01 — What Regulators Actually Assess
The shift from "have" to "prove."
Regulatory supervision in Asia has undergone a fundamental shift over the past five years. The question is no longer "do you have a policy?" It's "can you prove it works?"
This shift is visible across every major regulator in the region.
The HKMA has moved explicitly toward outcomes-based supervision. Recent enforcement actions — including HK$16 million in fines across three banks in 2023–2025 — focus not on missing policies, but on governance failures, inadequate senior management oversight, and controls that existed in documentation but failed in practice.
The SFC has embedded effectiveness expectations into its strategic priorities for 2024–2026. Year three of that cycle — 2026 — is when the SFC will demonstrate what its priorities achieved. Expect enforcement to function as the evidence of impact.
MAS in Singapore has long operated an outcomes-focused model, and its influence on Hong Kong and broader APAC regulatory approaches is clear.
The three layers of assessment
When a regulator conducts an inspection, they assess at three distinct layers.
Layer 1: Design adequacy
Are your policies and procedures sufficient for the risks you face? Is your risk assessment proportionate? Are controls designed to address identified risks?
Layer 2: Operational effectiveness
Do those controls actually work in practice? Can you demonstrate — with evidence and data — that they prevent or detect harm? Are they calibrated to your actual risk exposure, not theoretical risk?
Layer 3: Management oversight
Does senior management actively govern the framework? Is there evidence of challenge, resource allocation, and decision-making driven by compliance data? Does the board understand and own the risk?
Most firms prepare for Layer 1. Internal audit tests Layers 1 and partially Layer 2. Regulators assess all three — with increasing weight on Layers 2 and 3.
The inspection gap lives in the space between what firms prepare and what regulators assess.
02 — The Five Most Common Inspection Findings
Patterns that recur with striking consistency.
Based on patterns observed across dozens of inspection cycles, regulatory reviews, and remediation programmes in Asia, five findings recur with striking consistency.
Finding 01
Risk assessment disconnect
The risk assessment exists. It's board-approved. It's reviewed annually. It identifies the right risk categories.
But it doesn't drive anything.
Customer risk ratings don't clearly link back to the methodology. Monitoring thresholds weren't derived from the assessment's conclusions. Resource allocation doesn't reflect the priorities it identifies. Enhanced due diligence triggers don't correspond to the risks it highlights.
The assessment is an artefact — produced for compliance purposes, disconnected from operational reality.
Finding 02
Governance theatre
Compliance committees meet. Minutes are recorded. Standing agenda items are covered. Reports are received.
Nothing changes.
The hallmarks of governance theatre:
- Minutes that record receipt of information but no challenge or debate
- MI packs that present the same metrics quarter after quarter without triggering any action
- No evidence of the committee ever overruling a business decision or escalating a concern
- Actions limited to "continue monitoring" or "review at next meeting"
Finding 03
Training that doesn't stick
Training completion rates are 100%. Every employee has completed their annual AML module. Records are immaculate.
But when the regulator asks frontline staff to explain the firm's risk appetite, or describe what they'd do if they encountered a suspicious transaction outside normal patterns, or name the firm's top three financial crime risks — blank stares.
Finding 04
MI that doesn't inform
Management Information reaches the board. Dashboards exist. Data is presented regularly.
But there's no evidence that anyone acted on it.
Typical MI failures:
- SAR volumes trend downward for six months. No one asks why.
- Alert-to-SAR conversion rates drop to 1%. No one questions whether monitoring is effective.
- Customer risk ratings skew heavily toward "medium" — a distribution that statistically suggests the model isn't differentiating. No one investigates.
- Training completion dips in one business unit. No follow-up documented.
Finding 05
Undocumented rationale
Controls exist. Thresholds are set. Suppression rules are active. Risk scoring weights are configured.
No one can explain why.
The person who made the original decision left three years ago. The rationale wasn't documented. The current team inherited the configuration and hasn't changed it — not because it's correct, but because they don't know what changing it would break.
03 — The Root Cause
Compliance as documentation exercise.
These five findings share a common root: firms treat compliance as a documentation exercise rather than an operational discipline.
The documentation trap
When compliance is measured by the existence of documents — policies written, procedures filed, minutes recorded, training completed — the incentive is to produce documents. Not to ensure those documents reflect reality.
The result is a compliance function that generates paper while gaps persist in practice. The paper satisfies internal audit. It populates the committee pack. It fills the regulatory submission. But it doesn't prevent financial crime, and it doesn't withstand regulatory scrutiny.
The audit-driven compliance cycle
Many firms' compliance programmes are shaped by their internal audit methodology. Audit tests control design and procedural conformity. Compliance teams, knowing this is what's assessed, optimise for audit outcomes.
Audit rewards consistency. Regulators reward effectiveness.
