The Hong Kong Stock Exchange has finalised its proposed amendments to the Listing Rules to tighten restrictions on backdoor listings and continuing listing criteria. The changes are aimed at combatting listed company shell activities which have been the subject of ongoing regulatory scrutiny in recent years. Continue reading
Tag: Asia
HKMA rates level of money laundering and terrorist financing risk for SVF sector as medium
Last Friday, the Hong Kong Monetary Authority (HKMA) published its money laundering and terrorist financing (ML/TF) risk assessment report for the stored value facility (SVF) sector in Hong Kong.
The latest assessment confirms that the SVF sector continues to carry a medium level of ML/TF risk.
While the majority of the sector continues to be characterised by lower ML/TF risks (as indicated by the use of SVF products for low value transport and retail transactions), some pockets of higher ML/TF risks have emerged, arising from SVF products with functions such as overseas cash withdrawal and cross-border remittances.
SVF licensees should consider the HKMA’s report, and (where necessary) update their institutional ML/TF risk assessments and enhance their internal systems and controls.
Launch of Asia Pacific Guide to Privilege 2019
Please click here to access a preview of the Guide.
We are pleased to launch the 2019 edition of our Asia Pacific Guide to Privilege.
Businesses are increasingly faced with multi-jurisdictional disputes where evidence rarely falls within the borders of a single country and complex legal privilege issues often surface when dealing with communications across multiple jurisdictions.
Compiled by our network of Herbert Smith Freehills lawyers and trusted local counsel, the updated Guide takes account of the latest developments across Asia Pacific and covers 21 jurisdictions.
SFC, CSRC and MOF sign tripartite MOU on access to audit working papers kept in Mainland China
Last week, the Hong Kong Securities and Futures Commission (SFC) signed a tripartite memorandum of understanding (MOU) with the China Securities Regulatory Commission (CSRC) and the Ministry of Finance of the People’s Republic of China (MOF) regarding audit working papers in the Mainland arising from the audits of Hong Kong-listed Mainland companies.
FATF expects to finalise mutual evaluation report on Hong Kong’s AML/CFT regime by September 2019
The mutual evaluation of Hong Kong was a subject of discussion at the Financial Action Task Force (FATF)’s recent plenary meeting in Orlando, Florida (19-21 June 2019). This follows the FATF’s on-site visit to Hong Kong late last year.
SFC encourages the industry to keep in mind the ‘spirit’ of the new Internal Investigation Disclosure Requirement introduced to halt the ‘roll’ of ‘bad apples’
On 17 June 2019, Ms Julia Leung (Deputy Chief Executive Officer, Intermediaries) and Mr Wilson Lo (Senior Director, Licensing) discussed the recent initiative by the Securities and Futures Commission (SFC) to halt the ‘roll’ of ‘bad apples’ within the financial services industry at the 2019 SFC Compliance Forum (Forum). The SFC encourages industry participants to have regard to the spirit of the Internal Investigation Disclosure Obligation when assessing whether internal investigations in relation to outgoing licensed individuals should be disclosed to the SFC.
SFC Compliance Forum 2019: the SFC outlines its key supervisory priorities for the year ahead
The Securities and Futures Commission (SFC) held its third annual Compliance Forum (Forum) on 17 June 2019 – a series of six panel discussions with industry participants:
- Morning plenary panel: Digital journey of client onboarding, act on red flags of improper client activities
- Morning breakout session 1: Vaccines of client protection – internal controls and supervision of account executives
- Morning breakout session 2: Securities margin financing
- Afternoon plenary panel: Governance framework as a driving force for a culture of accountability and behavioural change
- Afternoon breakout session 1: Gearing up for distribution of investment products in an evolving world
- Afternoon breakout session 2: Regulatory obligation and risk management function of prime brokerage in Hong Kong as Asia’s hub
HKMA reminds registered institutions of their Internal Investigation Disclosure Obligation
Authors: William Hallatt, Hannah Cassidy, Natalie Curtis, Tess Lumsdaine and Isabelle Lamberton
The Hong Kong Monetary Authority (HKMA) has issued a circular to registered institutions (RIs) in relation to the frequently-asked questions (FAQs) released by the Securities and Futures Commission (SFC) on 21 May 2019, which sought to clarify the SFC’s Internal Investigation Disclosure Obligation.
In the circular, the HKMA reminds RIs that they also must comply with the Internal Investigation Disclosure Obligation, when notifying the SFC that an individual has ceased to act as its executive officer (EO), reflecting the SFC’s guidance in Question 9 of the FAQs.
