業が生じ、多額のコストがかかる。

8

取引データから KYC プロ
セスに必要かつ有益な情報を抽出する仕組み（システム）を構築しているか（例えば給与所
得者か、年金生活者かなど）

 日本の多くの銀行では、KYC と取引モニタ
リングシステムを結び付けて、各顧客のリスク検知に使う仕組みが充分でない（相互審査報告書パラグラフ 366 を参照）。

9

既存顧客についての最新の情報の取得について、銀行が難しさを抱えている場合の個別銀行や銀行業界としての対処策

 全銀協では、最新情報の提供に協力することの重要性について、顧客の意識向上を図るため、テレビ CM や店頭動画配信など

 オンラインバンキングアプリとデジタル ID の２つの普及が、顧客情報データ収集・検証の両面で銀行にとっての負担を減らしている（瑞、星、印）。
 顧客が website で情報をアップロードするのが標準的な方法である一方、銀行は入手した情報の確認と検証を必要としており、これは依然として目視確認が残る（米、独、豪）。
 英の銀行では個人情報（公開情報あるいは個人が同意した情報）をまとめて提供する FinTech プロバイダの利用を増やしている。
 香の大手銀行は最近、オンラインバンキングアプリ経由で顧客情報をアップロードする
オプションを顧客に提供し始めているが、まだ広く利用されていない。
 銀行は、既存の顧客情報から予想される想定取引パターンと、実際の顧客の取引が整合的かどうかを確認する。不整合がある場合、銀行は調査を実施し、顧客のリスクプロファイルを見直す必要性や、顧客情報の追加的な入手の必要性または STRを提出する必要があるかどうかを判断する（米、英、豪、香）。
 星の銀行では、上記のプロセスにあたりデータアナリティクスツールの利用が多い。
米、英、豪の銀行においてまだほとんど手作業のプロセスである。
 瑞、独、香は、理想的には、取引モニタリングシステムのシナリオは、顧客のプロファイ
ルに合わせて調整されるが、実際には、銀行が、「ベンダーから提供された初期設定」
を変えず、いわば「レディメードの TMS」で対応しているケースが多い。
 米の銀行は CIF（顧客情報ファイル）の不足を補うため、銀行が持つその他の既知のデータを使用する。例えば、継続的な資金源についての情報が欠けている場合、銀行は顧客の取引記録から顧客の職業を特定し、それが顧客の継続的な資金源であると推定する等。
 既存顧客についての最新の情報の取得について、難しさを抱えていないため、業界レベルで特段の対応は行っていない国が多い（米、英、瑞、独、豪、星、印）。
 香の金融業界では、過去 10 年にわたり、HKMA が AML/CFT のリスク及びAML/CFT 規制遵守の重要性に関する顧客意識の向上のため CM やその他マーケ
ティング活動に積極的に取り組んできており（Appendix 3 を参照）、これには顧客による最新情報の提供の必要性が含まれる。これらの措置は、AML/CFT の重要

12

#

観点

日本の状況

海外（意見交換先）の状況
7のマーケティング活動を実施している 。

7性を認識し、顧客が銀行に情報を提供することを受け入れる文化をもたらした。
 星の銀行は、顧客情報の更新を適時に銀行に提供することを拒否することを含め、銀行との契約条件に違反した顧客の口座を凍結または解約することを顧客向けのウェブサイトで明示している。
 いずれの国もポジティブインセンティブは見られない。その理由として、多くの国では①そもそも難しさを抱えていない、②法律上、実務上顧客が最新情報を提供しなければ取引制限、残高維持しなければ手数料というネガティブインセンティブが既に組み込まれている。

https://www.zenginkyo.or.jp/money-laundering/#c43776

13

4. 今後についての示唆・今後の検討ポイント
1.3.仮説の再掲

3.調査結果を踏まえた評価

仮説１ 海外では、顧客との「海外では取引にオンラインバンキング

顧客に対するデジタルチャネル開拓は、各行それぞれの営業戦略に基づき適宜推進している。

間でのやりとりが電子メールやアプリが使われるケースが多く、手紙でDM 郵送に基づく継続的顧客管理の実効性やコスト面の課題は各行にとって解決が難しいところ

Web アプリなどが普通。従っはなくバンキングアプリを使った対顧客であることを踏まえると、AML/CFT 目的達成の観点からもデジタルチャネル対応を一層推進するて、手紙が届かないことによる連絡が可能」との声が多く、仮説１をことが望ましい。8

問題が無い。また電子メール

支持している。

や Web アプリで連絡が取れ示唆・検討ポイント

各行のデジタルチャネル対応を推進するため、デジタルチャネル推進の事例共有等が考えられる。
（参考）なお、AML/CFT 態勢高度化研究会関係者から「電子メールアドレスの対銀行届出をない顧客との間では、取引の必須化できるか」「電子メールによる銀行からの連絡にどういった効力を持たせることができるか」につ一時停止・中断が広く行わいても要検討との指摘があった。

れ、また顧客からもそれが受け入れられている。
仮説 2 海外の（一部の）デジタル ID が普及している星、印、瑞

我が国におけるデジタル ID および関連する制度として、マイナンバーカードの公的個人認証、およ国では、デジタル ID が普及しでは、取引開始時はもちろん継続的びこれを利用することを前提とした犯収法施行規則 6 条 1 項 1 号ワ等が挙げられる。マイナンバており、一定期間の経過など

顧客管理の際にもデジタル ID が有効

ーカードの普及率が今後一層拡大することが見込まれ、政府も様々な施策に取り組んでいる9。

で継続的顧客管理が必要ととの見方が示され、仮説２を支持して（参考）2021 年 9 月 1 日時点の普及率 37.6％（交付枚数／人口）。政府は 2022 年なった顧客に対しては、デジタいる。

度末にほぼ全ての国民が取得することを目指している。

ル ID の提示を求め、それとと8同時に、なりすまし等の非対面チャネル固有のリスクについては適切に対応することが前提となる。

9

マイナンバーカード機能のスマートフォン搭載、公的個人認証における基本４情報の提供等

一方で、本人確認情報の更新を含む CDD の対応高度化においては、このような国の制度・施14

1.3.仮説の再掲

3.調査結果を踏まえた評価

示唆・検討ポイント

もに当該顧客の最新時点で

策と十分関連付けて検討するに至っていない銀行が少なくない状況と言える。10の住所等の情報取得が可能

各行が、上記のような検討を推進するために、官民での協力体制を今後検討していくことが考えらとなっている。

れる。例えば、当局からの制度・施策に関する必要な情報の共有を頂き、公的個人認証制度の利用を検討する際の共通の課題に関する検討、必要に応じた当局への働きかけが考えられる。

仮説 3 海外では、消費者は

海外では、銀行顧客が口座維持に必各行が継続的顧客管理を十分にすすめていくことが難しい理由として、①デジタルチャネルが十分

日本のように多くの銀行口座

要な情報提供を怠ることが原則として確立されてないこと②DM 郵送に頼らざるを得ないことがあるが、これらに加えて、左記のようにあまを保有することがない（もしく認められないこと（下記仮説４）、口り使用されないままに、多くの口座を保有するケースが多いことが要因として考えられる。これらの口は銀行口座を保有できない

座維持手数料が存在することから、継座が多数存在したまま、郵送を中心とした継続的顧客管理を継続するのは実効性・効率性双方

Un-banked 層が相応に多続して保有する意義に乏しい口座をの観点からも課題がある。

い）。日本では、口座維持

保有し続けることはまずないとの声が多

これらの課題については、DM 郵送に大きく依拠することなく、継続的顧客管理をすすめるため、各手数料徴収が一般的ではな

かった。これにより左記仮説３は支持行の事例紹介・ノウハウ整理・共有を積極的に行っていくことが望ましいとの意見もあるところであ

いこともあり、あまり使用されな

される。

る。

いままに、多くの口座を保有しさらには、各行の取組上の課題については、当局からの国民への周知が期待される。

続けるケースが多い。このような口座を対象に継続的顧客管理が行われる場合、利用者は煩わしいと感じ、回答のインセンティブは低くなる。
仮説 4 海外では、口座を持

10

海外では、

FATF 第 4 次対日相互審査では、「顧客が金融機関の CDD 義務履行上の求めに応じなかっ

なお、邦銀の一部から、マイナンバーカード等から得られる基本情報以外の情報取得方法は、別途検討する必要があるとの指摘があった。

15

1.3.仮説の再掲

3.調査結果を踏まえた評価

示唆・検討ポイント

つ銀行に自らの最新情報を①法規制において、AML/CFT 目的

た場合、契約関係・取引を継続するかどうかの対応が金融機関によって分かれている。加えて金

更新しておかないと口座取引で情報提供に消極的な顧客との取引

融機関はこのような局面で取引関係を謝絶することは求められていない。11」と指摘されている。

の停止を受けることがむしろ当に制限的に対応せよとする姿勢が明

我が国の CDD は金融庁ガイドライン（相互審査上法的拘束力をもつ）にあるが、他方、海外たり前と考えられており、そのた

確、においては、法令レベルで同趣旨が規定されていることが多く（Appendix 1）、この違いが、国め、顧客が銀行に自らの最新②そうしたもとで、銀行は取引制限・口民への理解の深度に影響を及ぼす要因と考えられる。仮説６のとおり国民の理解が十分得られ情報を提供することに抵抗や座閉鎖等を実施、ていない現状、ならびに取引制限を規定するものが法令でなく、必要に応じてリスク低減措置をと遅滞が生じにくい。

③顧客側でも、自分の情報を提供しるべきといったガイドライン（含む FAQ)と、各行が預金者との間で締結している預金約款のみであないと銀行から取引制約や口座廃止

り、法的裏付けが海外での事例と比較しても弱い。そのような中で、金融機関は引き続き、顧客の措置を受けるのは当たり前と理解さから必要な情報を得ること、および得られなかった場合、適切な措置をとることについて対応に苦慮れている、する局面が今後も解消されないことが懸念される。

といった状況であり、左記仮説４は支

我が国では、CDD の国民の理解を推進していくため、官民が一体となって国民への情報発信や持される。

規制上のより一層の明確化の働きかけ等を行っていく必要がある。

仮説 5 海外では、SDD の

海外では「当局は既存顧客の情報取仮説３のとおり、我が国では海外に比べて、顧客が継続して保有する意義に乏しいものを含め複範囲（FAQ で示されたリスク

得の要否をリスクベースで判断すべきと数口座を保有していることで、CDD を実施することが必要な口座の比率が海外よりも高いことがに応じた簡素な顧客管理）している」とする国が多かった。これによ想定される。他方、海外においては、特にマスリテールのリスクの低い顧客層については、一律に何が日本よりも広く認められており仮説５は支持される。

