MAS Notice 626 vs HKMA AML-2: a clause-level control crosswalk.
A regional AML policy can share a control library. It still needs local rules for identifying connected parties, selecting beneficial owners, classifying PEPs and keeping evidence. This guide works through those differences with a free, source-linked Excel and CSV crosswalk.
Download the MAS–HKMA AML crosswalk
The workbook contains 12 selected clause pairs covering customer identification, beneficial ownership, deferred verification, PEPs, monitoring and records. Each row includes both source references, short requirement summaries, a local difference, an illustrative mapping decision and an example control, evidence record and owner role. No email is required.
Download the Excel crosswalk · Download the CSV crosswalk
Scope and review status: this is a worked starting point, not an exhaustive legal inventory or a compliance certification. The source summaries are paraphrases. Mapping decisions, controls, evidence and roles are Sia examples, not regulator-approved conclusions or implemented bank controls. Every row requires qualified human review before use.
Which versions does the comparison use?
Sources were checked on September 6, 2026. The MAS Notice 626 record links the consolidated Notice dated March 28, 2024, last revised June 30, 2025. The 2025 amendment took effect on July 1, 2025. The current HKMA AML-2 record lists May 25, 2023; that revision took effect on June 1, 2023.
MAS Notice 626 applies to banks within its scope and is issued under section 16 of the Financial Services and Markets Act 2022. HKMA AML-2 sets out statutory and regulatory requirements for Authorized Institutions alongside the AMLO and Banking Ordinance. Its paragraph 1.6 expressly says that "must" and "should" indicate mandatory requirements. Calling it a guideline does not make its requirements optional.
Read the Notice alongside the MAS Guidelines and relevant Singapore law. Read AML-2 alongside its cited Hong Kong legislation and associated guidance. This selected crosswalk does not fully map those additional sources, sanctions, suspicious-transaction reporting, trust structures, payments or third-party reliance. A difference identified in two selected clauses is not proof that no related requirement exists elsewhere.
Six worked clause pairs
The following samples use the row IDs in the download. PDF links open at the relevant source page; the workbook also records exact paragraph references and version dates.
| Topic and exact clauses | Difference to preserve | Sia example decision |
|---|---|---|
| MH-02 · Connected parties MAS 6.8–6.8B HKMA 4.3.18–4.3.19, footnote 26 | MAS specifies names and identifiers, with documented substitute conditions. The cited HKMA provision requires names; separate duties still apply if a connected party is also a customer, beneficial owner or representative. | Partial. Reuse party classification, but retain local fields and exception evidence. |
| MH-03 · Corporate beneficial owners MAS 6.13, 6.14(a), 6.16 HKMA 4.4.6, 4.4.9 | HKMA expressly includes more-than-25% ownership/voting tests. MAS 6.14(a) itself gives no percentage. Preserve its ownership/control sequence and the applicable inquiry exemptions. | Partial. Share the ownership chart; keep separate local selection and exemption decisions. |
| MH-07 · Former PEPs MAS 8.4(c) and higher-risk exception HKMA 4.9.12–4.9.13, footnote 43 | Both require a risk-sensitive decision. The HKMA pair concerns former non-Hong Kong PEPs and identifies specific assessment factors. An elapsed-time rule alone does not establish reduced risk. | Shared candidate. A documented residual-influence assessment can support this selected decision, with local scope preserved. |
| MH-08 · CDD refresh MAS 6.24 HKMA 5.2–5.3 | HKMA specifies at least annual review for high-risk customers. MAS 6.24 does not itself state that interval; the MAS Guidelines and other applicable sources still need review. | Partial. Reuse the review queue with separately approved local intervals, triggers and party scope. |
| MH-10 · COSMIC-only intake MAS 6.20, final sentence HKMA 5.1(b)(i) | MAS addresses received COSMIC information for participating banks. The paired HKMA transaction-scrutiny clause does not prescribe that input. | No match for this control. A Singapore intake log alone does not evidence Hong Kong customer-specific scrutiny. This is not a finding about all information-sharing duties. |
| MH-12 · Transaction records MAS 12.2(b), 12.3(b), 12.5 HKMA 8.5–8.6, 8.8 | The selected provisions require reconstructable records and at least five years from transaction completion, subject to local extensions and other applicable requirements. | Shared candidate. Test reconstruction and completion-triggered retention, with separate local holds. This is not permission to delete records automatically. |
Keep CDD retention separate from transaction-record retention. Row MH-11 preserves a specific distinction: HKMA 8.4 starts qualifying occasional-transaction CDD retention from the transaction date, while MAS 12.3(a) uses completion of the relevant transfer or no-account transaction. Store both dates when they differ.
