Hong Kong – The Year Of The Pig In Review: Key Developments In Hong Kong Financial Services Regulatory Enforcement.

Self-control through internal controls

The need for robust internal controls to prevent and detect misconduct of employees was also highlighted in the Year of the Pig.

In November 2019, the SFC levied its largest fine of the year when it reprimanded and fined one bank HK$400 million. The SFC found that the bank had overcharged clients over a ten year period when conducting bond and structured note trades by increasing the spread on trades after they had been completed, without the clients being made aware. The bank also failed to make adequate and accurate disclosure of fees that were charged. In addition to the fine, the bank also made good clients for approximately HK$200 million of overcharged fees.

In imposing this fine, the SFC was clearly concerned by the bank's failure to avoid conflicts of interest and to act fairly and in the best interests of its clients. An aggravating factor in the eyes of the SFC appears to have been that internal control failings occurred which allowed the conduct of the bank's employees to go un-checked for a decade. The internal control weaknesses identified by the SFC included inadequate policies and procedures, inadequate system controls to prevent manipulation of fees or identify errors, lack of supervision and staff training, and failures of the first and second lines of defence. In a similar light, the SFC also was critical of the bank's failure to self-report the breaches for a period of two years after they had first been identified.

Two brokerages were also fined for similar internal control failings in the Year of the Pig. In one case the brokerage's CEO, who was also a responsible officer, placed 199 illegal short sale orders through his own and a client's discretionary trading account. Notwithstanding that the stock exchange had made enquiries in respect of some of the suspicious trading, the CEO was able to continue his illegal short-selling activities unchecked for a period of time. In imposing a fine of HK$6.3 million, the SFC was critical of the firm's failure to put in place adequate systems and controls to detect illegal short selling by employees and implement effective controls to monitor cross-trades between its employees and clients. 

In the second case, a brokerage was fined HK$5 million for a variety of internal control failures. This investigation was triggered by a client complaint, alleging that a former account executive had conducted unauthorised trades in the customer's account. The SFC required the appointment of an independent reviewer, which identified 14 areas of the business with deficient internal controls, including compliance surveillance, staff dealing and escalation policies and handling of client funds and securities. 

Each of these cases highlight the importance of licensed intermediaries having in place robust policies and procedures to prevent and detect misconduct. Any issues identified must be appropriately escalated and red-flag activities followed up. A firm's failure to detect employee misconduct is treated as a separate regulatory breach on top of an employee's own misconduct.

Money laundering: the need to keep things squeaky clean

Regulatory breaches related to anti-money laundering and counter-terrorist financing (AML/CTF) also featured in the Year of the Pig, with the SFC having a strong focus on maintaining Hong Kong's reputation as a world-class financial centre.

In February 2019, a brokerage was reprimanded and fined HK$15.2 million for failing to comply with AML/CTF requirements when handling third party fund deposits. The SFC found that the firm had processed around 10,000 third-party deposits, totalling approximately HK$5 billion, for more than 3,500 clients which did not comply with AML/CTF regulatory requirements. The issues identified by the SFC included that deposits were made into accounts where there was no apparent relationship between the client and third party, clients receiving third-party deposits that were not commensurate with the client's financial profiles and third-party deposits being withdrawn by clients shortly after receiving the funds. The SFC found that these breaches should have been avoided and that the firm did not have in place appropriate policies and procedures with respect to third-party deposits into client accounts, or to escalate issues with third-party deposits once they had been identified and to discharge suspicious transaction reporting obligations.

In addition to the fine imposed, the head of retail brokerage at the firm, who was one of its responsible officers, was also sanctioned in a separate enforcement outcome reached in April 2019. The SFC found that the firm's breaches were attributable to the individual's failure to discharge his duties as a responsible officer and banned him from the industry for ten months. As with the individuals sanctioned for failings as sponsor principals, this aspect of the SFC's enforcement action demonstrates clearly that it will not hesitate to proceed against senior individuals in appropriate cases.

Getting research right

The SFC has focused on research reports and the need to appropriately manage conflicts of interest for some time now. The Year of the Pig was no exception, with three key enforcement outcomes being published.