年に一回という CDD ではなく、イベントベースでの CDD を実施しているとの回答が多かった。こうり、定期的な CDD に応じなしたことを踏まえると、SDD の範囲や対応方法について各行の事例照会、ノウハウ整理・共有等

ければいけない顧客層が相対を進めつつ、そういった情報も参考に、各行において自らリスクベース判断し対応を進めていく必要“FIs have some flexibility to continue to engage into the relationship or conduct the transaction, if a customer does not respond to the request for verification (CDD measures) at the time of transaction.
In addition, FIs are not required to terminate the business relationship under this scenario.” FATF, Mutual Evaluation Report Japan, P283.
11

16

1.3.仮説の再掲

3.調査結果を踏まえた評価的に少ない。

示唆・検討ポイントがある。
海外の事例にもある、イベントベースでの対応の仕方については、取引モニタリングと CDD の関係の深化を求める FATF 対日審査結果12も踏まえて検討することが必要である。

仮説 6 国民文化（消費者

米・瑞・香で「自分たちの国でも昔と今

海外事例では、国民の生命の危機、日常生活に潜んでいたシステミックな不法行為の暴露14、あの考え方、姿勢）の違いといは違う」として、国民の理解が進んだ背るいは当該行為にからんだ自殺等15の衝撃的な事件等が、社会全般に甚大かつ深刻なインパク

うことが考えられる。日本で景として、国民生活に直結するテロ、マトを与えたことによって、国民の意識が大きく変わり得ることを示している。加えてこのような国民のは、自らの苗字や住所など基

ネロンスキャンダルおよびこれを契機とし危機意識に基づき、当局が適切に法制度を整備し、金融機関やこれを利用する国民への説明

13

本的な情報についても「なるべた当局の姿勢の変化 をあげた。この責任を果たした結果、国民に一定の納得性が浸透しつつ、金融実務が変わってきたということもでく他者」に伝えない傾向が強観点から仮説６は支持される。

きる。

い。

この点、FATF 第４次対日相互審査結果にもあるとおり、日本は「全体として実際のテロ資金供与リスクは相対的に低い」とされていることから、国民の AML/CFT への理解が左記のような各国と異なり、これを変えることは、容易ではないことも推察される。

パラグラフ 366 “Regarding ongoing CDD, FIs are starting to build up systems to maintain accurate and relevant customer information, according to the requirements of the JFSA Guidelines. However,
the ongoing CDD measures seem limited to updating information collected on the customer and to screening lists. Conducting ongoing CDD following this approach does not allow FIs to makeconnections between the customer’s profile and his/her operations, and to detect potential deviation from the expected customer’s behaviour. Supervisory interpretation or guidance would be needed toaddress this weakness and improve the effectiveness of the implementation of ongoing CDD requirements (see IO 3). As reported in the 2019 JFSA AML/CFT report, some FIs are currently considering
the utilization, designing or implementing IT systems for CDD and transaction monitoring and transaction filtering/screening. However, these IT systems are mostly not in place yet, while theireffectiveness, where already in place, is still limited (mega banks and some regional banks, which have already implemented transaction monitoring systems with thresholds adjusted to customer risk
profiles, are still facing many challenges, such as a very high ratio of false positives).”
1213

米：9.11 同時多発テロ以降の PATRIOT ACT 制定、瑞：北欧の大規模マネロンスキャンダル後の当局の AML/CFT 対応厳格化等

14

シティバンクのメキシコ支社の麻薬関連取引への関与が社会の不安定化につながると意識された例。

15

ダンスケ銀行エストニア支社長の自殺の例。

17

1.3.仮説の再掲

3.調査結果を踏まえた評価

示唆・検討ポイント
ML/TF の社会に及ぼす害、これを防止・検知することの社会的な要請、金融機関に求められている義務とそれに国民が応じる意義については、国際社会における日本の立ち位置も含め、今まで以上に官民をあげて積極的かつ継続的に情報発信していく必要がある。

仮説７ 海外では、既存顧

海外には「プラスのインセンティブがあ

プラスのインセンティブについては、継続的顧客管理としてのみではなく、仮説 1 で記載したようなデ客が最新の顧客情報を銀行る」とした国は無かった。他方「マイナスジタルチャネル誘導の一環として取り組むことも考えられる。

に提供しやすくする、ないしはのインセンティブはある」として取引制約

ただし、マイナスインセンティブに関しては、海外事例における法制化や規制当局の厳格な姿勢、せざるを得ないようなインセンや口座廃止の措置をあげる国々は多社会的な合意形成等を踏まえ、我が国における対応を総合的に検討していく必要がある。

ティブを銀行が与えている。

かった（この観点から仮説７は支持される）。

海外では、顧客リスク３段階16ごとの継続的顧客管理の更新頻度について、当局の期間指定が厳格になった例17もあれば、長期化した例18もある。「銀行のリスク対応状況が不適切」と判断された場合当局対応が厳格化され、「適切」と判断された場合緩和されていることが示唆されている。

（Appendix 1）情報更新について非協力的な顧客に対する対象国該当規制（抜粋）
国・規制名
英国
The Money Laundering, Terrorist

規制条項（抜粋）
Requirement to cease transactions etc.
31.—(1) Where, in relation to any customer, a relevant person is unable to apply customer due

16

Low-Middle-High

17

豪：以前は当局規制が厳しく無かったが、最近、1-3-5 年の指導が明確化。

18

独：ガイドライン更新前の多くの例 1-3-5 年→更新後のガイドラインに 2-7-15 年と明記された。

18

国・規制名規制条項（抜粋）

Financing and Transfer of Funds(Information on the Payer)
Regulations 201719

diligence measures as required by regulation 28, that person—(a) must not carry out any transaction through a bank account with the customer or on behalf of thecustomer;(b) must not establish a business relationship or carry out a transaction with the customer otherwise
than through a bank account;(c) must terminate any existing business relationship with the customer;(d) must consider whether the relevant person is required to make a disclosure (or to make further
disclosure) by—(i) Part 3 of the Terrorism Act 2000(11); or(ii) Part 7 of the Proceeds of Crime Act 2002(12).
5.8.1 Principles
The termination obligation in case of the actual or legal impossibility of fulfilment of one of the due
diligence obligations indicated in section 10 (1) nos. 1 to 4 of the GwG applies without any
restrictions. Pursuant to section 14 (3) of the GwG and section 15 (9) of the GwG, this also applies
where the relevant simplified or enhanced due diligence obligations cannot be fulfilled.
In case of existing business relationships, if the above-mentioned due diligence obligations cannot be
fulfilled notice of regular or extraordinary termination must be provided (where applicable, whilereferring to a violation of the relevant persons’ obligation to cooperate as well as a possible
termination obligation stipulated by law), irrespective of the (in-) applicability of other statutory or
contractual provisions or else termination must be otherwise effected.
Chapter 3 Customer knowledge
Prohibition of business relationships and transactions
Insufficient customer knowledge§ 1 An operator may not establish or maintain a business relationship or perform a single

ドイツInterpretation and Application
Guidance in relation to theGerman Money Laundering Act(Geldwäschegesetz – GwG)20

スウェーデン
Act (2017: 630) on measuresagainst money laundering andterrorist financing21

19

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, Part 3 Customer Due Diligence, Chapter 1 Customer due diligence: general, 31.
Requirement to cease transactions, etc. https://www.legislation.gov.uk/uksi/2017/692
Interpretation and Application Guidance in relation to the German Money Laundering Act (Geldwäschegesetz – GwG), Customer-related due diligence obligations, 5.8 Non-establishment/terminationof business relationships and non-implementation of transactions, section 10 (9) of the GwG, 5.8.1 Principles.
https://www.bafin.de/SharedDocs/Downloads/EN/Auslegungsentscheidung/dl_ae_auas_gw2020_en.pdf?__blob=publicationFile&v=1
20

21

Act (2017: 630) on measures against money laundering and terrorist financing, Chapter 3 Customer Knowledge, Prohibition of business relationships and transactions, Insufficient customer
knowledge.

19国・規制名

オーストラリア
Anti-Money Laundering andCounter-Terrorism Financing
Rules 2007 (No. 1)22

香港
Guideline on Anti-Money
Laundering and CounterFinancing of Terrorism(For Authorized Institutions)23

シンガポール

規制条項（抜粋）
transaction, if the operator does not have sufficient knowledge of the customer to be able to
1. manage the risk of money laundering or terrorist financing that may be associated with thecustomer relationship, and
2. monitor and assess the customer's activities and transactions according to Ch. 1 and 2 §§.
CHAPTER 15 Ongoing customer due diligence15.10 The enhanced customer due diligence program must include appropriate risk-based systems
and controls so that, in cases where one or more of the circumstances in paragraph 15.9 arises, areporting entity must undertake measures appropriate to those circumstances, including a range ofthe measures in subparagraphs 15.10(1) to (7):(5) undertake more detailed analysis and monitoring of the customer’s transactions – both past andfuture, including, but not limited to:(a) the purpose, reasons for, or nature of specific transactions; or(b) the expected nature and level of transaction behavior, including future transactions;(6) seek senior management approval for:(a) continuing a business relationship with a customer; and(b) whether a designated service should continue to be provided to the customer;(7) consider whether a transaction or particular transactions should be processed.
4.13 Failure to satisfactorily complete CDD
s.3(1) & (4), Sch. 2(4.13.1) Where the AI is unable to comply with relevant CDD requirements set out in this Chapter
and the ongoing due diligence requirements set out in Chapter 5, it should not establish a business
relationship or carry out any occasional transaction with that customer, or should terminate business
relationship as soon as reasonably practicable (where applicable), and where there is relevant
knowledge or suspicion, should make an STR to the JFIU.
Where Measures are Not Completed

https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-forfattningssamling/lag-2017630-om-atgarder-mot-penningtvatt-och_sfs-2017-630 (Google translation from Swedish).
22

Anti-Money Laundering and Counter-Terrorism Financing Rules 2007 (No. 1), CHAPTER 15 Ongoing customer due diligence, 15.10.
Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1) (legislation.gov.au)
23

Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Authorized Institutions), 4.13 Failure to satisfactorily complete CDD, s.3(1) & (4), Sch. 2, 4.13.1.
https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and-circular/guideline/g33.pdf

20国・規制名規制条項（抜粋）

MAS Notice 626
Prevention on Money Launderingand Countering The Financing ofTerrorism- Banks24

6.35 Where the bank is unable to complete the measures as required by paragraphs 6, 7 and 8, it
shall not commence or continue business relations with any customer, or undertake any transaction
for any customer. The bank shall consider if the circumstances are suspicious so as to warrant thefiling of an STR.
6.36 For the purposes of paragraph 6.35, completion of the measures means the situation where thebank has obtained, screened and verified (including by delayed verification as allowed underparagraphs 6.33 and 6.34) all necessary CDD information under paragraphs 6, 7 and 8, and where
the bank has received satisfactory responses to all inquiries in relation to such necessary CDD
information.
Existing Customers
6.38 A bank shall perform the measures as required by paragraphs 6, 7 and 8 in relation to its
existing customers, based on its own assessment of materiality and risk, taking into account any
previous measures applied, the time when the measures were last applied to such existing customers
and the adequacy of data, documents or information
obtained.
Chapter VI
Customer Due Diligence (CDD) Procedure
Part I - Customer Due Diligence (CDD) Procedure in case of Individuals
If the CDD procedure as mentioned above is not completed within a year, in respect of deposit
accounts, the same shall be closed immediately. In respect of borrowal accounts no further debits
shall be allowed.
Part V - On-going Due Diligence
Provided further that if a customer having an existing account-based relationship with a RE gives inwriting to the RE that he does not want to submit his Permanent Account Number or equivalent edocument thereof or Form No.60, RE shall close the account and all obligations due in relation to theaccount shall be appropriately settled after establishing the identity of the customer by obtaining theidentification documents as applicable to the customer.

