Identity verification in Hong Kong
Hong Kong is Asia's most concentrated international financial centre and, since 1 June 2023, the region's most ambitious experiment in bringing crypto fully inside the regulatory perimeter. Onboarding a Hong Kong customer is not a screen capture — it is an act governed by the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), supervised by the Hong Kong Monetary Authority
Documents supported
(Government IDs from 220+ countries)
Average verification time
Countries covered
(Government-issued IDs validated)
Market overview
Hong Kong has a population of roughly 7.5 million, one of the world's highest GDP-per-capita numbers, and a financial sector that dwarfs its demographic footprint. For an identity-verification vendor, four clusters matter: - Central and Admiralty global banking. HSBC, Standard Chartered, Bank of China (Hong Kong), DBS, Hang Seng, Citi Hong Kong, JPMorgan Chase, Credit Agricole, Morgan Stanley, Goldman Sachs and UBS together hold trillions of HKD on Hong Kong balance sheets. These are authorized institutions (AIs) supervised by the HKMA under both the Banking Ordinance and the AMLO. Private-banking onboarding is the toughest identity use case in the territory — ultra-high-net-worth clients, Mainland Chinese source-of-wealth narratives, and enhanced due diligence on every beneficial owner. -
Supported documents
Didit templates cover national IDs, passports, residence permits and regional documents — plus 14,000+ documents globally for cross-border flows.
Regulators
all CDD documents and transaction records must be retained for at least five years after the end of the business relationship or the completion of the transaction, measured from the later date
2019, 2021 and subsequent updates
the "VATP Guidelines"
governed by the PCPD's Code of Practice on the Identity Card Number and Other Personal Identifiers (the "PIC Code"
the PCPD's **Guidance on Collection and Use of Biometric Data (August 2020, updated
PDPO section 33, which would restrict transfers to non-whitelisted jurisdictions, has never been brought into force, so in practice cross-border transfer is permitted provided the DPPs are otherwise c
d VASPs must collect, transmit and receive originator and beneficiary information for all virtual-asset transfers, irrespective of transaction value, with a reduced information set below HKD 8,000
d entities follow in practice
Immigration Department
regulated
Smart HKID card with chip and biometrics. HKID number assigned to all residents. Highly advanced card with multiple applications.
Office of the Government CIO
regulated
Government digital identity platform. Supports identity verification, digital signing, and form pre-filling. API available for authorized private sector use.
Companies Registry
open
Business register. Online search via ICRIS (Integrated Companies Registry Information System).
Government & regulated databases
Compliance framework
AML framework
Supervised by Record-keeping
The Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) is the backbone of Hong Kong KYC. Originally enacted in 2012 and repeatedly amended (notably by the Amendment Bill 2022 to add the VASP regime), it is published on the official elegislation.gov.hk portal. Key anchors for any onboarding flow:
Data protection
Supervised by National DPA
A production-grade Hong Kong onboarding flow ships in English, Traditional Chinese (Cantonese-speaking audience), and Simplified Chinese (Mainland-origin customers and cross-border flows). Sentence-level translation is not sufficient: legal terms of art (e.g., beneficial owner / 實益擁有人, politically e
Penalties for non-compliance
- Integrated AML screening against 1,000+ global watchlists including UN sanctions implemented under Cap. 537, OFAC SDN, UK OFSI, EU consolidated list, HKMA-designated terrorist lists, and commercial PEP feeds.
Use cases
Neobanks, EMIs, payment institutions, lenders, brokerages.
Hong Kong is not a non-documentary KYC market. Unlike India's Aadhaar eKYC or Brazil's Receita Federal CPF API, there is no open government identity API that a vendor can hit to resolve a name, date of birth and national ID number to a definitive "match / no match" answer. Verification is therefore
Exchanges, custodians, wallets, on/off-ramps.
Biometric authentication is mandatory in practice for any non-face-to-face onboarding in Hong Kong. The HKMA's remote-onboarding circulars, the SFC's AML Guideline, and the IA's GL3 all implicitly require a liveness-and-face-match layer because the alternative — independent third-party introduction
Sports betting, online casinos, age-gated platforms.
Hong Kong maintains no domestic PEP list. Market practice is to rely on commercial databases (Dow Jones Risk & Compliance, LexisNexis WorldCompliance, Refinitiv World-Check, ComplyAdvantage, Moody's Orbis / Bureau van Dijk) for both foreign and domestic PEPs. On sanctions, Hong Kong implements Unite
Gig platforms, delivery, creator economy, e-commerce.
The FATF Travel Rule applies in two parallel tracks:
Biometric liveness
Under the HKMA's outsourcing framework (SPM module SA-2) and the SFC's outsourcing circulars, a regulated institution may outsource the execution of CDD to a third party — including an identity-verification vendor — but remains fully responsible for compliance with the AMLO. Cross-border transfer of personal data for the purpose of AMLO compliance is permitted under the PDPO provided the DPPs are respected and contractual safeguards are in place. Operators should document the vendor's ISO 27001
CERTIFICATIONS
Our platform meets the highest international standards for information security, data privacy, and biometric accuracy.
Full EU data protection compliance
Information security management
PAD (liveness + face match)
TRUSTED WORLDWIDE
Join thousands of companies that trust Didit for their verification needs
Didit’s NFC + active biometrics technology blocks the most advanced fraud scenarios, offering a level of security equivalent to or superior to in-person verification.
Spanish Financial Sandbox
CNMV, SEPBLAC & Spanish Treasury — Conclusions Report
Didit is an exceptionally valuable partner, delivering a stable and highly adaptable solution”.
Vuk Adžić
Head of the E-Business Department at Crnogorski Telekom
Didit offered us a robust technology with a simple implementation and adaptability to different markets”.
Fernando Pinto
CEO & CoFounder at TucanPay
Thanks to Didit we have been able to reduce manual processes and improve data extraction accuracy”.
Diana Garcia
Trust & Safety Executive at Shiply
Didit’s integration slashed verification times and costs, freeing resources for other projects”.
Guillem Medina
COO at GBTC Finance
Didit removed KYC costs, enabling faster scaling with high verification standards and less fraud.”
Paul Martin
VP Marketing & Growth at Bondex
Didit’s secure, user-friendly verification boosts customer trust and optimizes our process.”
Cristofer Montenegro
Executive assistant to the CEO at Adelantos
Didit ensures a precise, secure digital onboarding without slowing negotiations or client time.”
Ernesto Betancourth
Gerente de riesgos at CrediDemo
FAQ
Yes. Hong Kong permits remote KYC onboarding under its national AML framework, including document verification, biometric liveness and video identification where required by regulation.
Didit verifies all major national IDs, passports and residence permits issued in Hong Kong, plus 14,000+ document types globally for cross-border flows.
Didit charges $0.30 per verification with 500 free checks per month. No contracts, no minimums. Competitors typically charge $1.00–$2.50+ per verification.
Yes. Didit screens against 1,000+ global watchlists including PEP databases, sanctions lists (EU, UN, OFAC, OFSI), and adverse media — covering all AML obligations in Hong Kong.
Most regulated sectors in Hong Kong require or strongly recommend biometric liveness detection for remote onboarding. Didit provides ISO 30107-3 PAD Level 2 certified liveness.
Yes. Didit supports document verification, liveness, AML screening and ongoing monitoring aligned with Hong Kong’s crypto regulatory framework, including EU Travel Rule compliance where applicable.
Yes. Didit provides document-based age verification and identity confirmation suitable for Hong Kong’s iGaming regulatory requirements.
500 free verifications per month. No contracts, no minimums. $0.30 per verification after the free tier.
