Hong Kong's Companies Registry publishes every AML decision it takes against a trust or company service provider, where TCSP AML requirements get defined (Companies Registry, TCSP disciplinary cases). The ledger runs to 94 decisions, May 2019 to June 2026. The largest fine in it is HK$90,000.
That is why almost nobody has read it. A number that size does not get repeated in a management meeting.
The record says something else. Across those 94 entries the regulator has moved from penalising missed notifications to penalising a failure to work out who owns the company in front of them. What follows is that layer, and what it means for a KYB chain that stops at the provider's letterhead.
The Layer That Forms the Entity
Three kinds of firm sit here. Corporate service providers, TCSPs in Hong Kong and CSPs in Singapore, incorporate companies and supply directors and shareholders on request. Licensed trust companies hold and administer trusts. Money services move the value once the structure exists.
The shape of the entity is what they decide: who sits on the board, who holds the shares, whose name tops the register. None of them takes deposits or lends. A shell with no substance reached your bank because somebody assembled it one layer upstream.
Hong Kong publishes that layer's discipline: 17 decisions on the current page, dated October 2024 to June 2026, and 77 archived.
The mechanics of seeing through a structure are set out in how far up the ownership chain a verification actually reaches. That method is not the subject here. What matters is that it now has an enforcement record.
What 94 Decisions Actually Say
Start with the amounts. Across the 94 TCSP decisions, 89 carry a fine, from HK$4,000 to HK$90,000, with a median of HK$14,000 and a total of HK$1,503,500. Five are reprimands with no fine.
By provision (of 94 decisions):
- Paragraph 23, Schedule 2 (reasonable measures against ML/TF risk): 60
- Paragraph 19(3) (internal CDD procedures): 45
- Paragraph 19(1) (PEP determination procedure): 33
- Licence condition 2: 25
- Paragraph 2(1) (identifying the customer or beneficial owner): 14
Split the ledger in two. Section 53U(1), becoming a director without the Registrar's approval, accounts for 31 decisions, all archived. Section 53W(1), failing to notify a change within a month, 36, of which 35 are archived. In the 17 decisions published since October 2024, those two appear 0 and 1 times.
What replaces them is substantive. Within those 17: paragraph 23 sixteen times, paragraph 19(3) ten, paragraph 19(1) eight, paragraph 2(1) six.
One reading is that small decisions in the middle of the chain are a leading indicator. That is my reading of the record. No regulator has said it.
Singapore Said It Out Loud
The Corporate Service Providers Act 2024 took effect on 9 June 2025 (ACRA, Corporate Service Providers Act 2024). Every business carrying on corporate services in and from Singapore must now register. The gap ACRA describes closing: "there is a regulatory gap as CSPs that are not RFAs may be engaged by customers to facilitate illicit activities."
Then the sentence that matters:
The amendments aim to prevent misuse of nominee directorship arrangements by way of business, in creating shell companies to facilitate money laundering. This situation is observed to be largely created by CSPs who arrange for unqualified individuals to act as nominee directors for their customers.
The regulator describes observed behaviour and names the mechanism: unqualified people put forward as directors, arranged by the provider. The premise of the argument, in the regulator's own words.
A registered CSP that breaches its AML/CFT/PF obligations commits an offence, fined up to S$100,000 for each breach; a parallel provision catches the individuals behind those failures at the same maximum. Nominee directors may only be arranged by a registered CSP, after a fit-and-proper assessment.
Where each jurisdiction draws that boundary is set out in the four-jurisdiction rule set behind these filings.
The Rest of the Layer
Money services are the other end of the same layer. Malaysia has been settling administratively: Bank Negara penalised Moneywave RM14,000 on 31 October 2025 for having no sanctions database, and JAGS Money RM17,400 on 19 September 2025 for CDD failures under section 74(3) of the Money Services Business Act 2011, plus a RM69,600 compound.
Singapore took a moneychanger to court. On 9 July 2026 Samlit Moneychanger was charged with 19 counts of failing to comply with a direction on complaints handling. Same layer, two instruments.
The trust side of the same layer gets the same treatment. On 25 May 2026 MAS imposed a S$300,000 composition penalty on Padang Trust, a licensed trust company, for failing to scrutinise unusual transactions and for late suspicious transaction reports (MAS, 25 May 2026). Each breach of MAS Notice TCA-N03 carries a maximum fine of S$1,000,000.
Three Checks on the Provider
If your KYB process ends with the documents your provider issues, your diligence ends where enforcement now starts.
Three checks. Is your provider on the register at all? Singapore's register is public; an unregistered provider is a finding in itself. On beneficial ownership, ask for evidence that it was verified; a register screenshot and a verification record look alike in a folder and part company under examination. Add the provider's own enforcement history to onboarding.
I made the neighbouring argument for payment processors in gaming: outsourcing KYC changes where the work happens, while accountability stays with the regulated firm.
the APAC control map sets out where these obligations sit.
Where This Leaves the Filing
A bank fine is an outcome. The decisions against the layer that formed the entity are where the cause starts being recorded.
the retrofit cost of a verification that was never done is the arithmetic underneath: a control never grounded in a verified entity cannot be relied on later.
What I cannot check from here: the ledger gives me what the 94 decisions say, and nothing about how many licensed providers exist: I have no licence count I would stand behind. So I cannot say what share of the layer they touch.
Nor can I test the shift itself. Seventeen decisions is a small window, and movement inside one can reflect filing practice as easily as supervisory priority.