For those in remittance or money exchange businesses, the biggest headache is often not a lack of clients, but improper handling of compliance documents. During customs inspections, failing to produce complete client due diligence records can result in fines or even the revocation of an MSO license . Many business owners assume that filling out a copy of an ID card is sufficient, only to discover later that they’ve overlooked numerous details.

This article will break down the entire process, documentation requirements, and common compliance pitfalls of MSO customer due diligence from a practical perspective . Whether you are a newcomer to the licensing process or a compliance officer looking to optimize existing processes, you can use this information directly.

Confirm customer’s basic identity information

The first step in CDD (Content Delivery) is figuring out who your customers are. You need to record their full name, date of birth, nationality, contact number, and address. If it’s a corporate customer, you need to record the company name, registration number, business type, and registered address. This information seems simple, but many people overlook verifying the timeliness of the data—for example, whether the address provided by the customer matches a recent utility bill.

In practice, we recommend completing document verification at the time of account opening, rather than waiting until after a transaction. For example, one client provided an address certificate from three months prior, but had moved since then, resulting in customs questioning the effectiveness of the inspection. Therefore, it’s best to verify the original documents immediately when confirming basic information and record the verification date and the person handling the transaction in the system.

• Individual customers: Name, Hong Kong Identity Card number (or passport number), date of birth, address, contact number
• Corporate Clients: Full Company Name, Business Registration Number, Registered Address, Description of Main Businesses, List of Directors and Shareholders

Obtain valid identification documents

Basic information alone is not enough; you need to obtain valid identification documents. For Hong Kong residents, the most common document is their identity card, while non-residents use their passports. Crucially, you must ensure the document is not expired and that the photo matches your appearance. Many compliance novices overlook this—obtaining a copy of a client’s passport from three years ago, even though the client has since obtained a new passport. This situation is easily considered a flaw during the review process.

Another practical pain point is the quality of document copies. Some businesses, to save time, simply take a quick photo with their phones, resulting in blurry identification numbers. It’s recommended to use a scanner or high-resolution camera to take the photo and require the client to sign and confirm the copy. This complies with legal requirements and provides strong evidence in case of future inquiries.

Verify address verification documents

Address verification is the most easily overlooked aspect of CDD (Cash Exchange Dealership). Many exchange shops only require customers to provide their ID cards, neglecting address verification. According to MSO (Mechanical, Commercial, and Industrial) licensing regulations , you must verify the customer’s residential or business address. Acceptable documents include: utility bills (water, electricity, gas), bank statements, government-issued letters, etc. Documents must be dated within the last three months, and the name must match the identity document.

Many people ask: What if the customer provides an electronic invoice? The answer is yes, but you must ensure the document is authentic and unaltered. You can ask the customer to log into their online banking immediately to view the invoice, or call the relevant institution directly to verify. We’ve seen far too many examples of customers using Photoshop to change addresses, only to be discovered during customs inspections, ultimately resulting in penalties for the company. Therefore, spending an extra five minutes verifying addresses can save you endless trouble later.

Identify the ultimate beneficiary and controller

When conducting MSO (Money Laundering Organization) business, you can’t just look at the surface-level clients. According to anti-money laundering requirements, you need to identify the Ultimate Beneficial Owner (UBO)—that is, the person who actually controls the company or funds. Typically, an individual holding 25% or more of the company’s shares meets the UBO definition. If the shareholding structure is complex (e.g., held through trusts or offshore companies), you need to trace the ownership through multiple layers.

In practice, we recommend requiring clients to complete a shareholding structure diagram and attach relevant supporting documents (such as a certificate of incorporation and a register of shareholders). If a client is unwilling to disclose their UBO, you may have to refuse to provide services. Never compromise to avoid trouble, because if something goes wrong, customs will hold you accountable for compliance issues.

• Confirm UBO’s name, address, and ID number.
• Obtain the company’s organizational chart
• Check if a UBO is a politician (PEP) or a sanctioned individual.

Assess customer risk level

Not all clients should be treated with the same standard. You need to determine a risk level for each client based on their background, transaction patterns, source of funds, and other factors. High-risk clients (e.g., from high-risk countries, involved in sensitive industries, or with frequent large cash transactions) require more thorough due diligence and the collection of more background information; low-risk clients can be handled with a simplified procedure.

Here’s a common mistake: some companies, to save time, classify all clients as low-risk. However, during inspections, customs will question the logic behind your risk assessment. The correct approach is to create a written risk scoring system, listing various indicators (such as country of origin, transaction amount, and product type), and then categorize them according to scores. This provides both objective standards and the ability to address regulatory questions.

Establish a continuous monitoring and updating mechanism

CDD (Contact Distributor) is not a one-off task. Throughout the client relationship, you need to continuously monitor transaction activity and regularly update client information. For example, if a client’s transaction volume suddenly surges or their fund flows are unusual, you should activate the alert mechanism. It is also recommended to update client information at least annually, including re-verifying address verification and confirming any changes in equity structure.

Many small and medium-sized money exchange shops neglect continuous monitoring, thinking that “if you do a good job when opening an account, everything will be fine.” However, customs inspections often focus on transaction records. If you cannot explain why a certain transaction was unusual but did not trigger an investigation, it constitutes a compliance loophole. The simplest solution is to use a compliance system to automatically flag high-risk transactions, which will then be reviewed periodically by a compliance officer.

In summary, MSO client due diligence is not a single action, but a cyclical process. From the rigorous review at account opening to ongoing monitoring, each step needs to be properly documented. If you haven’t yet established a standard procedure, or have questions about your existing practices, please contact us directly . We will provide specific optimization suggestions based on your business model.