インド
Master Direction – Know Your
Customer (KYC) Direction, 2016
(Updated as of May 10, 2021)25

24

MAS Notice 626, Prevention on Money Laundering and Countering The Financing of Terrorism- Banks, Where Measures are Not Completed, 6.35, 6.36, 6.38.
https://www.mas.gov.sg/-/media/MAS-Media-Library/regulation/notices/AMLD/notice-626/MAS-Notice-626---Banks.pdf
Reserve Bank of India, Master Direction – Know Your Customer (KYC) Direction, 2016 (Updated as of May 10, 2021), Chapter VI, Part I Customer Due Diligence (CDD) Procedure in case ofindividuals and Part V – On-going Due Diligence. https://m.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=11566
25

21

22

（Appendix 2）対象国の一部における SDD 関連規制の抜粋
英国
規制名：The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 201726
Chapter 3. Simplified customer due diligence37(1)A relevant person may apply simplified customer due diligence measures in relation to a particular business relationship ortransaction if it determines that the business relationship or transaction presents a low degree of risk of money launderingand terrorist financing, having taken into account—(a) the risk assessment it carried out under regulation 18(1);(b) relevant information made available to it under regulations 17(9) and 47; and(c) the risk factors referred to in paragraph (3).
37(2)
Where a relevant person applies simplified customer due diligence measures, it must—(a) continue to comply with the requirements in regulation 28, but it may adjust the extent, timing or type of the measures
it undertakes under that regulation to reflect its determination under paragraph (1); and(b) carry out sufficient monitoring of any business relationships or transactions which are subject to those measures toenable it to detect any unusual or suspicious transactions.
37(3)(a)When assessing whether there is a low degree of risk of money laundering and terrorist financing in a particular situation,and the extent to which it is appropriate to apply simplified customer due diligence measures in that situation, the relevant
person must take account of risk factors including, among other things—(a) customer risk factors, including whether the customer—(i) is a public administration, or a publicly owned enterprise;(ii) is an individual resident in a geographical area of lower risk (see sub-paragraph (c));(iii) is a credit institution or a financial institution which is—(aa) subject to the requirements in national legislation implementing the fourth money laundering directive as an obliged
entity (within the meaning of that directive), and(bb) supervised for compliance with those requirements in accordance with section 2 of Chapter VI of the fourth money

26

https://www.legislation.gov.uk/uksi/2017/692/pdfs/uksi_20170692_en.pdf

23

37(3)(b)37(3)(c)

37(4)
37(5)

laundering directive;(iv) is a company whose securities are listed on a regulated market, and the location of the regulated market;(b) product, service, transaction or delivery channel risk factors, including whether the
product or service is—(i) a life insurance policy for which the premium is low;(ii) an insurance policy for a pension scheme which does not provide for an early surrender option, and cannot be used ascollateral;(iii) a pension, superannuation or similar scheme which satisfies the following
conditions—(aa) the scheme provides retirement benefits to employees;(bb) contributions to the scheme are made by way of deductions from wages; and(cc) the scheme rules do not permit the assignment of a member’s interest under the scheme;(iv) a financial product or service that provides appropriately defined and limited services to certain types of customers toincrease access for financial inclusion purposes in an EEA state;(v) a product where the risks of money laundering and terrorist financing are managed by other factors such as purse limits
or transparency of ownership;(vi) a child trust fund within the meaning given by section 1(2) of the Child Trust Funds Act 2004(a);(vii) a junior ISA within the meaning given by regulation 2B of the Individual Savings Account Regulations 1998(b);(c) geographical risk factors, including whether the country where the customer is resident, established or registered or inwhich it operates is—(i) an EEA state;(ii) a third country which has effective systems to counter money laundering and terrorist financing;(iii) a third country identified by credible sources as having a low level of corruption or other criminal activity, such as
terrorism (within the meaning of section 1 of the Terrorism Act 2000(c)), money laundering, and the production and supplyof illicit drugs;(iv) a third country which, on the basis of credible sources, such as evaluations, detailed assessment reports or publishedfollow-up reports published by the Financial Action Task Force, the International Monetary Fund, the World Bank, theOrganisation for Economic Co-operation and Development or other international bodies or nongovernmental organisations—(aa) has requirements to counter money laundering and terrorist financing that are consistent with the revised
Recommendations published by the Financial
Action Task Force in February 2012 and updated in October 2016; and(bb) effectively implements those Recommendations.
In making the assessment referred to in paragraph (3), relevant persons must bear in mind that the presence of one ormore risk factors may not always indicate that there is a low risk of money laundering and terrorist financing in a particularsituation.
A relevant person may apply simplified customer due diligence measures where the customer is a person to whom24

37(6)

37(7)
37(8)

paragraph (6) applies and the product is an account into which monies are pooled (the “pooled account”), provided that—(a) the business relationship with the holder of the pooled account presents a low degree of risk of money laundering andterrorist financing; and(b) information on the identity of the persons on whose behalf monies are held in the pooled account is available, onrequest to the relevant person where the pooled account is held.
This paragraph applies to—(a) a relevant person who is subject to these Regulations under regulation 8;(b) a person who carries on business in an EEA state other than the United Kingdom who is—(i) subject to the requirements in national legislation implementing the fourth money laundering directive as an obliged
entity (within the meaning of that directive), and(ii) supervised for compliance with those requirements in accordance with section 2 of Chapter VI of the fourth money
laundering directive.
In determining what simplified customer due diligence measures to take, and the extent of those measures, whenparagraph (1) applies, credit institutions and financial institutions must also take account of any guidelines issued by theEuropean Supervisory Authorities under Article 17 of the fourth money laundering directive.
A relevant person must not continue to apply simplified customer due diligence measures under paragraph (1)—(a) if it doubts the veracity or accuracy of any documents or information previously obtained for the purposes ofidentification or verification;(b) if its risk assessment changes and it no longer considers that there is a low degree of risk of money laundering andterrorist financing;(c) if it suspects money laundering or terrorist financing; or(d) if any of the conditions set out in regulation 33(1) apply.

ガイダンス名：JMLSG Prevention of money laundering/combating terrorist financing, Part I27
5.4 Simplified due diligence
5.4.1
A firm may apply SDD measures in relation to a particular business relationship or transaction if it determines that, taking
into account its risk assessment, the business relationship or transaction presents a low degree of risk of ML/TF.

27

https://secureservercdn.net/160.153.138.163/a3a.8f7.myftpupload.com/wp-content/uploads/2020/07/JMLSG-Guidance_Part-I_-July-2020.pdf

25

5.4.2

When assessing whether there is a low degree of risk of ML/TF in a particular situation, and the extent to which it isappropriate to apply SDD measures in that situation, a firm must take account of at least the following risk factors:(i) Whether the customer is –
 a public administration, or a publicly owned enterprise 5.3.192/193
 an individual resident in a geographical area of low risk
 a credit or financial institution subject to the requirements in the fourth money laundering directive (see paragraph5.3.133)
 a company listed on a regulated market (see paragraph 5.3.155)
 firms holding a pooled account (see paragraph 5.3.142)

5.4.3
5.4.4

5.4.5
5.4.6
5.4.7

5.4.8

5.4.9

(ii) certain life assurance and e-money products (see Part II, sectors 7 and 3)(iii) certain pension funds (see paragraphs 5.4.4 and 5.3.228ff)(iv) Child Trust Funds and Junior ISAs (see paragraphs 5.4.5 - 5.4.7)
Annex 5-III to this chapter sets out suggested Risk Factor Guidelines on Simplified Due Diligence, consistent with thoseissued jointly by the European Supervisory Authorities.
Subject to an assessment of the ML/TF risk presented, SDD measures may be applied to pension, superannuation or similar
schemes which provide retirement benefits to employees, where contributions are made by an employer or by way of
deduction from an employee’s wages and the scheme rules do not permit the assignment of a member’s interest under thescheme.
SDD measures may be applied to Child Trust Funds and Junior ISAs.
In respect of Junior ISAs, although SDD measures may be applied, firms will, however, in due course need to verify identity
at the point the child reaches 18 years and becomes entitled to the funds, or at the next ‘trigger’ event thereafter (unlessthe child’s identity has by then already been verified for the purposes of some other relationship).
With Junior ISAs, the child is able to manage the account from the age of 16, in which case the firm might choose toundertake customer due diligence at that stage in order to avoid delaying any transaction the child should wish to undertakeon reaching 18, when the account becomes a ‘full’ ISA. It is recommended that firms indicate in their product literature etc.
what their policy will be when, for example, the child reaches 16 or 18.
SDD measures must not be applied, or continue to be applied, where: the firm’s risk assessment changes and it no longer
considers that there is a low degree of risk of ML/TF; where the firm suspects money laundering or terrorist financing; orwhere there are doubts about the veracity or accuracy of documents or information previously obtained for the purposes ofidentity or verification.
A determination that SDD measures may be applied in a particular situation does not remove the obligation to conductongoing monitoring of the business relationship, although the extent of this may be adjusted to reflect its determination of
the low degree of ML/TF risk. Such determination does not affect the duty to report knowledge or suspicion of money
laundering or terrorist financing.

26

5.4.10Firms should also document the rationale for the decision to apply SDD.

香港
規制名：Guideline on Anti-Money Laundering and Counter-Financing of Terrorism28
4.1 What CDD measures are
4.1.2
An AI should apply an RBA when conducting CDD measures and the extent of CDD measures should be commensurate with
the ML/TF risks associated with a business relationship. Where the ML/TF risks are high, the AI should conduct enhanced
due diligence (EDD) measures (see paragraph 4.9). In low risk situations, the AI may apply simplified due diligence (SDD)
measures (see paragraph 4.8).
4.8 Simplified due diligence
4.8.1
In general, an AI should carry out all four CDD measures set out in paragraph 4.1.3 before establishing any business
relationship, before carrying out a specified occasional transaction, and continuously monitor its business relationship (i.e.

