I'll see what I can dig up, but you're unlikely to find explicit references saying what is and what isn't acceptable. The FSA created what it termed "principle-based regulation", which laid out principles for how to do business rather than strict rules. It's therefore a game of interpretation. The FCA have inherited that rulebook (this would fall under the FCA's jurisdiction as relating to conduct, as opposed to the PRA, who are interested in financial prudence, i.e. is your company going to collapse).
The intersection between the FCA's "room for interpretation" guidelines and the "enshrined in law" ML legislation is where policies like this one are born. One compliance team in one organisation will interpret is as a must do, and another as a nice to have.
ETA: I didn't actually say this was new regulation. I said that the FCA are throwing out new reviews all over the place, and changing ("clarifying") old guidance regularly, which has created an atmosphere of caution. It's possible HSBC have had this policy in place for a while, and it's only just made it to the news - or they might have instigated it recently.
Policies tend to get reviewed regularly, and while regulations might not have changed, the company's attitude to what's compliant or not may well do. Just because you haven't been hauled over a barrel for a policy in the past doesn't mean a new regulatory body might not make a huge deal of it now.