The largest research-related sanction was imposed early in January 2020 when a brokerage firm was fined HK$6.4 million. An SFC inspection of the firm identified that while it had policies in place to manage conflicts of interest for research reports and investment banking relationships, in practice those policies had not been enforced. This included the firm publishing two research reports for a company that was on its "research restricted list" in circumstances where both the analyst and former head of research had never been made aware of the firm's policy on research restrictions. The SFC also found that the research report disclosures made by the firm were inadequate, only referring to the possibility of having received investment banking income from a company covered in the research report and omitting to mention that a sponsorship agreement had been entered into.

In June, the SFC had another victory in respect of research reports when its decision to reprimand and fine another firm HK$3.5 million was upheld by the Securities and Futures Appeals Tribunal (SFAT). Two individuals responsible for overseeing the research reports were also suspended for nine months. The firm had published three research reports in the name of one of its own analysts when in fact they had been authored by two unknown individuals who were not employees. It was not known whether the authors were related to or had a financial interest in the companies covered, and the firm was unable to demonstrate that there was any reasonable basis for the analysis or recommendations contained in the reports. The disclosures made for one company covered through the research also incorrectly stated that the firm had not provided any investment services to the company when it had in fact done so. The SFC further found that the firm had in place inadequate policies and procedures and failed to address conflicts of interest, with staff involved in providing investment services also being involved in the preparation of research. While the SFC's findings were not disputed by the firm, it contended before the SFAT that the sanctions imposed were manifestly excessive. The SFAT rejected that argument, holding that as the breaches were multiple and persistent, the SFC was entitled to impose a punitive sanction to act as a deterrent.

Finally, and at the other end of the scale of seriousness, a bank was reprimanded and fined HK$2.8 million for failing to ensure its disclosures for research reports were in full compliance with regulatory obligations. Two separate issues gave rise to the breaches, both of which were identified and self-reported to the SFC by the bank. The first issue arose as a result of an IT issue which meant that not all investment banking relationships were disclosed for companies that had multiple products or securities covered by the bank's research team. That issue had been ongoing for 10 years before it was identified and remediated. The second issue, which applied for a much shorter period of time, resulted in the bank omitting a disclaimer that it acted as a market maker for certain securities covered in its research. While the number of research reports potentially impacted was in the thousands, the unintentional nature of the breaches, self-reporting and extensive remediation carried out by the bank to ensure similar issues did not arise in future were viewed by the SFC as mitigating factors.

Firms involved in publishing research materials in Hong Kong should be aware of the SFC's focus on potential conflicts of interest and its willingness to take enforcement action in appropriate cases. Firms publishing research should have in place strong policies and procedures to ensure that conflicts of interest are appropriately managed and all regulatory requirements complied with. While one might question whether consumers of research pay close attention to disclosures of interest sections of reports, the SFC may still take action when strict compliance with all of the disclosure requirements has not been achieved. 

Client money – handle with care

Two enforcement actions brought by the SFC in the Year of the Pig have also underscored the importance of handling client money in strict accordance with the Securities and Futures (Client Money) Rules.
 
The first action, in May 2019, was taken against a brokerage firm that was reprimanded and fined HK$5 million for failing to segregate client money in accordance with the Client Money Rules. An internal review conducted by the firm identified that there were over 800 instances of non-compliance over a three year period. This involved the transfer of funds from client trust accounts for a range of other purposes, including repayment of the brokerage firm's loans and to make margin loans to clients. The SFC concluded that these were breaches notwithstanding that the transfers were intra-day only (i.e. the funds were returned to the client trust accounts within the same day). In publicising the enforcement outcome, the SFC made clear that safe custody of client assets is a fundamental obligation of licensed corporations and that any breaches of this nature "cannot be tolerated".
 
In July 2019 the SFC also reprimanded and fined another brokerage group HK$6.3 million for mishandling client money. The SFC investigation found that for operational convenience the firm had used client accounts to pay its account executives, an arrangement that had likely been in place for more than 20 years. The firm had also conducted intra-day fund swaps between two group companies so that they could meet various margin calls on time. The SFC considered that there was an absence of internal controls and supervision within the firm, with staff essentially given little guidance and free reign over client money.
 
Both these cases demonstrate that the SFC will adopt a zero tolerance approach to breaches of the Client Money Rules, even where clients have not suffered any loss. Intermediaries subject to the Client Money Rules should pay close attention to these decisions, and particularly the SFC's conclusion that restoring client accounts in full by the end of the day (i.e. intra-day transfers out and in) are still in breach. Care should also be taken to ensure that back office accounting and finance staff, who it appears often approve these type of arrangements, are aware of the Client Money Rules and subject to compliance oversight when handling client funds.