28

https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and-circular/guideline/g33.pdf

27

4.8.2
4.8.3

4.8.4
4.8.5
4.8.6
4.8.7

4.8.8

ongoing CDD and transaction monitoring). As stated in Chapter 2, the extent of four CDD measures and ongoing monitoringshould be determined using an RBA.
An AI may apply SDD measures in relation to a business relationship or transaction if it determines that, taking into accountits risk assessment, the business relationship or transaction presents a low ML/TF risk.
SDD measures should not be applied or continue to be applied, where:(a) the AI’s risk assessment changes and it no longer considers that there is a low degree of ML/TF risk;(b) where the AI suspects ML or TF; or(c) where there are doubts about the veracity or accuracy of documents or information previously obtained for the purposesof identification or verification.
The assessment of low risks should be supported by an adequate analysis of ML/TF risks by the AI.
The SDD measures applied should be commensurate with the nature and level of ML/TF risk, based on the lower ML/TF risk
factors identified by the AI.
When an AI applies SDD measures, it is still required to continuously monitor its business relationship (i.e. ongoing CDD andtransaction monitoring) in accordance with section 5 of Schedule 2 and Chapter 5.
Examples of potentially lower risk factors include:(a) customer risk factors:(i) a government entity or a public body28 in Hong Kong or in an equivalent jurisdiction;(ii) a corporation listed on a stock exchange and subject to disclosure requirements (e.g. either by stock exchange rules, or
through law or enforceable means), which impose requirements to ensure adequate transparency of beneficial ownership;(iii) an FI as defined in the AMLO, or other FI incorporated or established in an equivalent jurisdiction and is subject to andsupervised for compliance with AML/CFT requirements consistent with standards set by the FATF; or(iv) a collective investment scheme authorised for offering to the public in Hong Kong or in an equivalent jurisdiction.
(b) product, service, transaction or delivery channel risk factors:(i) a provident, pension, retirement or superannuation scheme (however described) that provides retirement benefits toemployees, where contributions to the scheme are made by way of deduction from income from employment and thescheme rules do not permit the assignment of a member’s interest under the scheme;(ii) an insurance policy for the purposes of a provident, pension, retirement or superannuation scheme (however described)
that does not contain a surrender clause and cannot be used as a collateral; or(iii) a life insurance policy in respect of which:(A) an annual premium of no more than $8,000 or an equivalent amount in any other currency is payable; or(B) a single premium of no more than $20,000 or an equivalent amount in any other currency is payable.
(c) country risk factors:(i) countries or jurisdictions identified by credible sources, such as mutual evaluation or detailed assessment reports, as
having effective AML/CFT Systems; or(ii) countries or jurisdictions identified by credible sources as having a lower level of corruption or other criminal activity.
Examples of possible SDD measures include:

28

(a) accepting other documents, data or information (e.g. proof of FI’s license, listed status or authorization status etc.),other than examples provided in paragraphs 4.3.7 and 4.3.12, for a customer falling within any category specified inparagraph 4.8.7(a);(b) adopting simplified customer due diligence in relation to beneficial owners as specified in paragraph 4.8.9 to 4.8.20;(c) reducing the frequency of updates of customer identification information;(d) reducing the degree of ongoing monitoring and scrutiny of transactions based on a reasonable monetary threshold; or(e) not collecting specific information or carrying out specific measures to understand the purpose and intended nature of
the business relationship, but inferring the purpose and intended nature from the type of transactions or business
relationship established.

シンガポール
規制名：Notice 626 Prevention of Money Laundering and Countering the Financing of Terrorism – Banks29
7. Simplified Customer Due Diligence
7.1
Subject to paragraph 7.4, a bank may perform simplified CDD measures in relation to a customer, any natural person
appointed to act on behalf of the customer and any beneficial owner of the customer (other than any beneficial owner thatthe bank is exempted from making inquiries about under paragraph 6.16) if it is satisfied that the risks of money launderingand terrorism financing are low.
7.2
The assessment of low risks shall be supported by an adequate analysis of risks by the bank.
7.3
The simplified CDD measures shall be commensurate with the level of risk, based on the risk factors identified by the bank.
7.4
A bank shall not perform simplified CDD measures (a) where a customer or any beneficial owner of the customer is from or in a country or jurisdiction in relation to which the
FATF has called for countermeasures;(b) where a customer or any beneficial owner of the customer is from or in a country or jurisdiction known to haveinadequate AML/CFT measures, as determined by the bank for itself or notified to banks generally by the Authority, or otherforeign regulatory authorities; or(c) where the bank suspects that money laundering or terrorism financing is involved.
7.5
Subject to paragraphs 7.2, 7.3 and 7.4, a bank may perform simplified CDD measures in relation to a customer that is a29

https://www.mas.gov.sg/-/media/MAS-Media-Library/regulation/notices/AMLD/notice-626/MAS-Notice-626---Banks.pdf

29

7.6

7.7

financial institution set out in Appendix 2.
Where the bank performs simplified CDD measures in relation to a customer, any natural person appointed to act on behalfof the customer and any beneficial owner of the customer, it shall document (a) the details of its risk assessment; and(b) the nature of the simplified CDD measures.
For avoidance of doubt, the term “CDD measures” in paragraph 7 means the measures required by paragraph 6.

規制名：Guidelines to Notice 626 on Prevention of Money Laundering and Countering the Financing of Terrorism – Banks30
7. Notice Paragraph 7 - Simplified Customer Due Diligence
7-1
Paragraph 7.1 of the Notice permits a bank to adopt a risk-based approach in assessing the necessary measures to be
performed, and to perform appropriate SCDD measures in cases where the bank is satisfied, upon analysis of risks, that the
ML/TF risks are low.
7-2
Where a bank applies SCDD measures, it is still required to perform ongoing monitoring of business relations under the
Notice.
7-3
Under SCDD, a bank may adopt a risk-based approach in assessing whether any measures should be performed forconnected parties of the customers.
7-4
Where a bank is satisfied that the risks of money laundering and terrorism financing are low, a bank may perform SCDD
measures. Examples of possible SCDD measures include ―(a) reducing the frequency of updates of customer identification information;(b) reducing the degree of ongoing monitoring and scrutiny of transactions, based on a reasonable monetary threshold; or(c) choosing another method to understand the purpose and intended nature of business relations by inferring this from thetype of transactions or business relations to be established, instead of collecting information as to the purpose and intended
nature of business relations.
7-5
Subject to the requirement that a bank’s assessment of low ML/TF risks is supported by an adequate analysis of risks,
examples of potentially lower ML/TF risk situations include ―(a) Customer risk(i) a Singapore Government entity;(ii) entities listed on a stock exchange and subject to regulatory disclosure requirements relating to adequate transparency
in respect of beneficial owners (imposed through stock exchange rules, law or other enforceable means); and(iii) an FI incorporated or established outside Singapore that is subject to and supervised for compliance with AML/CFT

30

https://www.mas.gov.sg/-/media/MAS/Regulations-and-Financial-Stability/Regulations-Guidance-and-Licensing/Commercial-Banks/Regulations-Guidance-and-Licensing/Guidelines/MAS-Notice-626Amendments-Nov-15/Guidelines-to-MAS-Notice-626--November-2015.pdf

30

requirements consistent with standards set by the FATF.
(b) Product, service, transaction or delivery channel risk(i) a pension, superannuation or similar scheme that provides retirement benefits to employees, where contributions are
made by way of deduction from wages, and the scheme rules do not permit the assignment of a member’s interest under
the scheme; and(ii) financial products or services that provide appropriately defined and limited services to certain types of customers (e.g.
to increase customer access for financial inclusion purposes).

31

（Appendix 3）Countering Money Laundering and Terrorist Financing- Education and Publicity- Multimedia31
香港政府ウェブサイトに公表されている ML/TF のリスクに対する一般市民の意識を高めるための情報配信キャンペーンのメディア・コンテンツの概要は以下の通り。
コンテンツ名Safeguard Hong Kong's status as an international financial
centre - YouTube

概略（KPMG 香港記載）
It is a TV announcement in the public interest aired in 2012 to promote
the new law (i.e. The Anti-Money Laundering and Counter-Terrorist
Financing (Financial Institutions) Ordinance) in the financial sector tosafeguard Hong Kong’s status as an international financial centre.

Micro-Film - The Stooges (police.gov.hk)

The Hong Kong Police Force aired a micro-film adapted from a real casein 2015 to raise public awareness about the criminal liability of money
laundering arising from the opening of bank accounts for use of criminals.
(It is conducted in Cantonese, cannot find English version)

Police Report - 2016-2-26 - YouTube“Police Report” is a show conducted by the Hong Kong Police Force tobring some important messages to raise public awareness. This video
was aired in 2016 by the Hong Kong Police Force to share two real-life
examples of money laundering activities that may happen around the
public and raise public awareness of these traps.

（Appendix 4）ヒアリング記録
今回対象とした８ヵ国の KPMG メンバーファームに対するヒアリング記録は以下のとおり。

31

https://www.fstb.gov.hk/fsb/aml/en/edu-publicity/multimedia.htm

32

米国
#

Viewpoint

1

Do FIs in your country have difficulty obtaining thelatest information about existing customers?

Discussion Details
 Like all jurisdictions, this is an issue, but for retail banking, US customers
are used to providing information so it may not be as challenging as insome other countries.
 People in the US are used to providing their information to banks,
particularly high net worth individuals who tend to have numerous bank33

2

Means of contacting existing customers (by post,
emails, apps, etc.)3

The use of/methods of restricting or suspendingtransactions for non-cooperative customers interms of providing updated information, customer
response to such measures, the underlying laws
and regulatory guidance (guiding principles) andaccounts and regular interactions with banks.
 There is not a regulatory requirement stipulating a set schedule for
periodic review, and accordingly banks in the US do not take a consistent
approach to scheduled OCDD, rather each bank adopts an approachaccording to the bank’s risk appetite. That being said the regulatory
expectation is that high risk customer are reviewed regularly and that
there is a mechanism in place to ensure that all customer go through aperiodic review when there are triggering factors. From this perspective,
many banks do adopt a schedule to include all customer risks.
 Some banks have adopted a H=1 year/M=3 year/L=5 year approachfor OCDD, while others do not perform periodic review for L risk
customers at all.
 Some banks perform OCDD for M and L risk customers only based on
trigger events, with H risk customers reviewed on a yearly basis inaddition to monitoring for trigger events.
 Triggers are different for each bank. The bank needs to demonstrate to
the regulator that the level of CDD and ongoing monitoring iscommensurate with the customer risk.
 Most customers in the US use online banking and customer interaction ismainly through the bank’s app.
 Banks may send letters to customers via post, but this will be in
conjunction with emails and interaction through the online banking app.
 In the US, when updated customer information is required, the bank will
flag the customer’s account as “Information pending” in the bank systems,
both in the account and online.
 Online banking customers attempting to access their account online
will then be prompted with a screen requesting the customer toprovide the updated information in order to access the account.

