For licensed trust or company service providers and CPA firms: customer due diligence, the risk assessment behind it, the Significant Controllers Register, the statutory registers, and the audit trail that shows who did what and when. 為持牌信託或公司服務提供者及會計師事務所而設：客戶盡職審查、背後的風險評估、重要控制人登記冊、法定登記冊，以及顯示誰在何時做了甚麼的審計紀錄。
| 責任What the licence expects | 系統中的位置Where it is kept |
|---|---|
| 客戶盡職審查Customer due diligence | 每位客戶的盡職審查表格：關係的目的及性質、是否面對面、經由代理或依賴其他機構，以及信託客戶的財產授予人、受託人、保護人及受益人。The CDD form held for each customer. |
| 身分核實Identity verification | 每位人士、每位客戶分別記錄：所見文件、正本或核證副本、由誰核證、由誰查核及何時查核。Per person, per customer: the document seen, original or certified copy, who certified it, who checked and when. |
| 制裁及政治人物篩查Sanctions and PEP screening | 所查清單（聯合國、OFAC、英國、歐盟或其他）、日期、結果（無命中／已澄清／真實命中）及由誰篩查；真實命中須記下發現及處理。The lists, date, result and who screened; a true match records what was found and done. |
| 風險評估Customer risk assessment | 41 條加權問題，得出低、中或高風險；另記財富及資金來源、加緊審查措施，以及建議與批准（分別記錄，不由同一人自動完成）。41 weighted questions; source of wealth and funds; EDD measures; recommendation and approval recorded separately. |
| 定期覆核Periodic review | 高風險客戶總在上次評估後 12 個月內；低及中風險按公司設定的月數，未設定則按周年申報日期。下次覆核日期印在客戶檔案上。High risk within 12 months; low and medium on the firm's interval or the annual return date. |
| 重要控制人登記冊Significant Controllers Register | 重要控制人登記冊可獨立列印；另有重要控制人及指定代表的會議紀錄，以及指定代表的委任決議及同意書。The SCR prints on its own, with the SC and DR minutes and the DR's appointment resolutions. |
| 法定登記冊Statutory registers | 股東、董事、公司秘書及押記登記冊，按指定日期列印；登記冊存放於其他地點時，以 NR2 通知。Members, directors, secretaries and charges, as at a chosen date; NR2 when kept elsewhere. |
| 文件登記冊Document Register | 每份文件何時收到、如何收到、何時送出、送往何處均予記錄；電子提交的收據一併保存。Every document in and out — date, method, waybill — with e-submission receipts. |
| 內部管控Internal controls | 可開啟「張貼前覆核」：同事的修改待主管批准，製作人不能批准自己的修改。每項修改、登入及匯出均寫入審計紀錄，保留十二個月。Review before posting — a maker cannot approve their own change; every change, sign-in and export is logged for twelve months. |
| 資料保護Data protection | 敏感欄位在資料庫內加密，密鑰存放在資料庫以外；每間公司由列級安全分隔；備份已加密；強制雙重認證。Sensitive fields encrypted with the key kept outside the database; row-level security per firm; encrypted backups; two-factor sign-in. |
The obligations are described as the firm's own day-to-day practice, not as legal advice. Each firm remains responsible for the records its licence requires. 上述責任以公司日常實務描述，並非法律意見。每間公司仍須就其牌照所要求的紀錄負責。
The answers work out to a rating of their own — Low, Medium or High — so the file shows the method, not only one person's opinion. 答案本身計算出一個評級——低、中或高——檔案顯示的是方法，而非單憑一個人的看法。
The officer recommends; the approval is recorded with its approver and date. Where the officer's rating differs from the one the answers give, the reason is required. 由人員建議，批准則連同批准人及日期記錄。如人員所定評級與答案計算所得不同，須記明理由。
Every assessment is kept as it stood — when it was made, by whom, what it said — so the file can show the history, not only the latest. 每次評估按其當時狀況保存——何時、由誰、說甚麼——檔案可顯示歷次評估，而非只有最新一次。
Worked out from the rating and the firm's own interval, printed on the file, and movable earlier for a trigger event. 按評級及公司自訂的覆核周期計算，印在檔案上；如遇觸發事件可提前。
A member's history of particulars is kept for ten years after they leave every company — the firm may set its own period, or keep it for ever. A deleted company sits in a 30-day recycle bin before it is purged; the audit log is kept twelve months. 成員的詳情更改歷史，在其離開所有公司後保留十年——公司可自訂年期，或永久保留。刪除的公司先放入 30 日回收箱，然後清除；審計紀錄保留十二個月。
Each firm's records are separated at the database's row level. The platform's own support may edit a firm's record only when the firm asks, with a reason, and for an hour. 每間公司的紀錄由資料庫列級安全分隔。平台支援只會在 貴公司要求、並說明理由時，於一小時內修改紀錄。
A full identification number, shown or printed, is itself written to the audit log — so a file can show who looked at it. 完整的身份證明號碼被顯示或列印，本身亦會寫入審計紀錄——檔案可顯示誰曾查看。
Companies incorporated anywhere may be recorded; the filings the system prepares are the Hong Kong Companies Registry and Business Registration Office forms. 任何註冊地的公司均可記錄；系統擬備的申報文件為香港公司註冊處及商業登記署的表格。
It does not run the screening for you. It keeps the record of a check a person made, or that a screening tool outside the app made: the lists, the date, the result and who did it. 系統不會代替你做篩查。它保存由人員或系統以外的篩查工具所作的檢查紀錄：所查清單、日期、結果及由誰負責。
It does not give legal or compliance advice. The firm remains responsible for the records its licence requires, and for the judgments recorded in them. 系統不提供法律或合規意見。公司仍須就其牌照所要求的紀錄，以及紀錄中的判斷負責。
It records the screening rather than performing it: the lists checked (UN, OFAC, UK, EU or another), the date, the result and who did it. A true match must record what was found and what was done about it.
系統記錄篩查結果，而非代替人手篩查：所查清單（聯合國、OFAC、英國、歐盟或其他）、日期、結果及由誰負責；如為真實命中，須記下發現了甚麼及如何處理。
A high-risk customer is always reviewed within 12 months of the last assessment. Low and medium risk follow the firm's own interval, and where none is set, the company's annual return date.
高風險客戶總在上一次評估後 12 個月內覆核。低及中風險客戶按公司設定的月數覆核；未設定者，則按該公司的周年申報日期覆核。
ID and passport numbers, dates of birth, mobile numbers and sources of wealth are encrypted in the database with the key kept outside it; each firm's records are separated by row-level security, and backups are encrypted.
身份證及護照號碼、出生日期、手提電話及財富來源在資料庫內加密，密鑰存放在資料庫之外；每間公司的紀錄由列級安全分隔，備份已加密。