The Internal Investigation Disclosure Obligation
On 1 February 2019, the SFC announced significant changes to its licensing forms and processes. Included in these changes was the introduction of the compulsory Internal Investigation Disclosure Obligation through the new Form 5U, which came into effect on 11 April 2019.
The Internal Investigation Disclosure Obligation requires RIs to provide information to both the SFC and the HKMA regarding:
- whether departing EOs were the subject of an internal investigation in the six months prior to their cessation; and
- details of this investigation, if such details have not previously been provided to the regulators.
Firms are also required to notify the SFC and HKMA as soon as practicable if an internal investigation into that individual is commenced subsequent to making the initial notification of cessation (for more details, please see our February 2019 bulletin).
The FAQs
On 21 May 2019, the SFC released the FAQs to clarify various aspects of the Internal Investigation Disclosure Obligation, including:
1. The scope of reportable investigations
It is now clear that the scope of reportable investigations is very wide, given that:
- firms are required to proactively disclose information about all “investigative actions” (no matter how they are described in internal policies), regardless of whether the subject matter covers regulated or unregulated activities; and
- no materiality threshold will apply to exclude low-level investigations that are of minimal significance from the obligation.
2. The level of detail required for disclosures
When making an internal investigation disclosure, firms are required to provide information on:
- factual matters, including a description of the matter, background, relevant dates, duration, the role played by the outgoing employee, and status of the investigation;
- an assessment of the (potential) impact to the market and clients, and materiality; and
- if the investigation is completed, the outcome of the investigation and the basis of its conclusion.
3. The confidentiality applied to any disclosures made
In the FAQs, the SFC reiterated its statutory obligation under section 378 of the Securities and Futures Ordinance, and confirmed that it will not disclose information obtained under the new obligation to any other persons, including the outgoing employee and his/her prospective employer, unless otherwise permitted by law.
Although the HKMA’s circular is silent on this point, it is likely that the HKMA will take a similar approach to the sharing of information obtained under the obligation. However, given the scope of the obligation and the sensitive nature of the disclosures, a positive statement from the HKMA would be welcomed.
Final Thoughts
The HKMA’s circular has made clear that the HKMA is supportive of the SFC’s intention to ensure that individuals will no longer be permitted to escape regulatory scrutiny by simply resigning during the course of an investigation.
However, the Internal Investigation Disclosure Obligation is a significant enhancement of the prior notification requirements. We anticipate that firms will face a number of key issues in complying with this requirement, including navigating potential litigation risk from former employees, and considering what constitutes an “investigative action”.
William Hallatt
Asia Head of Financial Services Regulatory, Hong Kong
+852 2101 4036
Hannah Cassidy
Partner, Hong Kong
+852 2101 4133
Natalie Curtis
Partner, Singapore
+65 6868 9805
Tess Lumsdaine
Registered Foreign Lawyer (New South Wales, Australia), Hong Kong
+852 2101 4122
Isabelle Lamberton
Registered Foreign Lawyer (New South Wales, Australia), Hong Kong
+852 2101 4218
Client facilitation – Key standards of conduct and internal controls identified and reiterated by Hong Kong SFC
Authors: William Hallatt, Hannah Cassidy and Jennifer Fong
On 14 May 2019, the Securities and Futures Commission (SFC) issued further guidance identifying and reiterating the key standards of conduct and internal controls relating to client facilitation expected of licensed corporations (LCs).
By way of background, conflicts of interest may arise in a facilitation transaction where LCs assume a risk-taking principal position against clients as opposed to acting as an agent. Such conflicts of interest have long been identified by the SFC as a recurring regulatory concern, which they take very seriously.
- Guidance issued to date on client facilitation
- Recent inspection findings
- Expected standards of conduct and internal controls – the key ones
- Way forward
Guidance issued to date on client facilitation
Back in 2014, the SFC organised a supervisory briefing session so as to draw the industry’s attention to common deficiencies and vulnerabilities associated with the provision of client facilitation services identified during its routine inspections.
Two years on, the SFC commenced a thematic review in 2016, which assessed the effectiveness and adequacy of management supervision and controls concerning client facilitation.
In 2018, the SFC published detailed observations from its thematic review, and set out guidance on the standards of conduct and internal controls expected of LCs providing client facilitation services. Four main areas of expected standards of conduct and internal controls relating to client facilitation were identified:
- controls, monitoring and management supervision;
- segregation of agency and facilitation activities;
- consent and disclosure; and
- indications of interests (IOIs).