34

status of regulations, and the existence ofprovisions in the contracts between FIs andcustomers (Presence or absence of an environment
or mechanism that allows for transaction
restriction)

4

Ease of obtaining the latest customer information
through the spread of digital ID use

5

The number of bank accounts for consumers andthe impact on their willingness to provide
information to banks

Customers who dial into a call center or enter a bank branch will be
requested by bank staff to provide the updated information before
being able to proceed with their transaction.
 Banks in the US take a very conservative approach to actually
blocking/preventing transactions or freezing accounts as this may comeinto conflict with consumer protection regulations. Instead, as a first stepbanks will typically prevent the customer from using certain features of
their online account until responses are provided; however, banks will still
permit regularly occurring transactions (bill payment, salary deposit, etc.)
to occur.
 If the customer still does not provide their updated information, the bankwill undertake a review of the customer relationship and consult with thelegal department to determine whether the customer’s account should be
frozen or closed from an AML risk perspective.
 No use of digital ID either by the government or by third party solution
providers.
 Customers in the US may have numerous bank accounts in the US, butthese accounts are typically utilized by customers on a regular or semiregular basis.
 If there is no activity on an account for a certain period (3-5 years,
depending on state law) and the bank cannot get in touch with theaccount holder, then the account becomes dormant and the bankbegins procedures to move the account to abandoned property, which
is managed by the state.
 The bank will notify the account holder that the account has become
dormant and the customer will typically have to respond to the bankwithin a set timeframe to either claim the funds in the account orreactivate the account.

35

If the customer does not respond to the bank notification, the balanceof the account is turned over to the state treasury, where the funds areheld as unclaimed property.
 Banks will assess a monthly fee on accounts that fall below a certainbalance.


6

Presence or absence of an account maintenance fee

7

Does the widespread use of the customer uploading
their updated information via the FI's website leadto reduced burden on FIs?

8

Is there a mechanism (system) used by FIs to
extract information from transaction data necessary
and useful for the KYC process from transaction
data (e.g. whether the consumer is a salaried
worker or a pensioner)?

 This is standard practice for most customers at most banks. Obtaining thisinformation online is faster than by post but banks still need to confirm
and verify the information, which is largely still a manual process.
 Banks will utilize Lexis Nexus or other third party vendor solutions totriangulate customer information from external sources (e.g., publicrecords of criminal history). Depending on the product for which thecustomer is onboarded, the social security provided by the customer may
then be cross-referenced against, for example credit reporting databases(specifically for loans and/or credit card applications) to match the social
security number provided by the customer to the customer’s name.
 Banks also try to use other data elements known by the bank tosupplement missing information in the customer information file. For
example, for ongoing source of funds, banks will review the customer’stransactions to identify the customer’s occupation and then deduce that
this is the customer’s ongoing source of funds.
 Banks will build expected customer activity based on the informationcollected in the CDD process and then monitor the customer’s transactions
to check whether these two are aligned. If there is an inconsistency
between the expected and actual activity the bank will perform an
investigation to determine whether the customer’s risk profile needs to bereevaluated, whether there is potentially suspicious activity occurring if theactivity is unusual, and/or whether additional or updated customer

36

9

Measures taken by individual FIs and the financial
services industry when banks have difficulty
obtaining the latest information about existingcustomers

information needs to be obtained.
 There is not a consistent practice at the industry level. Individual banks
apply an approach consistent with their risk appetite outlined in #1-8
above.
 Additionally, there is no incentive program used by banks or industry toobtain updated customer information.

英国#

Viewpoint

1

Do FIs in your country have difficulty obtaining thelatest information about existing customers?

Discussion Details
 This is not viewed as an issue in the UK for the following reasons: There is an overarching obligation to ensure that customer information is
up-to-date, but the obligation does not specify a specific timeline for this.
 High Risk customers are subject to enhanced levels of scrutiny, which
results in an annual KYC review.
 On the other hand, the vast majority of banks will not apply OCDD to L
Risk retail customers unless there is a material gap in the criticalinformation from the customer (name, address, date of birth, nationality).
 Additionally, in order to obtain the information above, banks will typically
rely on service providers offering electronic Identification & Verification(see #4 below) to verify the information through third party sources
rather than contacting the customer directly.
 For data points that are not critical (e.g. occupation), banks will derive thedata based on customer information already known, such as transaction
information. For occupation, the bank would review the customer’stransactions and for example if a fixed amount is deposited in thecustomer’s account on a monthly basis, the bank would deduce that thecustomer is an employee of that company.

37

2Means of contacting existing customers (by post,
emails, apps, etc.)

 Most customers in the UK use online banking and therefore customer
interaction is mainly through online banking applications.
 At the same time, most banks in the UK will adopt a multi-channel
approach to allow the customer to respond in the manner that is mostconvenient to the customer.
 For example, the bank will send a letter to the customer, but thecontent of the letter will also appear as a message within thecustomer’s online banking app, and call center staff, bank branch staff
will also be alerted when speaking to the customer. The customer canthen choose which channel to use to provide the information.
 Digital channels are very effective for obtaining updated identification
documents because the bank can provide detailed guidance to thecustomer that is not possible via post. Verification of the documents canalso be performed using service providers to provide feedback to thecustomer in real-time (as opposed to the image being sent to the bank via
post, reviewed by the bank for several days/weeks, then going back to thecustomer for additional information).
 To obtain updated information from customers, banks will try to linkcommunication with customers to existing interactions that the customer
has with the bank.
 For online banking customers, the next time the customer logs into their
online banking app, the customer will be prompted to provide updated
information.
 For non-online banking customers, the customer account will be flagged sothat the next time the customer calls into a call center or visits a branch,bank employees will request the information from the customer.
 Additionally, banks will use BAU interactions with customers, such as
inquiry regarding a new product or changing the terms of an existingproduct to review or refresh the customer data, irrespective of where the

38



3

The use of/methods of restricting or suspendingtransactions for non-cooperative customers interms of providing updated information, customer
response to such measures, the underlying laws
and regulatory guidance (guiding principles) andstatus of regulations, and the existence ofprovisions in the contracts between FIs andcustomers (Presence or absence of an environment
or mechanism that allows for transaction
restriction)customer is in the periodic review cycle. In such cases, the bank will ask
the customer whether the information is still up-to-date and use that
opportunity to fill in any gaps in information. The customer is thenincentivized to provide that information because they are seeking a
product or service from the bank.
Case study: KYC remediation engagement for GSIFI
 Using letters to reach out to customers: 5% response rate Online banking app w/multi-channel approach above: 90% response
rate
Restrictions on accounts are applied following a reasonable amount of timeand number of attempts to obtain updated information from the customer.
If a customer has mail returned as “person not at that address”, this will
be a trigger to limit customer activity on the account, because the bankwould be concerned of the fraud risk associated with the account.
Banks will take an incremental approach to placing restrictions on acustomer’s account. This is due to recent cases where banks have placed
heavy restrictions on customer accounts which directly resulted in anegative impact on the customers quality of life, such as credit scores
suffering due to inability to pay on a mortgage or electricity being cut off
due to inability to pay electrical bill.
 First the bank would restrict the customer’s ability to withdraw cash or
to initiate new payments outside the regular payment cycle.
 Regular payments will still be permitted, but discretionary payments(e.g. one-off payments to individuals or shopping) will not be
permitted.
 If there is still no response from the customer following the restrictions
above, the bank will assess the situation and determine whether the
gap has a regulatory implication or cannot be derived from internalsources or obtained from a third party.

39

In such cases, the bank will issue a notice notifying the customer thatthe account will be closed within 90 days. The funds will then be madeavailable to be returned to the customer once they contact the bank.
There is not a piece of regulation that clearly articulates what banks canand cannot do in terms of account closure. The Money Laundering
Regulations state that banks cannot maintain a relationship with acustomer if they are unable to complete customer due diligence. Banks will
make a decision on whether to limit or close a customer account based on
their assessment of the criticality of the gaps in customer information.
The bank’s discretion to limit a customer’s transactions or close theaccount is also stipulated in the terms and conditions of the contract withthe customer.
There is not a digital ID in the same sense of other countries such asSingapore.
The UK does have electronic Identification and Verification (ID&V), wherea third party service provider (Experion and Equifax as credit agencies,
Fintechs such as Onfido and Jumio) will access a number of data sets fromgovernment records, public sources and from participating banks totriangulate name, address, date of birth. For example, to obtain address
information the ID&V service would access the Electoral Register.
 By using this scheme, the banks can verify customer information
independently using third party information rather than contacting thecustomer directly.
It is not uncommon for consumers in the UK to have multiple bankaccounts.
 Consumers will often have a traditional bank account (HSBC, Barclays,etc.), as well as a FinTech bank account (Revolut, etc.) that allows
better international services, which may be used for specific purposes(such as for international travel) rather than on a day-to-day basis.






4

5

Ease of obtaining the latest customer information
through the spread of digital ID use

The number of bank accounts for consumers andthe impact on their willingness to provide
information to banks






40

6

Presence or absence of an account maintenance fee

7

Does the widespread use of the customer uploading
their updated information via the FI's website leadto reduced burden on FIs?

8

Is there a mechanism (system) used by FIs to
extract information from transaction data necessary
and useful for the KYC process from transaction
data (e.g. whether the consumer is a salaried
worker or a pensioner)?

9

Measures taken by individual FIs and the financial
services industry when banks have difficulty
obtaining the latest information about existingcustomers

 No monthly maintenance fees on customer accounts.
 The response rate from customers is much higher via digital channels vs.
sending letters (90% vs. 5%).
 Additionally, online verification of identity documents results in a
substantial reduction in resources required by the bank in comparison to
manually reviewing and confirming copies of identification documents
received.
 Banks will review customer transactions to look for indicators that acustomer has changed occupation or address, and if such indicators are
identified this will trigger a KYC review.
 Banks will use third party service providers to obtain customer informationfrom multiple sources such as government records, publicly available
information or even from other FIs participating in electronic ID&V
schemes (see #4 above).
 There is not a consistent approach applied at the industry level. Individual
banks obtain updated customer information from third party information(#4 above) along with multi-channel communication with customers (#2
above). If banks are unable to obtain updated customer information
through these means, they will apply restrictions on customer accounts on
an incremental approach, and may close the customer account if the bankdetermines that the information gap results in a substantial risk from an
AML compliance perspective.
 Additionally, there is no incentive program used by banks or industry toobtain updated customer information.

41

ドイツ
#

Viewpoint

1

Do FIs in your country have difficulty obtaining thelatest information about existing customers?