What do Shared, Partial and No match mean?
These labels assess the example control, not legal equivalence. "Shared" means the control could support the selected objective in both sources after review. "Partial" means a component is reusable but a local condition or configuration remains. "No match" means the specific control cannot evidence the paired objective; it does not claim that the wider regimes have no comparable requirements.
A reviewer can disagree with a sample decision. Record the replacement rationale, the approved control version and the evidence used. An unsupported "Shared" label is less useful than an explicit gap.
Turn one row into a control test
Take MH-02, the connected-party row. In a synthetic test case, a corporate customer's director is classified only as a connected party. A names-only checklist may address the cited HKMA field requirement, but the reviewer must first check whether another covered role also applies. For the Singapore entity, the same checklist does not cover the identifier requirement or the documented substitute route in MAS 6.8A–6.8B.
- Confirm the customer entity, jurisdiction and each party's role. Do not put real customer information in this public template.
- Link the local onboarding procedure and its version to the source clauses.
- Test a synthetic record against the required fields and local exception conditions.
- Assign any missing field or exception evidence to the corporate KYC operations lead, with a target date.
- Have the designated reviewer approve the mapping and retain the test result. Keep the row open if the source or evidence is unresolved.
The same method applies to the other rows: identify the local decision, choose a test that could expose a gap and retain the evidence behind the conclusion.
How Sia RegAI supports the workflow
RegReview helps compare controlled regulatory versions and record the source, change, interpretation and applicability decision. RegMatcher connects approved obligations to policies, controls, owners and evidence, surfacing weak or missing mappings for qualified review.
For this crosswalk, a useful demonstration starts with two approved source versions and one existing KYC procedure. Review the clause pairing, inspect the proposed policy/control mapping and record the local gap, owner and evidence for a qualified reviewer to approve.
Sia RegAI does not perform customer screening, transaction monitoring or legal interpretation on behalf of the bank. Those decisions and activities remain with the bank's designated systems and qualified reviewers.
Book a MAS–HKMA control-mapping demo. Use a sanitized policy excerpt or one of the synthetic examples above to discuss the workflow.
Frequently asked questions
Is HKMA AML-2 part of the Supervisory Policy Manual?
HKMA publishes AML-2 as its Guideline on Anti-Money Laundering and Counter-Financing of Terrorism for Authorized Institutions in the Banking Regulatory Document Repository. Use the current document record rather than an informal module label.
Can one regional AML policy satisfy both jurisdictions?
A group policy can provide a common control standard, but each bank should document how applicable local requirements are implemented and evidenced.
Should the stricter requirement always become the group standard?
Not automatically. A group may choose a higher common standard, but it should assess operational consequences and preserve any jurisdiction-specific legal or procedural requirement.
How often should the comparison be reviewed?
Review it when either regulator changes a relevant source, when associated law or guidance changes, and when the bank materially changes its customers, products, channels, systems or risk profile.
Primary sources
- MAS Notice 626 current record and amendment history
- MAS Notice 626, last revised June 30, 2025 (PDF)
- HKMA AML-2 document record and version history
- HKMA AML-2, revised May 2023 (PDF)
- HKMA May 2023 consultation conclusions and June 1 commencement date (PDF)
Informational content only; it is not legal, financial-crime or supervisory advice. Confirm the current official sources before relying on this comparison.