Answering a question on stooge accounts opened with stolen identities, the Government set out where remote onboarding checks are heading. Digital lenders face the same fraud.
On 21 October 2026 the Under Secretary for Financial Services and the Treasury, Joseph Chan, answered a Legislative Council question on improving online bank account opening. The question concerned stooge accounts opened remotely with stolen identities.
The reply set out the existing safeguards. In 2023 the HKMA issued guidance requiring clear on-screen messages during the selfie and liveness steps of remote onboarding, and the "e-Banking Security ABCD" package of August 2025 includes deepfake-detection practices. The Government has no plans to let banks access SIM card real-name registration data. The HKMA is working with the Digital Policy Office to integrate iAM Smart step-up authentication, which combines facial recognition with reading the chip in the identity card, into remote account opening. First-phase testing has begun and will be expanded gradually on a risk basis.
The reply is about bank accounts, but the fraud pattern is the same one digital lenders see. A loan applied for online with a stolen or borrowed identity, disbursed to an account controlled by someone else, is a stooge account problem with a credit loss attached. Banks and larger lenders that onboard remotely face it too, and the answer is the same: verified identity at the door, a recorded check and a named reviewer.
The direction is clear: a photograph of an identity card and a selfie are no longer treated as the end of identity verification. Reading the identity card chip, and checking that the face matches the person holding it, is where bank onboarding is going. For a lender, the practical step is to record which checks each application actually passed, so that a decision on a high-value or high-risk application can require the stronger check rather than assume it happened.
We wrote in August that eKYC is not finished when the HKID is photographed. This reply makes the same point from the Government's side.
Covenant Desk publishes regulatory context for Hong Kong lending operations, not legal advice. Confirm how anything here applies to your licence with your own advisers.