What Changed
- HKMA requires clear on-screen notifications during facial recognition for remote account opening and mandates In-app Authentication over SMS OTPs.
- Government affirms that Cap. 106AI prohibits bank access to SIM card real-name registration data, with no plans to amend access permissions.
- Testing has begun to integrate 'iAM Smart' Step-up Authentication and HKMA's 'e-Banking Security ABCD' deepfake detection into remote account opening.
### Background
In a Legislative Council session on October 21, 2026, Professor the Hon Alex Fan submitted a parliamentary question regarding measures to improve online bank account opening security and prevent remote stooge account creation in Hong Kong SAR. The inquiry addressed fraud schemes where perpetrators obtain victims' identity cards and personal data—frequently targeting vulnerable groups such as foreign domestic helpers and elderly persons—to open bank accounts remotely via mobile applications without the victims' knowledge. In these schemes, criminals enter personal data into bank mobile applications, link the applications to pre-arranged mobile phone numbers, and deceive victims into passing facial recognition verification through screen prompts that lack clear notices. Once opened, these stooge accounts are used immediately to receive, transfer, or launder crime proceeds using one-time passwords (OTPs) sent to the linked numbers.
In response, the Under Secretary for Financial Services and the Treasury, Mr Joseph Chan, after consulting the Commerce and Economic Development Bureau and the Hong Kong Monetary Authority (HKMA), detailed the existing regulatory framework, supervisory requirements established by the HKMA, statutory limitations regarding SIM card registration data, and ongoing technical countermeasures implemented across government departments and the banking sector.
### Regulatory Guidance and Security Requirements
Under Hong Kong SAR's existing regulatory framework, regulated financial institutions, including authorized banks, are mandated to establish effective anti-money laundering (AML) and counter-financing of terrorism (CFT) controls. These controls encompass customer due diligence, continuous transaction monitoring, and the reporting of suspicious transactions to law enforcement agencies.
To address remote account opening risks, the HKMA enforces multi-layered controls. Banks must verify customer identities using technological solutions that check identity card authenticity and utilize facial recognition technology to confirm that the applicant matches the identity document. In 2023, the HKMA issued specific guidance requiring banks to display clear on-screen messages during remote account opening procedures. These prompts must explicitly notify applicants that collected selfies or liveness tests are being conducted specifically for account opening purposes, ensuring applicants are fully aware of the context.
To mitigate risks associated with fraudsters intercepting SMS One-Time Passwords (OTPs), banks have implemented "In-app Authentication" in accordance with HKMA requirements. Customers who install a bank's mobile application must authenticate through the app when logging into internet banking or conducting high-risk actions, such as adding new payees, raising transfer limits, or changing phone numbers for bank messages. Furthermore, binding internet banking accounts to mobile devices requires completing facial recognition verification, thereby reducing reliance on SMS OTPs.
Regarding access to telecommunications data, the Government clarified that access to SIM card real-name registration data is strictly restricted by Sections 12 and 13 of the Telecommunications (Registration of SIM Cards) Regulation (Cap. 106AI). Under this Regulation, telecommunications operators are authorized to provide user records solely to law enforcement officers of designated agencies for investigating or preventing crimes. The Regulation does not authorize banks or other organizations to access user registration records. Because banks are progressively reducing reliance on SMS OTPs, the Government confirmed it has no plans to authorize banks to access SIM card registration data.
Additional technical countermeasures include the HKMA's August 2025 "e-Banking Security ABCD" initiative, which introduced "Deepfake Detection" best practices for facial recognition processes across remote account opening and high-risk online transactions. Furthermore, the HKMA is working with the Digital Policy Office and the banking sector to integrate the Step-up Authentication function of "iAM Smart" into critical procedures. Utilizing facial recognition alongside identity card chip reading is designed to prevent fraudsters from using stolen or fake identity documents, with the first phase of testing for remote account opening already underway.
### Practical Implications
For banks operating in Hong Kong SAR, regulatory expectations require continuous enhancements to remote onboarding interfaces, including mandatory clear context prompts during liveness checks and advanced facial recognition defenses against deepfakes. Banks must also continue transitioning away from SMS OTP reliance toward In-app Authentication and biometric device binding.
For the general public, account opening workflows will increasingly feature explicit context prompts during biometric checks and potential integration with "iAM Smart" identity verification, combining physical card chip authentication with facial scanning.
### Frequently Asked Questions
**Question 1: Are banks in Hong Kong SAR permitted to access the SIM Card Real-name Registration database to verify account applicants?**
Answer: No. Pursuant to Sections 12 and 13 of the Telecommunications (Registration of SIM Cards) Regulation (Cap. 106AI), telecommunications operators are only authorized to disclose user registration records to law enforcement officers of designated agencies for crime investigation or prevention. Banks are not authorized to access this data, and the Government currently has no plans to grant them access.
**Question 2: What measures did the HKMA introduce in 2023 regarding remote account opening screens?**
Answer: In 2023, the HKMA issued guidance reminding banks to adopt appropriate measures during remote account opening, including displaying clear on-screen messages informing applicants that selfies or liveness tests are being conducted specifically for account opening purposes.
**Question 3: How is the government utilizing "iAM Smart" to enhance remote bank account opening security?**
Answer: The HKMA is collaborating with the Digital Policy Office and the banking sector to integrate the Step-up Authentication function of "iAM Smart" into remote account opening. This function utilizes facial recognition and identity card chip reading to prevent the use of fake or stolen identity documents. First-phase testing has commenced.
**Question 4: What is "e-Banking Security ABCD" announced by the HKMA?**
Answer: Announced in August 2025, "e-Banking Security ABCD" is a set of measures launched by the HKMA to enhance internet banking security. It includes "Deepfake Detection" guidance to share good practices with banks for defending against deepfake attacks during facial recognition processes.
Who May Be Affected
Authorized banks, internet banking customers, fintech applicants, and telecommunications operators in Hong Kong SAR.
Cross-Border Context
Applies to financial institutions operating within Hong Kong SAR and individuals attempting remote account opening in the jurisdiction.
What to check next
- Progress and outcome of 'iAM Smart' Step-up Authentication testing for remote account opening.
- HKMA circulars and guidance materials on 'e-Banking Security ABCD' and remote account opening controls.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.