Discussion Details
 Banks face challenges in obtaining the latest information about existingcustomers to some extent, but this issue has been mitigated by the risk
classification framework for retail customers, as well as the requirement tooffboard customers who do not provide updated customer information(see #3 below).
 The supervisory expectation is that banks with similar characteristics will

42



2

3

Means of contacting existing customers (by post,
emails, apps, etc.)

The use of/methods of restricting or suspendingtransactions for non-cooperative customers interms of providing updated information, customer
response to such measures, the underlying laws
and regulatory guidance (guiding principles) andstatus of regulations, and the existence ofprovisions in the contracts between FIs andcustomers (Presence or absence of an environment
or mechanism that allows for transaction
restriction)









follow a similar periodic review cycle.
About three years ago, common practice for mass market retail banks was(H= 1 year/ M= 3 years/ L= 5 years), but the recent update of theregulatory guidelines allows banks to have even more relaxed frequencies:
2 / 7 / 15 years. Still we see that banks remain stricter than required
For inactive accounts no update of the KYC files are required.
The majority of contact with customers through online banking apps andemail.
If customers cannot be contacted through digital media, as a secondary
approach the bank would send a letter by post, but this would be after
numerous attempts to contact the customer by digital means and would
be indicative of an issue in communicating with the customer.
If a customer does not provide updated information despite repeatedattempts to contact the customer, the Application Guidelines for the Money
Laundering Act stipulate that customer must ultimately be offboarded.
 Common practice is to do this through a gradual approach, wherebanks would place a block on the customer account, preventing
new/discretionary transactions, while continuing to permit inflow offunds and debit transactions such as bill paying.
 If the bank is still unable to obtain updated customer information
despite additional requests to the customer, the account would then be
terminated.
 This is consistent with the German Money Laundering Act, theApplication Guidelines for the Money Laundering Act and the EU
regulations.
The terms and conditions of the deposit account contracts stipulate thatthe customer must provide up-to-date and complete information
requested by the bank, and if the customer does not provide thisinformation that the bank is obligated to terminate the account.

434Ease of obtaining the latest customer information
through the spread of digital ID use

 Most customers in Germany are not averse to providing their information
to banks. Historically, customers have had a close relationship with theirbanks, and customers are open to providing personal information to banksin Germany.
 The German National Identity Card includes an electronic identity
verification function and can be used both for accessing public services aswell as for interaction with private companies, such as for banking. In
theory this could be used for CDD, but in reality, it is not widely
implemented by banks. The reason for this is that most German citizens
have opted not to activate the electronic component of their identification
due to (1) data privacy concerns, (2) a burdensome process to activate
the electronic ID component and (3) the current lack of services where theelectronic ID can be used.
 Another reason that the electronic ID has failed to gain traction is that for
onboarding customers are still required to appear in-person and produce aphysical ID for verification at a branch.
 There are alternatives allowed to this such as Video ID (where acompliance professional verifies the customer’s identity via a live twoway video link) or POSTIDENT (where Deutsche Post employees
perform identity verification on behalf of the bank and transmit theconfirmed ID data to the bank upon verification). POSTIDENT has been
widely used as an option by banks, but Video ID has been plagued
with issues and not well received by banks.
 There are solution vendors which Video ID services (Scalable Capital,
ID Now, WebID and others), but these companies are more focused on
the strategic leveraging of data rather than offering viable onboarding
services, and as a result they are currently not commonly used bybanks in Germany.

44

5

The number of bank accounts for consumers andthe impact on their willingness to provide
information to banks

6

Presence or absence of an account maintenance fee

7

Does the widespread use of the customer uploading
their updated information via the FI's website leadto reduced burden on FIs?

 It is normal for customers to have multiple bank accounts in Germany.
 The trend within the past 10-15 years will jump from bank to bank looking
for better interest rates, driven by the low interest rates in the EU region(some banks will temporarily offer a higher interest rate to recruit newcustomers).
 Younger consumers are also more likely to hold multiple bank accounts,
with one traditional bank account and two or more FinTech accounts.
 Customer accounts are not normally shut down accounts due to lack ofactivity. In such cases, customers will be sent many marketing materials
trying to prompt them to engage in transactions, and once there is activity
on an account that has been inactive for a long period of time this will
likely trigger a KYC review, where the bank will request updated
information from the customer. If the customer does not provide theinformation requested, then he or she would be subject to the restrictions
outlined in #3 above.
 An annual account maintenance fee (around EUR4, depending on thebank) is assessed on all retail bank accounts.
 There are no maintenance fees assessed if an account balance falls below
a certain threshold; actually, if a bank account has a balance above acertain threshold, customers will have to pay fees to the bank due to the
EU negative interest rate.
 Customers will typically use either the online banking platform or email to
upload their latest information Can use portals for OCDD. Some banks will
still send requests for updated information by post (where the customer
will provide copies of their identification information by return post), but
this is an increasingly less common practice.
 For onboarding CDD, customers are still required to appear in-person andproduce a physical ID for verification at the bank branch, or use one of thepermissible alternatives, such as Video ID or POSTIDENT outlined in #4

45

8

Is there a mechanism (system) used by FIs to
extract information from transaction data necessary
and useful for the KYC process from transaction
data (e.g. whether the consumer is a salaried
worker or a pensioner)?





9

Measures taken by individual FIs and the financial
services industry when banks have difficulty
obtaining the latest information about existingcustomers








above.
Currently transaction data and KYC data are not systematically linked.
Transaction monitoring is still a very manual process and the TM scenarios
are not tied to the customer’s risk rating, nor is transaction activity used to
extract information for KYC or fed back into the KYC process. This isconsidered the next step in the evolution of AML in Germany. Both banks
and the German regulator are behind in comparison to other global leading
jurisdictions.
The exception to this would be Deutsche Bank, as a GSIFI headquarteredin Germany. Due to the numerous sanctions assessed by US regulators,
Deutsche Bank has a transaction monitoring framework to monitor
customer activity against expected activity, but this is the only bank withsuch practices in the market.
There is no standard practice outlined at the industry level.
Recent updates of regulatory guidelines explicitly mention that there is apossibility to update certain client data without the need to have theinformation provide by clients – opening the opportunity to use publicly
available data (without any further specification with regard to therequirements to these sources)
Standard practice by banks is to block customer accounts in a graduatedapproach, ultimately closing the account if the bank cannot obtain updated
customer information (see #3 above).
Additionally, there is no incentive program used by banks or industry toobtain updated customer information.

46

スウェーデン#

Viewpoint

1

Do FIs in your country have difficulty obtaining thelatest information about existing customers?

2

Means of contacting existing customers (by post,

Discussion Details
 Today the overall observation is that Swedish FIs have been stepping up
their OCDD processes and become more efficient obtaining updated KYC
information regarding their customers. They rely on digital tools andinformation to ensure the KYC is kept up to date. This was overcome by a
combination of migration to widespread use of online banking apps, use ofdigital IDs (such as Swedish “BankID”) for CDD, a shift of banks toaccessing third party data (public registers) to complete the CDD/OCDD
process, and also use of banking apps to collect updated KYC information.
 No specific timeline for KYC refresh specified in legislation, but standardpractice among majority of FIs is (H=1 year/M=2 year/L=3 year).
 In combination with the periodic review, banks will also conduct OCDD in
response to trigger events identified in transaction monitoring.
 Additionally, rather than contacting the customer directly, banks will first
access public information such as official registers (for example the tax
authority register, beneficial owner registry) to identify any updated
customer information, then request that the customer verify that the
information is correct.
 Online banking apps are the main channel used for communication withexisting customers.

47

emails, apps, etc.)3

The use of/methods of restricting or suspendingtransactions for non-cooperative customers interms of providing updated information, customer
response to such measures, the underlying laws
and regulatory guidance (guiding principles) andstatus of regulations, and the existence ofprovisions in the contracts between FIs andcustomers (Presence or absence of an environment
or mechanism that allows for transaction
restriction)

4

Ease of obtaining the latest customer information
through the spread of digital ID use

5

The number of bank accounts for consumers andthe impact on their willingness to provide
information to banks

 Following the Danske Bank/Swedbank ML scandals in 2018-19, banks
have taken a much more proactive approach to dealing with customers
who have not responded to requests for updated information.
 Whereas previously banks would be reluctant to freeze accounts, if
customers fail to respond to repeated requests for updated
information, banks are now much faster to restrict access to products
and services until customers provide the updated information.
 Additionally, The Swedish AML regulation stipulates that if complete,
up-to-date KYC information cannot be obtained, a FI must terminate
the relationship with the client. As a result, while banks will take agradual approach to freezing customer accounts, if updated customer
information cannot be obtained banks are obligated to close thecustomer account and do so. This is also clearly stipulated in the terms
and conditions of bank account contracts with clients as well as clearlyvisible on bank websites.
 Since this is a regulatory requirement, is clearly communicated tocustomers and is standard practice across all banks in Sweden, it isaccepted by customers. The Swedish Banker’s Association have also
played an important role in facilitating common information to bankcustomers through their website.
 “Swedish Bank ID” is, among other digital IDs, used for identifying andverifying customers in both CDD and for OCDD.
 Most customers in Sweden have only one or a few number of bankaccounts.

48

6

Presence or absence of an account maintenance fee

7

Does the widespread use of the customer uploading
their updated information via the FI's website leadto reduced burden on FIs?

8

Is there a mechanism (system) used by FIs to
extract information from transaction data necessary
and useful for the KYC process from transaction
data (e.g. whether the consumer is a salaried
worker or a pensioner)?

9

Measures taken by individual FIs and the financial
services industry when banks have difficulty
obtaining the latest information about existingcustomers

 Not aware of any account maintenance fees.
 Widespread use of online banking apps in combination with digital ID andaccess to public registers results in a reduced burden on FIs in collecting
and verifying CDD and OCDD customer information.
 When onboarding customers, banks are required to collect a broad range
of information from customers in addition to identification information,such as detailed information regarding the purpose and nature of thebusiness relationship, including: e.g. monthly salary and employer, sourceof funds/wealth, expected monthly incoming transactions and outgoingtransactions (including expected number of transactions and amount oftransactions).
 If banks are skilled at obtaining this information during customer
onboarding, transaction monitoring can be tailored to each customer’s
profile.
 Ideally transaction monitoring system scenarios are then tailored to thecustomer profile, but in reality, banks are relying on traditional transaction
monitoring systems with pre-defined “out-of-the box” scenarios which are
not tailored to expected customer activity.
 In practice, banks do not extract information useful for the KYC process
but rather rely on information obtained from the customers during
onboarding, however, tailored KYC monitoring is on the rise in Sweden.
 There is no standard practice outlined at the industry level. Standardpractice by FIs is to restrict and/or freeze customer accounts in a
graduated approach, ultimately closing the account if the bank cannot
obtain updated customer information (see #3 above).
 Additionally, there is no incentive program used by banks or industry to49

obtain updated customer information.