Most recently, on 14 May 2019, the SFC issued a circular to LCs to:
- outline its inspection findings relating to client facilitation in recent years; and
- remind LCs of the expected standards of conduct and internal controls in respect of providing client facilitation services.
Since mid-2018, the SFC has reviewed the level of compliance with expected standards during the course of its inspections of selected brokers. In particular, the SFC found that certain traders:
- misrepresented a house or client facilitation trade as an agency trade;
- were silent or not transparent about whether facilitation would be involved in a trade; or
- failed to obtain express consent from clients prior to effecting client facilitation trades;
The SFC also discovered that:
- some IOIs were described as natural although they were not based on a genuine client intent to trade; and
- some firms’ policies and procedures were not clear and failed to ensure compliance with the expected standards.
Expected standards of conduct and internal controls – the key ones
The SFC identified in its 14 May 2019 circular the standards of conduct and internal controls relating to client facilitation expected of LCs it considered were key, all of which were covered in the 2018 observations and are not new:
- controls, monitoring and management supervision: establishing policies and procedures which cover key client facilitation controls such as client consent and accuracy of IOIs;
- segregation of agency and facilitation activities: recording and monitoring on a timely basis communications between agency traders and client facilitation traders;
- consent and disclosure: disclosing to clients the nature of trades and obtaining clients’ prior explicit consent to each client facilitation trade to ensure that they are fully informed of the inherent conflicts of interest; and
- IOIs: disseminating IOIs with accuracy and sufficient details only in cases of a genuine client or proprietary intent to trade.
Ensuring compliance with the SFC’s expected standards in relation to client facilitation, especially the key ones identified in the 14 May 2019 circular, is of utmost importance as it helps to protect clients who rely on LCs to act in their best interests and to maintain market integrity and confidence.
In doing so, licensed individuals should, when dealing with clients, always act honestly and fairly, disclose conflicts of interests and take all reasonable steps to ensure fair treatment of clients if such conflicts cannot be avoided.
In light of the SFC’s close scrutiny of non-compliance on the part of LCs and the increasing enforcement focus on individuals (including Managers-in-Charge), LCs are advised to critically review existing policies and procedures for client facilitation and implement all necessary measures to ensure full compliance with the SFC’s expected standards.
William Hallatt
Head of Financial Services Regulatory, Asia Hong Kong
+852 2101 4036
Hannah Cassidy
Partner, Hong Kong
+852 2101 4133
Jennifer Fong
Associate, Hong Kong
+852 2101 4244
HKMA takes first step towards regulating the use of big data analytics and artificial intelligence in FinTech
Authors: Hannah Cassidy, Jeremy Birch, Sheena Loi and Peggy Chow
The Hong Kong Monetary Authority (HKMA) has issued a circular to encourage authorised institutions to adopt the “Ethical Accountability Framework” (EAF) for the collection and use of personal data issued by the Office of the Privacy Commissioner for Personal Data (PCPD). A report on the EAF was published by the PCPD in October 2018 (Report), which explored ethical and fair processing of data through (i) fostering a culture of ethical data governance and (ii) addressing the personal data privacy risks brought by emerging information and communication technologies such as big data analytics, artificial intelligence and machine learning.
The EAF is expressly stated to be non-binding guidance, intended as a first step towards a privacy regime better equipped to address modern challenges. However, the HKMA’s circular arguably elevates the legal status of the EAF for authorised institutions. The HKMA is likely to incorporate the EAF into its broader supervision and inspection of authorised institutions. In particular, in construing the principles based elements of the Supervisory Policy Manual as it applies to FinTech, the EAF will undoubtedly have an influence going forward.
- Tension between the value of data-processing technology and public trust
- Data stewardship accountability
- Data stewardship values
- International Direction of Travel
Tension between the value of data-processing technology and public trust
Big data has no inherent value in its raw form. Its value lies in the ability to convert that data into useful information for organisations, which can then generate knowledge or insight relating to clients or the market as a whole through data analytics or artificial intelligence. Ultimately, this insight results in competitive advantage. However, a tension exists between (i) developing data-processing technology to gain a competitive advantage; and (ii) addressing public distrust arising from the data-intensive nature of such technology.
As the Report highlights, the existing regulatory regime in Hong Kong does not adequately address the privacy and data protection risks that arise from advanced data processing. Big data analytics and artificial intelligence in particular pose challenges to the existing notification and consent based privacy legal framework. These challenges are not limited to the legal framework in Hong Kong. The privacy and data protection legislations on an international level are also ill-equipped to anticipate advances in data-intensive technology.
