Look, HK$19.5 million is what FWD Life just paid the Insurance Authority for anti-money laundering failures (Bing news, this week), and the same three days produced two separate HKMA scam alerts (September 22 and September 23) plus an HKICL warning about fraudulent websites impersonating the payments clearing house. None of those are the same problem. FWD's is a control failure inside a licensed insurer's own AML programme. The HKMA alerts are the regulator's press office republishing warnings about criminals impersonating banks, which changes no institution's obligations (it's a public notice, not supervisory guidance, however useful it is to the customer scrolling past a fake login page).

For a Hong Kong-authorized insurer, the FWD number is the one that lands on a compliance desk: IA GL3 governs AML/CFT obligations for insurers and intermediaries under the Anti-Money Laundering Ordinance, and a $19.5 million penalty is the Insurance Authority's own arithmetic on what gaps in that programme cost (the IA hasn't published the breakdown by control failure yet, so what exactly failed, customer due diligence, transaction monitoring, suspicious activity reporting, is the open line item). Separately, the HKMA's repeated scam alerts this week are a signal about volume, not a new duty: banks' existing obligations under the Code of Banking Practice on fraud awareness and reporting don't change because the regulator posted twice in two days.

The FWD penalty decision itself is the primary source; expect the IA to publish the underlying breach findings in its usual disciplinary notice format, which historically follows weeks after the headline fine, not months. Until then, HK$19.5 million is the number every other insurer's compliance head is benchmarking their own AML remediation budget against.