オーストラリア#

Viewpoint

1

Do FIs in your country have difficulty obtaining theDiscussion Details
 Not considered to be an issue in Australia.
 KYC refresh frequency is not stipulated in regulations.

50

latest information about existing customers?

2

Means of contacting existing customers (by post,
emails, apps, etc.)

 Standard practice 5 years ago was periodic review based on thecustomer’s risk (1/3/5), but banks found that this was too burdensome
and many chose to implement periodic review only on H risk customers,
with M and L review occurring only as a result of a trigger event.
 Recently the regulator has told a major bank that KYC refresh must be
performed on a 1/3/5 year periodic cycle, so banks are starting to follow
this trend again, which means that the refresh process will likely be morelabor intensive in the future. On the other hand, mechanisms for obtaining
this information are built into online banking apps, which is how mostbanks interact with customers in Australia, and banks continue to work
towards automating this process as much as possible.
 KYC requirements in Australia:
 Minimum requirements for individuals are collection of name, address,
date of birth information from the customer.
 While it is a regulatory requirement to verify KYC information, this canbe done either by documents or electronic verification (voters roll,etc.). With electronic verification, it is not a regulatory requirement tocollect copies of the ID underlying the information provided. This has
resulted in numerous cases of identity fraud. Now banks are trying to
implement more robust verification measures such as collecting thespecific information (reference numbers, dates, etc.) from the ID
documents (such as passport and driving license, etc.), so thisinformation can be verified using AUSTRAC’s Document Verification
Service(DVS) and/or utilizing facial recognition (from the copy of thepassport and driving license, etc.) like E-KYC for opening accounts
online.
 In Australia, the majority of customer interaction for retail accounts(including account opening and ongoing customer interaction) take placethrough online and banking apps (which has been increased as a result of51

COVID and virtual communications).
3

The use of/methods of restricting or suspendingtransactions for non-cooperative customers interms of providing updated information, customer
response to such measures, the underlying laws
and regulatory guidance (guiding principles) andstatus of regulations, and the existence ofprovisions in the contracts between FIs andcustomers (Presence or absence of an environment
or mechanism that allows for transaction
restriction)

4

Ease of obtaining the latest customer information
through the spread of digital ID use

5

The number of bank accounts for consumers andthe impact on their willingness to provide
information to banks

6

Presence or absence of an account maintenance fee

7

Does the widespread use of the customer uploading
their updated information via the FI's website leadto reduced burden on FIs?

 The AML/CTF Act stipulates that banks may determine not to proceed witha transaction based on their discretion.
 Bank account terms and conditions will contain a clause stating that thebank can freeze or terminate a customer account at the bank’s discretion.
 In practice, it is very easy to put a freeze or terminate a deposit accountsince this simply involves returning the funds to the customer. It becomes
more complicated for credit products such as mortgages, credit cards andloans (where the bank needs to obtain remaining loans from thecustomer). For such products, banks will restrict customer activity to only
allow the customer to repay those loans and not allow the customer to use
any additional products.
 N/A- Digital ID in Australia is not currently being considered due mainly todata privacy concerns.
 Australian consumers may have numerous accounts but there is not atrend of keeping accounts without any activity since such accounts would
be frozen by the bank or once the account goes dormant (after 1 to 2
years of inactivity), the account will be closed and the funds will beabsorbed by the government.
 Banks will assess a monthly fee (usually $5) if a customer does not
maintain a deposit of a certain amount (usually $1,000 per month).
 Approx. 80% of customers use online banking. Updated information
requests from these customers are handled through the bank’s app. Whenthe customer logs in, they will be prompted with a screen requesting themto provide their updated information.
 For the 20% of customers who do not use online banking, the bank will52

8

Is there a mechanism (system) used by FIs to
extract information from transaction data necessary
and useful for the KYC process from transaction
data (e.g. whether the consumer is a salaried
worker or a pensioner)?

9

Measures taken by individual FIs and the financial
services industry when banks have difficulty
obtaining the latest information about existingcustomers

use a combination of means to contact the customer (email, phone,letter). If the customer does not respond, the bank will place a block on
their account which forces the customer to contact the bank, at which
point the bank will again request the updated information from thecustomer and not allow the customer to proceed with transactions until
the updated information has been provided.
 This is used mainly for tracking the activity of High risk customers. Banks
will look at the customer’s transactions through transaction monitoring todetermine whether the transactions match up with the customer’s KYC
profile (such as occupation) and source of funds/source of wealth. If thetransactions do not align with the customer’s profile, this will trigger atransaction review and depending on the outcome of this review, a KYC
review may be required, and the bank may contact the customer for
updated information.
 Currently this is a very manual process. AML operations at banks havebeen increasing their headcount to process both transaction monitoringand KYC reviews- they are finding that this is not sustainable and aretrying to figure out how to utilize technology to increase efficiency as
the current manual process is not sustainable.
 There has been an emergence of FinTechs such as Simple KYC andFirst AML who are offering solutions around KYC remediation and there
has been a recent trend by banks to utilize these solutions rather thanengaging large consulting firms.
 There is not a consistent approach at the industry level for measures taken
when banks are unable to obtain updated information from customers.
 Individual banks will, after numerous attempts to contact a customer for
updated information, block a customer account and then (a) prompt
customers for updated information through online banking apps (forcustomers using online banking) or (b) rely on the account block to force

53customers to contact the bank (via call center or physical access to abranch) where the bank will then obtain updated customer information.
 Additionally, there is no incentive program used by banks or industry toobtain updated customer information.

香港#

Viewpoint

1

Do FIs in your country have difficulty obtaining thelatest information about existing customers?

Discussion Details
 There are still some issues with obtaining updated customer information,
but this is in specific cases. For example, for an individual who holds aprivate company where the information is not publicly available (a private
individual generating wealth). For normal individual retail customers, thisis not considered an issue compared to 10 years ago.
 10 years ago, customers didn’t understand why they had to provide
information and there was a reluctance to provide this information andalso banks were less aggressive about collecting this information.
 Around this time, HKMA started levying heavy fines against banks for
AML/CFT failures including failure to obtain complete and up-to-datecustomer information, which caused banks to take their AML/CFT
obligations much more seriously.

54

Additionally, both the government and banks engaged in marketing
campaigns such as television advertisements to raise public awarenessof AML/CFT risks.
 Now, general public is more widely educated and open to providing
information.
The introduction of FATCA/CRS information collection requirements also
helped to ease customers’ acceptance to provide information.
AML regulations stipulate that H Risk customers are subject to periodic
review at least on an annual basis. For L and M risk customers, theschedule for periodic review is on a risk-based approach depending on the
bank’s risk appetite.
Private banks typically adopt a periodic review model that follows (H=1
year/M=2 years/L=3 years) due to higher inherent AML/CFT risk in privatebanking
The practice among mass retail banks varies, but the recent trend is for L
Risk customers to be scoped out of periodic review, subject only to triggerevent based review, with M Risk customers reviewed every 2 or 3 years
and H Risk customers reviewed every year (in addition to trigger-event
based reviews).









2

Means of contacting existing customers (by post,
emails, apps, etc.)

 This practice varies from bank-to-bank.
 Most banks contact their customers by telephone to request additional
information. Banks have found that this channel elicits the highest
response rate from customers in comparison to requests for
information by post, and as a result post is not typically used forrequests for updated customer information.
 Some banks have a requirement that relationship managers meet with
their customers on an annual basis.

55

3The use of/methods of restricting or suspendingtransactions for non-cooperative customers interms of providing updated information, customer
response to such measures, the underlying laws
and regulatory guidance (guiding principles) andstatus of regulations, and the existence ofprovisions in the contracts between FIs andcustomers (Presence or absence of an environment
or mechanism that allows for transaction
restriction)

 Virtual banks have been moving more towards remote onboarding
solutions, where ID information can be uploaded through a banking app
portal, but this is still not widely adopted in the market since virtual banks
only came into the market in Hong Kong in the past two years. Even forvirtual banks, customers will be contacted first by phone to provide
updated information, which they would then be able to upload via thevirtual bank app.
 When opening an account, if the bank is not able to obtain all necessary
customer information to open the account, the bank will perform a review
to determine whether to reject the account or escalate the case forapproval from senior management to open the account but restrict thetypes of transactions possible on that account. The bank would then obtain
the additional information from the customer within a specific timeline (90days) before allowing the customer to all functionality of the account.
 For OCDD, if the client cannot be reached or refuses to provide updated
information, the standard practice by banks in Hong Kong is to apply theso-called Three Strike Policy:
 After attempting to contact the customer without success, the bankwill perform a compliance review, depending on the customer’s
AML/CFT risk and/or depending on whether a specific transaction is
subject to suspicious transaction reporting. The bank will then file an
STR and/or reassess the customer’s risk rating. If three STRs are filed
within a two year period, the bank will close the customer’s account.
 The terms and conditions of retail banking contracts stipulate that banks
have the discretion to close customer accounts for refusing to provide
complete and up-to-date customer information. The content of thesecontracts is explained to customers at the time the customer completes
the contracts.
 The regulations stipulate that banks take a risk-based approach when56

4Ease of obtaining the latest customer information
through the spread of digital ID use

5

The number of bank accounts for consumers andthe impact on their willingness to provide
information to banks








6

Presence or absence of an account maintenance fee





7

Does the widespread use of the customer uploading
their updated information via the FI's website leadto reduced burden on FIs?



considering whether to continue relationships with customers, rather thanspecific requirements for banks to close a customer’s account. In practice,most banks adopt the three-strike policy outlined above.
In Hong Kong, Digital ID (iAM Smart) was launched in December 2020,
and in May 2021 the HKMA updated its AML/CFT FAQ to clarify how digital
ID can be used for remote onboarding. On the other hand, digital ID for
CDD has not adopted by banks as of August 2021.
It is common for consumers to have multiple (three or more) accounts.
Hong Kong’s financial environment is extremely competitive, and banks
will offer various incentives to customers for opening new accounts.
These accounts are typically held for different purposes (e.g. one accountfor fixed deposit, one for savings, one for investment) and each of thesewill have different interest rates.
Since these accounts are used for specific purposes, it is not common foraccounts to be held for long periods of time without any activity.
Account maintenance fees were introduced by most banks in Hong Kong in
2001, where monthly fees were assessed against accounts failing tomaintain a minimum balance.
Over the past couple of years, some banks have abolished this fee in aneffort to stay competitive with virtual banks emerging in the market, andthere has been a trend for more banks to follow suit. As a result, it is notcommon for retail bank accounts to assess maintenance fees on accounts
comparing with past years as of August 2021.
Larger banks are starting to offer the functionality for customers to upload
their information via online banking app, but this has yet to reach criticalmass among consumers.
While younger consumers are starting to use this technology, older
generations of consumers still tend to conduct all of their banking at thebranch.