Data stewardship accountability
The PCPD sees the need to provide guidance on how institutions could act ethically in relation to advanced data-processing to foster public trust. It reminds institutions to be effective data stewards, not merely data custodians. Data stewards take into account the interests of all parties and consider whether the outcomes of their advanced data processing are not just legal, but also fair and just.
The PCPD also encourages data stewardship accountability, which calls for institutions to define and translate stewardship values into organisational policies, using an “ethics by design” approach. This approach requires institutions to have data protection in mind at every step and to apply the principles of privacy by default and privacy by design. Privacy by default means that once a product or service has been released to the public, the strictest privacy settings should apply by default. Privacy by design, on the other hand, requires organisations to ensure privacy is built into a system during the entire life cycle of the system. Ultimately, data stewardship should be driven by policies, culture and conduct on an organisational level, instead of technological controls.
Both the privacy by design and the privacy by default principles are mandatory requirements under the EU General Data Protection Regulation (GDPR). The legal development trend is for Asian-based privacy regulators to, whether by means of enacting new laws (e.g. India) or issuing non-mandatory best practice guidance to encourage data users to meet the higher standards under GDPR.
The PCPD encourages institutions to adopt the three “Hong Kong Values”, whilst providing the option to modify each value to better reflect their respective cultures. The three Hong Kong Values listed below are in line with the various Data Protection Principles of the Personal Data (Privacy) Ordinance (Cap. 486):
(i) The “Respectful” value requires institutions to:
- be accountable for conducting advanced data processing activities;
- take into consideration all parties that have interests in the data;
- consider the expectations of individuals that are impacted by the data use;
- make decisions in a reasonable and transparent manner; and
- allow individuals to make inquiries, obtain explanations and appeal decisions in relation to the advanced data processing activities.
(ii) The “Beneficial” value specifies that:
- where advanced data-processing activities have a potential impact on individuals, organisations should define the benefits, identify and assess the level of potential risks;
- where the activities do not have a potential impact on individuals, organisations should identify the risks and assess the materiality of such risks;
- once the organisation has identified all potential risks, it should implement appropriate ways to mitigate such risks.
(iii) The “Fair” value specifies that organisations should:
- avoid actions that are inappropriate, offensive or might constitute unfair treatment or illegal discrimination;
- regularly review and evaluate algorithms and models used in decision-making for any bias and illegal discrimination;
- minimise any data-intensive activities; and
- ensure that the advanced data-processing activities are consistent with the ethical values of the organisation.
The PCPD also encourages institutions to conduct Ethical Data Impact Assessments (EDIAs), allowing them to consider the rights and interests of all parties impacted by the collection, use and disclosure of data. A process oversight model should be in place to ensure the effectiveness of the EDIA. While this oversight could be performed by internal audit, it could also be accomplished by way of an assessment conducted externally.
International Direction of Travel
The approach outlined above is not unique to Hong Kong. In fact, at the time the EAF was announced by the PCPD in October 2018, the 40th International Conference of Data Protection and Privacy Commissioners released a Declaration on Ethics and Protection in Artificial Intelligence (Declaration) which proposes a high level framework for the regulation of artificial intelligence, privacy and data protection. The Declaration endorsed six guiding principles as “core values” to preserve human rights in the development of artificial intelligence and called for common governance principles on artificial intelligence to be established at an international level.
It is clear that there is a global trend toward ethical and fair processing of data in the application of advanced data analytics. For instance, the Monetary Authority of Singapore has formulated similar ethical principles in the use of artificial intelligence and data analytics in the financial sector, announced in November 2018. Another example is the EU’s GDPR’s specific safeguards related to the automated processing of personal data that has, or is likely to have, a significant impact on the data subject, to which the data subject has a right to object. Specifically, a data protection impact assessment assessing the impact of the envisaged processing operations must be carried out before such processing is adopted, if such processing uses new technologies and is likely to result in a high risk to the rights and freedoms of natural persons after taking into account the nature, scope, context and purposes of the processing.
Although this may appear to be a relatively minor development in Hong Kong, we see this as a step in a broader movement toward the regulation of AI and a sea change in the approach to data protection and privacy. The HKMA circular and the EAF are in line with the global data protection law developments, which are largely being led by the EU.
Hannah Cassidy
Partner, Hong Kong
+852 2101 4133
Jeremy Birch
Partner, Hong Kong
+852 2101 4195
Sheena Loi
Senior Consultant, Hong Kong
+852 2101 4146
Peggy Chow
Senior Associate TMT/Data Protection, Singapore
+65 6868 8054