AML · 05 Editorial guide
AML, KYC and Financial-Crime Controls in China
Build CDD, beneficial-owner, monitoring, reporting and investigation-readiness around the current AML framework. This topic routes; it does not decide the legal outcome on your facts.
First job Build CDD, beneficial-owner, monitoring, reporting and investigation-readiness around the current AML framework.
Start here
Key considerations
The first questions are about urgency, governance and preservation — before collection expands or interviews begin.
- Which facts show this is a aml / kyc / financial crime question?
- Which institution or process should be identified before assuming an outcome?
- What evidence should be gathered before contacting counsel?
Direct answer
What this page decides
02
A China AML programme should connect an institution-wide risk assessment to customer risk classification, proportionate due diligence, beneficial-owner identification, ongoing monitoring, suspicious-transaction escalation, recordkeeping and regulator-ready governance. The revised Anti-Money Laundering Law requires measures to match risk and protects normal financial service and lawful customer rights; it does not support indiscriminate de-risking as a substitute for analysis. The operating model must also cover products, delivery channels, geography, counterparties, agents and outsourced systems. Screening alone is not KYC, and collecting identity documents once is not ongoing due diligence.
At a glance
Which fact changes the next route
Use the fact that changes ownership or urgency to decide the next move.
| Question | Why it matters | Next route |
|---|---|---|
| Which entity has the AML obligation? | Licensed institutions, payment and clearing operators, and specified financial businesses can have different direct or supervisory duties. | Map each legal entity, branch, product and outsourced function. |
| Who is the customer and beneficial owner? | Identity documents do not by themselves establish ownership, control or the person for whom activity is conducted. | Document ownership, control and verification evidence. |
| What activity is expected? | Monitoring cannot identify anomalies without a reasoned customer and product baseline. | Record purpose, source, destination, scale and frequency. |
| Is the risk higher, lower or changing? | The law and current rules use a risk-based model rather than one uniform checklist. | Apply enhanced, standard or simplified measures only on documented grounds. |
| Has an alert become a suspicion? | Investigation, escalation, reporting and confidentiality require a controlled decision record. | Preserve the facts and route through the designated AML function. |
Scope
What this page owns — and what it does not
Practical workflow
Action, evidence, legal gate, output
| Action | Documents / evidence | Legal gate | Output |
|---|---|---|---|
| Map obligations and inherent risk | Entities, licences, products, customers, channels, countries and transaction data | Cover branches, agents and material outsourcing | Institution-wide risk assessment |
| Set governance and controls | Board and management roles, policies, staffing, systems and escalation paths | Assign authority, independence and resources | Approved AML control framework |
| Design customer due diligence | Identity, beneficial ownership, purpose, expected activity and verification sources | Match measures to documented risk | CDD and risk-rating standard |
| Monitor customers and transactions | Rules, scenarios, customer baselines, screening results and change triggers | Tune for products and typologies; investigate context | Alert and periodic-review programme |
| Investigate and escalate | Alert evidence, account history, linked parties and analyst reasoning | Separate suspicion decisions from commercial pressure | Documented report, restriction or closure decision |
| Retain, test and improve | CDD files, transactions, reports, model changes, training and audit findings | Preserve confidentiality and lawful access | Regulator-ready evidence and remediation log |
Documents
What to gather before the next call
These items help clarify the file; they are not a legal requirement list.
| Item | Why needed | Who holds it | Risk if missing |
|---|---|---|---|
| Institution-wide AML risk assessment | Connects exposure to controls and resources | Board, senior management and AML function | Checklist programme unrelated to actual business |
| Customer and beneficial-owner file | Shows identity, control, purpose and verification | Onboarding and compliance | Nominee or opaque ownership is missed |
| Expected-activity and risk-rating record | Provides the baseline for monitoring and review | Business and compliance | Alerts lack customer context |
| Alert investigation and escalation record | Explains the report or no-report decision | AML investigations | Undocumented or inconsistent treatment |
| System, training and assurance evidence | Demonstrates that policy operates in practice | Technology, HR, audit and compliance | Controls exist only on paper |
Common failure points
Where files usually break
Treating sanctions or name screening as the entire customer-due-diligence process.
Accepting a corporate registry extract without identifying and verifying the beneficial owner or controller.
Assigning a risk score without recording the factors, rationale or review triggers.
Closing every higher-risk relationship instead of applying proportionate measures and protecting lawful access to normal financial services.
Allowing commercial teams or an outsourced vendor to make undocumented suspicious-transaction decisions.
Changing monitoring rules without validation, governance, version history or outcome testing.
FAQ
Narrow follow-ups owned by this page
Is collecting an identity document enough for KYC?
No. Due diligence can require identity verification, beneficial-owner identification, purpose and expected activity, risk classification, ongoing review and transaction monitoring.
Should every high-risk customer be rejected?
Not automatically. Measures should be proportionate to assessed risk while maintaining lawful financial service and customer protections; some risks may require enhanced measures or make the relationship unacceptable.
Can transaction monitoring be outsourced?
Technology or operations may be supported by a vendor, but the institution must preserve governance, data access, investigation quality, confidentiality and responsibility for its legal duties.
Decision map
Keep the question bounded.
- Name the questionClassify whether the live job is KYC design, a suspicious-transaction file, or a regulator enquiry before collecting a full crime file.
- Collect the evidence trailCollect onboarding records, transaction alerts, the reporting officer and any existing SAR or police notice.
- Stay inside the right practiceHand data-cyber and payments-licence questions to those topics; this one stays on AML, KYC and financial crime.
- Open a sourced deep guideOpen the AML topic pages already on this hub.
Curated resources
Open the asset that matches this job.
FinTech & Financial Services Legal Hub
An overview of legal and regulatory issues affecting financial-services and FinTech businesses in China.
Online Lending Risks in China
Chunfang Chen's reviewed guide to online-lending roles, compliance duties and risk controls under China's current framework.
PRC Anti-Money Laundering Law (2024 Revision)
Official full text of the revised Anti-Money Laundering Law, effective 1 January 2025, covering supervision, risk-based duties, investigations, international cooperation and liability.
Financial Institution Customer Due Diligence and Recordkeeping Measures
Official PBOC, NFRA and CSRC rules on customer due diligence, beneficial ownership, ongoing measures and retention of identity and transaction records, effective 1 January 2026.
PBOC Decision Amending AML Supervision Rules
Official 2025 PBOC amendments aligning institutional governance, risk assessment, monitoring, reporting and market-entry review with the revised AML Law.
Helpful to prepare
Facts that make the next conversation clearer.
These items are orientation aids, not a legal requirement list.
Related legal file
Stay in this practice; send neighbouring questions to their owner.
Counsel hand-off
What to bring when you instruct
Bring the entity and licence map, institution-wide risk assessment, governance chart, CDD and beneficial-owner standards, customer risk model, monitoring scenarios, escalation and reporting procedures, sample case files, outsourcing contracts, record-retention schedule, training records, audit findings and current remediation plan.
Local context
Add the city only when it changes implementation.
National routing first. Local notary, court or bureau practice second.
Open city and province guidesCounsel hand-off
Need qualified counsel?
Financial-services counsel can classify the product and regulated activity, test licensing boundaries and plan regulator-facing or remediation work.
Find financial-services counselLegal review
Who reviewed this guide
Need qualified counsel?
Move carefully. Move with a record.
Use the portal to identify counsel for this practice and related China-side issues.