57

8Is there a mechanism (system) used by FIs to
extract information from transaction data necessary
and useful for the KYC process from transaction
data (e.g. whether the consumer is a salaried
worker or a pensioner)?

9

Measures taken by individual FIs and the financial
services industry when banks have difficulty
obtaining the latest information about existingcustomers Banks may have a TMS in place for monitoring ongoing transactions, but
their transaction data and KYC data might not be systematically linked.
Transaction monitoring and periodic review is still a very manual process,
TMS scenarios are not tied to the customer’s risk rating, nor is transaction
activity used to extract information for KYC or fed back into the KYC
process.
 Banks in Hong Kong still lack the adequate data governance and data
integrity to implement this type of linked system and to perform data
analytics on such data.
 At the industry level, over the past ten years the HKMA has been very
proactive in raising customer awareness around the risks of AML/CFT as
well as AML/CFT compliance, including the need to provide up-to-date
information (see #1 above)
 Individual banks have also made efforts to raise such customer awareness,clearly specifying that accounts may be closed for refusal to provide up-todate information, and adopting the Three Strike Policy (see #3 above).
 These measures have resulted in a culture of AML/CFT awareness andacceptance by customers to provide their information to banks.
 There is no incentive program used by banks or industry to obtain updated
customer information.

シンガポール#Viewpoint

Discussion Details

58

1

Do FIs in your country have difficulty obtaining
the latest information about existing customers?

2

Means of contacting existing customers (by post,
emails, apps, etc.)3

The use of/methods of restricting or suspendingtransactions for non-cooperative customers interms of providing updated information, customer
response to such measures, the underlying laws
and regulatory guidance (guiding principles) andstatus of regulations, and the existence of This is not considered an issue by retail banks in Singapore.
 Normal practice is to categorize retail customers as either “Standard” Risk or“High” Risk. The vast majority of retail customers are categorized as“Standard” Risk and these customers are not subject to OCDD unless there
is a trigger event identified in transaction monitoring.
 Additionally, banks in Singapore will use customer interaction occurring in
BAU (e.g. car loan applications or marketing communication to raise credit
limits on credit cards) to confirm/obtain the latest customer information.
 Customers view this as normal and do not object to these practices.
 In Singapore, a large number of retail customers use online banking via thebank’s web app.
 As a suggestion, updated customer information due to a trigger event
could be obtained after logging into the bank app a screen would appear
prompting the customer to confirm their latest information. The
customer would not be able to proceed with any transactions until they
provide/confirm this information, which is normally done by allowing thebank access to the customer’s MyInfo.
 Based on KPMG experience, if the trigger event requires the bank to
obtain additional information from a customer regarding a specifictransaction, the bank would usually call the customer to verify the detailsof the transaction and would obtain supporting evidence for thetransaction from the customer if necessary.
 From KPMG observations in the industry, banks in Singapore can freeze or
terminate accounts at their discretion.
 The terms and conditions for deposit accounts generally do stipulate that
information provided to the bank has to be up to date. AML regulations in
Singapore do state that should verification not be completed by 30 businessdays, the bank has to suspend business relations with the customer. After
120 days and verification remains not completed, the bank has to terminate59

provisions in the contracts between FIs andcustomers (Presence or absence of anenvironment or mechanism that allows fortransaction restriction)
4

Ease of obtaining the latest customer information
through the spread of digital ID use

5

The number of bank accounts for consumers andthe impact on their willingness to provide
information to banks

6

Presence or absence of an account maintenancefee

7

Does the widespread use of the customer
uploading their updated information via the FI's
website lead to reduced burden on FIs?

the business relations with the customer.
 KPMG SG is not aware of specific underlying regulation that prevents banksfrom closing bank accounts. Rather this is a risk-based decision in line withMAS strong regulatory stance towards AML/CFT compliance.
 Use of digital ID for providing customer information in account opening andon an ongoing basis is normal practice in Singapore. Customers provide thebank with access to MyInfo through SingPass. MyInfo is then used ascustomer identification information.
 MyInfo draws information from the respective government agencies in
Singapore. Individuals living in Singapore are required to update theirinformation (e.g. address). Example, if a person has moved residences, theindividual has to go to the police post to update their address. This addressis then updated in government databases which will then flow into MyInfo.
 It is not unreasonable for customers in Singapore to have numerous bankaccounts. One reason for this is because the deposit insurance scheme in
Singapore covers up to SGD75,000 per account, so customers may holdnumerous bank accounts in order to diversify their risk.
 Bank accounts in Singapore with no activity for a certain period (typically 12months) are frozen, and the next time the customer logs into their bankaccount they will be prompted with a screen stating that the account has
been frozen and requesting the customer to contact the bank.
 Account maintenance fees are normal practice in Singapore. Based on thereview of websites of 3 local banks in Singapore, if the average daily accountbalance falls below SGD500, a monthly fee of SGD2 is levied.
 Normal practice in Singapore is for the customer to provide their digital ID
information (i.e. MyInfo) through the bank’s app. This is done through API
connection between the bank’s app and SingPass, which greatly reduces thebank’s burden in obtaining information.

60

8

Is there a mechanism (system) used by FIs to
extract information from transaction datanecessary and useful for the KYC process fromtransaction data (e.g. whether the consumer is asalaried worker or a pensioner)?

9

Measures taken by individual FIs and the financial
services industry when banks have difficulty
obtaining the latest information about existingcustomers Since MyInfo information is verified by the government, the bank’s burden interms of verifying the information is nonexistent.
 Based on KPMG understanding, we do know that there is a retail bank in
Singapore that utilize data analytics to determine whether a customer’stransactions are in line with the customer’s expected activity based on thecustomer’s risk profile.
 If outlying transactions are identified, depending on the transaction thebank will contact the customer for additional information on thetransaction, if necessary reperform KYC based on the transaction
patterns, or issue an STR and block/terminate the account.
 MAS has been very supportive of developing FIs data analytics
capabilities and has also mentioned of banks in Singapore being able touse data analytics capabilities to identify suspicious activities (point 6 inlink below) https://www.mas.gov.sg/news/speeches/2021/forging-ahead-on-ouraml-cft-journey-together
 MAS requires that banks maintain an audit trail to provide supporting
evidence for these decisions.
 As mentioned above, banks in Singapore have to comply with AML
regulations which requires them to suspend/terminate accounts if
verification is not completed.
 Additionally, there is no incentive program used by banks or industry toobtain updated customer information.

61

インド
#

Viewpoint

1

Do FIs in your country have difficulty obtaining thelatest information about existing customers?

Discussion Details
 This is not a major issue in India but is observed on a limited basis.
 KYC refresh in India is every 10 years for L Risk, 8 years for M and 2 years
for H.
 Nearly all bank accounts for customers with access to digital media arelinked to the customer’s Aadhaar and banks access Aadhaar (after
obtaining the customer’s consent) to perform KYC refresh for suchaccounts.
 In reality, banks take a risk-based approach to KYC refresh, focusing
mainly on H risk customers. For H risk customers the banks will reach out
to the customer directly to obtain additional information when thecustomer is scheduled for KYC review.
 Banks have difficulties obtaining the latest information for customers who62

2

Means of contacting existing customers (by post,
emails, apps, etc.)3

The use of/methods of restricting or suspendingtransactions for non-cooperative customers interms of providing updated information, customer
response to such measures, the underlying laws
and regulatory guidance (guiding principles) andstatus of regulations, and the existence ofprovisions in the contracts between FIs andcustomers (Presence or absence of an environment
or mechanism that allows for transaction
restriction)

4

Ease of obtaining the latest customer information
through the spread of digital ID use

do not have access to digital services.
 The majority of customers are contacted by email or online banking apps,
but customers without access to digital media are contacted by post
because the customers may not have email accounts or even telephones.
 The RBI Master Direction on KYC clearly stipulates that banks must
eventually terminate accounts if KYC cannot be completed within a specificperiod (this includes completion of KYC refresh).
 In practice this is accomplished through placing a block on thecustomer’s account preventing the customer from any debit
transactions until they contact the bank to provide the updated
information.
 For online banking customers, a message will appear on their app after
logging in prompting them to provide the updated information directly
through the app and allow the bank to access the customer’s Aadhaar
information, or to contact the customer service center or visit the bankbranch directly.
 For customers who do not use online banking, the bank will makenumerous attempts to contact the customer by telephone or by post.
 The majority of customers’ bank accounts are linked to their Aadhaar andthis makes both the onboarding process and the KYC refresh process
much easier for banks, since the bank can access the customer’s Aadhaar
information after obtaining the customer’s consent.
 On the other hand, the Aadhaar information for customers with older bankaccounts or underbanked customers in remote areas may not be linked totheir bank accounts or may not be up-to-date, and obtaining updated
customer information from this customers is difficult because they usually
do not have email and in many cases do not have a phone. In such cases
banks must rely on sending requests by post, but even following up with63

5

The number of bank accounts for consumers andthe impact on their willingness to provide
information to banks

6

Presence or absence of an account maintenance fee

7

Does the widespread use of the customer uploading
their updated information via the FI's website leadto reduced burden on FIs?

8

Is there a mechanism (system) used by FIs to
extract information from transaction data necessary
and useful for the KYC process from transaction
data (e.g. whether the consumer is a salaried
worker or a pensioner)?








customers who do not respond is difficult as the only channel for doing so
is by post.
Customers may have numerous bank accounts, but customers will
typically use these accounts.
If a customer does not carry out any transactions in a bank account for
twelve consecutive months, the bank will classify the account as dormant
and all activity on the account is blocked until the customer submits arequest to resume activity on the account. In such situations KYC will bereperformed for the customer and banks may assess a fee to reactivate
the account, but this practice varies from bank to bank.
Account maintenance fees are typically assessed by banks if a minimum
balance is not maintained. Banks do not charge a fee for inactivity on an
account but may charge a fee to reactivate dormant accounts (see #5
above).
KYC and KYC refresh for online banking customers utilizes Aadhaar. This
reduces the bank’s burden in verifying the customer’s information, since
the information obtained from the customer is compared against the
Aadhaar information, which has been verified by UIDAI.

 Banks can access the Aadhaar database or Permanent Account Number(PAN) database after obtaining permission from the customer. This
information is then compared against the customer’s transactions throughtransaction monitoring to check whether the customer activity aligns withthe customer information held by the bank and the information held in
Aadhaar and the PAN database.
 In practice, banks reassess the appropriateness of their customer risk
rating for customers every six months based on customer transaction
activity.

64

9

Measures taken by individual FIs and the financial
services industry when banks have difficulty
obtaining the latest information about existingcustomers

 For H Risk customers, banks will have extensive reach out to the customer
to obtain updated information. For M and L Risk customers, banks do nottend to consider these high priorities as banks rely on Aadhaar for
obtaining this information for the majority of customers.
 Additionally, there is no incentive program used by banks or industry toobtain updated customer information.

65