19 October, 2017
Yesterday, the Hong Kong Monetary Authority (HKMA) introduced by way of a circular new measures to heighten management accountability at Registered Institutions (RIs) for conducting or supervising the conduct of businesses that constitute regulated activities (RAs). These measures are detailed in a set of FAQs accompanying the circular.
This clarification is not unexpected given questions raised around how the Securities and Futures Commission’s (SFC) Manager in Charge (MIC) regime would be harmonised with the regime administered by the HKMA under section 72B of the Banking Ordinance (BO) (please see our briefing on the MIC regime here). However, the new guidance will require RIs to consider their existing governance frameworks and amend where appropriate to ensure full compliance with the HKMA’s expectations.
Breakfast Seminar
We will be holding a breakfast seminar on Thursday 26 October 2017 from 8.30am to 9.30am to discuss the HKMA’s guidance in more detail and its implications for firms. Further details will be circulated. In the meantime, we consider the issues raised by the circular and FAQs in more detail below.
Key Elements of the New Circular and FAQs
Timetable
16 March 2018 – RIs may commence submitting to the HKMA and the SFC relevant information on individuals who are principally responsible for businesses conducting RAs, together with an organisation chart depicting the RI’s management and governance structure (Required Information).
16 April 2018 – Existing RIs are expected to submit the Required Information to the HKMA and the SFC on or before this date. Authorised institutions (AIs) applying for registration as an RI or for addition of RAs on or after this date should submit the Required Information to the HKMA in support of their applications.
Given the tight timeline, RIs should begin reviewing their organisational structure and identifying who is principally responsible for each business conducting RAs, and making any necessary changes to comply with this new guidance.
Meaning of “management”
The circular clarifies who should be regarded as “management” of an RI and requires the RIs to identify and inform the HKMA and the SFC the individual managers who are principally responsible for businesses that constitute RAs.
The term “management” for the purposes of the new guidance includes chief executives (CEs) and alternate chief executives (ACEs), directors approved under section 71 of the BO, managers notified to the HKMA under section 72B of the BO (section 72B managers) and any other person who is involved in the management of any business that constitutes an RA for which the RI is registered. The HKMA does not regard non-executive directors and independent non-executive directors (INEDs) as “management” for the purposes of the guidance, on the basis that these individuals are not usually involved in the day to day management of RAs or other businesses.
The Regulated Activities
The HKMA has clarified that an RI must identify each individual who is principally responsible, either alone or with others, for (i) the overall management of the whole business of the RI (generally the CE); and (ii) for managing each of the businesses and functions listed in paragraphs 2 to 8 of the Fourteenth Schedule to the BO. The functions listed in the Fourteenth Schedule include:
- Retail banking, private banking, corporate banking, international banking, institutional banking, treasury or any other business which is material to the institution (equivalent to the Key Business Line Core Function under the SFC’s MIC regime);
- Maintenance of accounts or accounting systems of the institution (equivalent to the Finance and Accounting Core Function under the SFC’s MIC regime);
- Maintenance of systems of control of an institution, including those systems intended to manage the risks of the institution (equivalent to the Risk Management Core Function under the SFC’s MIC regime);
- Maintenance of systems of control of an institution to protect it against involvement in Anti-Money Laundering (equivalent to the Anti-Money Laundering and Counter-Terrorist Financing Core Function under the SFC’s MIC regime);
- Development, operation and maintenance of computer systems for the institution (equivalent to the Information Technology Core Function under the SFC’s MIC regime);
- Conduct of internal audits or inspections of the institution's affairs or business (equivalent to the Operational Control and Review Core Function under the SFC’s MIC regime); and
- Ensuring that the institution complies with laws, regulations or guidelines that are applicable to it (equivalent to the Compliance Core Function under the SFC’s MIC regime).
Importantly, an RI only needs to identify individuals as principally responsible for a particular business if that business constitutes an RA.
In exceptional cases where any RA conducted by an RI does not fall under the business areas managed by section 72B managers appointed for the areas listed in point 1 above, the business of such RA should be regarded as material to the RI and therefore covered by at least one section 72B manager.
In relation to mid/back office functions, if more than one individual are jointly responsible for a compliance function, for example, and one of them principally covers matters relating to RA business while the others cover those relating to non-RA business, the former (but not the latter) should be identified as principally responsible for the compliance function in relation to RAs. However, if the responsibilities of an individual overseeing such a function cover both RA and non-RA businesses, he/she should be captured for the purpose of the HKMA’s guidance.
Identification of those who are “principally responsible”
RIs must identify at least one individual as principally responsible for each of:
1. the overall management of the whole business of the RI (generally the CE); and
2. the businesses or functions listed above, to the extent that these individuals are involved in the management of the business constituting any RA for which the RI is registered.
An RI may appoint more than one individual for a particular function if more than one individual is jointly principally responsible for that business or function. An individual may also be identified as principally responsible for more than one business or function. This might be appropriate, for instance, where the RI regards an individual business as relatively small-scale within its overall business, making it acceptable to group more than one business/function under one individual.
If there is more than one individual jointly responsible for a particular function and one principally covers matters relating to RA business and the other covers matters relating to non-RA business, then only the former should be identified as principally responsible for that function.
In terms of seniority, these individuals are expected to be: (i) CEs, including ACEs; (ii) directors approved under section 71 of the BO; or (iii) section 72B managers.