When audit becomes the primary assurance mechanism, the compliance function unconsciously designs for the wrong audience. Controls become auditable rather than effective. Documentation becomes an end rather than a means.
The cultural dimension
Beneath the structural issues is a cultural one: in many firms, compliance is understood as a documentation function rather than a risk management function.
Compliance teams produce policies, file reports, maintain records. They're measured on output — documents produced, training delivered, actions closed. They're not measured on outcomes — risks mitigated, harm prevented, regulatory expectations met.
This cultural positioning makes the inspection gap inevitable. If the function is oriented toward production rather than protection, its outputs will satisfy administrative requirements while leaving operational gaps unaddressed.
04 — Closing the Gap
A practitioner framework.
Closing the inspection gap requires a fundamental shift from documentation-oriented compliance to effectiveness-oriented compliance. Five practical steps.
Separate from internal audit, conduct an independent review that specifically tests whether your controls work — not whether they exist.
Effectiveness testing asks:
- Does your transaction monitoring system detect the typologies relevant to your customer base? Test it with known scenarios.
- Does your CDD process produce information that's actually used for ongoing monitoring? Or is it collected and filed?
- Does your risk assessment produce ratings that differentiate customers meaningfully? Or does everyone cluster in the middle?
- Do your escalation procedures result in timely, appropriate action? Trace recent escalations from trigger to resolution.
This isn't audit. It's validation. The objective is to identify where your controls are operationally hollow — present on paper, absent in practice.
Transform compliance governance from a reporting exercise to a decision-making forum.
Practical mechanisms:
- Require every committee meeting to close with at least one decision or escalation — not just "noted"
- Include a standing agenda item: "What should we change based on today's data?"
- Track whether MI has triggered action within defined timeframes
- Record challenge and debate in minutes — not just attendance and agenda coverage
- Measure governance effectiveness by decisions made, not meetings held
Redesign management information to force decisions rather than inform passively.
Effective MI includes:
- Trend analysis with exception triggers — if a metric crosses a threshold, it automatically generates a required response
- Comparative data — how does your SAR rate compare to peer benchmarks? How do your risk ratings distribute versus industry norms?
- Effectiveness indicators — alert-to-SAR conversion, time-to-escalation, detection rate by typology
- Decision prompts — "this data suggests X. The options are A, B, or C. Which do we choose?"
MI that lands on a desk without demanding a response is not management information. It's compliance decoration.
Conduct internal mock inspections with adversarial questioning — not scripted walk-throughs, but genuine stress tests.
Effective simulation:
- Use external reviewers who don't know your framework intimately
- Request documents with short deadlines — test retrieval capability
- Interview staff at multiple levels without advance preparation
- Ask "why" repeatedly — why this threshold, why this rating, why this structure
- Test whether explanations are consistent across the organisation
- Identify gaps between what's written and what's understood
Run these annually at minimum. More frequently if you're expecting regulatory engagement.
Ensure that every significant control decision is documented with its rationale — at the time it's made, not reconstructed later.
This includes:
- Why monitoring thresholds are set where they are
- Why risk scoring weights are configured as they are
- Why suppression rules exist and what risk they manage
- Why certain customers are rated at particular risk levels when the rating isn't obvious
- Why resource allocation decisions were made
- What data or analysis informed each decision
When staff change, this documentation preserves institutional knowledge. When regulators ask "why," you have an answer grounded in analysis rather than inheritance.
05 — Preparing for 2026
The regulatory direction.
2026 brings three converging pressures.
Senior management accountability
The HKMA has demonstrated willingness to identify governance failures by name. Expect this to extend beyond banking into securities and virtual assets. Personal accountability is no longer theoretical.
Cross-regulator coordination
The HKMA/SFC joint enforcement on EFG Bank signals a structural shift. Information sharing between regulators means a finding in one domain triggers scrutiny in another. Siloed compliance responses will not survive.
Virtual asset enforcement
The SFC has moved from licensing to enforcement on virtual assets. The HKMA's stablecoin guidelines are in force. Firms in the VA space face immediate compliance expectations — not transitional periods.
Inspection-ready vs. audit-ready
The distinction matters.
Audit-ready means: our documents are complete, our processes are followed, our records are maintained.
Inspection-ready means: our framework is proportionate to our risks, our controls demonstrably work, our governance drives decisions, and our people can explain all of this under pressure without a script.
The first is necessary. The second is what the regulator tests.
The question to ask today
One question that predicts inspection outcomes better than any other.
If a regulator asked any member of your team — not just compliance — to explain your firm's top three financial crime risks and what you do about them, would the answer be consistent, confident, and supported by evidence?
If yes, you're inspection-ready.
If no, you have work to do. And the time to do it is before the letter arrives.