Individuals identified as principally responsible for a business or function do not necessarily need to be employees of the RI. They could, for instance, be employees of the parent bank or group company. However, they cannot be external parties merely providing outsourced services. Where a function is outsourced, management of the RI should retain the ultimate accountability of that outsourced function.
RIs should ensure that each individual identified as principally responsible for a business or function has acknowledged his or her responsibility for the particular business(es) or function(s) for which he or she is identified.
Relationship between executive officers (EOs) and those identified as principally responsible for a business or function
It is already a requirement that any CEs, ACEs or directors who are directly responsible for supervising the conduct of RAs should be appointed as EOs in respect of the RA(s) they oversee and the HKMA may require individuals to become EOs if appropriate.
However, the HKMA does not require all CEs, ACEs, directors or section 72B managers to be approved as EOs, to the extent that they are not directly responsible for supervising the conduct of the RAs they oversee. Although the HKMA does expect at least one of the EOs for a given RA to be a CE, ACE, director or section 72B manager.
In order to ensure that EOs have sufficient authority to conduct or oversee the relevant RA, EOs not falling within the above roles must be not more than one rank below the CE, ACE, director or section 72B manager, as the case may be.
The HKMA may allow some flexibility to the above rule in exceptional cases, where this can be justified taking into account the size of the RI, the significance of the RA in relation to the overall business of the RI, the management structure and the reporting lines of the EOs.
Standards of conduct expected and individual liability
The HKMA expects persons identified as principally responsible for a business or function to be CEs, ACEs, directors appointed under section 71 of the BO or section 72B managers. As such, the fit and proper requirement is already covered by sections 71 and 72B of the BO and relevant Supervisory Policy Manual (SPM) modules.
A person involved in the management of the business constituting any RA for which an RI is registered is a “regulated person”, and therefore already subject to the disciplinary powers under the Securities and Futures Ordinance (SFO).
Information to be submitted to the regulators
RIs must provide to the HKMA and the SFC:
- Relevant information on individual CEs, ACEs, directors and section 72B managers principally responsible for RA business and functions, using the forms provided in the Appendix to the circular; and
- An organisation chart depicting the RI’s management and governance structure relevant to its RA business, showing the individuals identified as being principally responsible for a business or function, as well as their respective reporting lines and the job titles of the persons reporting directly to them.
Submissions should be made by email to the HKMA at RI_management_info@hkma.iclnet.hk and to the SFC at mpra@sfc.iclnet.hk.
An RI should also notify the HKMA and SFC of any subsequent changes in the person(s) appointed as principally responsible for any business or function (including new appointment and cessation) within fourteen days of the change. Except where a change involves only a change in the person’s personal particulars, the RI should also submit an updated organisation chart in its notification of that change.
It is not necessary to notify the HKMA and SFC if an individual becomes principally responsible for a business or function on a temporary basis, unless the appointment is expected to last for more than a few months or is expected to be permanent. If a temporary appointment becomes permanent, the HKMA and the SFC should be notified of the change within fourteen days.
SFC MIC Regime
Today, the SFC announced the full implementation of the MIC regime following a six-month transition period which ended yesterday.
During the transition period, about 10,000 individuals were appointed by licensed corporations as MICs responsible for managing the Core Functions. Around 40% of these individuals are not licensed persons and they are primarily responsible for managing operations or control functions. The SFC also confirmed that it is handling responsible officer applications from about 500 MICs of the Overall Management Oversight and Key Business Line Core Functions.
The SFC has also updated the relevant FAQs to confirm that the MIC regime announced in December 2016 is only applicable to licensed corporations and, in relation to the RIs, the SFC cross-refers to the HKMA's circular published yesterday.
Concluding Remarks
The changes announced by the HKMA are largely consistent with the MIC regime (although there are some divergences around mapping and notification requirements). Of course the HKMA guidance introduces new complexities where an RI conducts a mixture of RA and non-RA business. Our experience and knowledge of the challenges experienced by licensed corporations in the lead-up to the MIC deadline means we can provide practical assistance to RIs as they prepare to implement these changes.
For instance, although the circular allows flexibility in management structure, the flexibility also means uncertainty in applying the regime in practice. Global organisations will have to think carefully when identifying individuals to ensure that they possess the relevant seniority and authority. The HKMA has said it expects appointed individuals to be CEs, ACEs, directors or section 72B managers.
The guidance also needs to be considered in parallel with a number of recent circulars issued by the HKMA around corporate governance, in particular:
- circular providing further guidance on the empowerment of INEDs in the banking industry in Hong Kong dated 14 December 2016 (please see our briefing on this topic here);
- circular providing guidance to AIs on developing and promoting a sound corporate culture dated 2 March 2017;
- circular announcing the publication of two revised SPM modules, namely CG-1 “Corporate Governance of Locally Incorporated AIs” and IC-1 “Risk Management Framework” dated 6 October 2017 (please see our briefing on this topic here); and
- circular launching a new On-boarding Programme for INEDs of locally incorporated AIs dated 11 October 2017.
Finally, it is important to remember that all persons involved in the management of a business constituting an RA for which an RI is registered (including those identified as being principally responsible for a business or function) are “regulated persons”, and are therefore subject to the disciplinary powers under the SFO. RIs will therefore want to ensure that individuals’ regulatory responsibilities are clearly understood, both by them and their firms. This is particularly relevant in the context of an enforcement agenda in Hong Kong that is focused on senior management responsibility and accountability.
For further information, please contact:
William Hallatt, Partner, Herbert Smith Freehills
William.Hallatt@hsf.com
