26 May, 2015
Financial institutions and funds doing business in Hong Kong are often subject to stringent statutory secrecy obligations. While statutory secrecy is approached with significant care during regulatory investigations, the scope of the obligations is broader. Financial institutions that are regulated by both the Securities and Futures Commission (SFC) and Hong Kong Monetary Authority (HKMA) also need to be aware of the mismatch in the secrecy obligations applicable to each of these regulators and what their respective expectations are. Even where information is not caught by statutory secrecy, there may still be an expectation that it is treated as if it were.
This bulletin considers and compares the secrecy obligations contained in the Securities and Futures Ordinance (SFO) and Banking Ordinance (BO). It also provides practical guidance on two questions that financial institutions should ask themselves: whether a piece of information is subject to statutory secrecy and, even if it isn't, whether it can be safely disclosed to others.
The wording of Hong Kong's secrecy provisions, particularly those in the SFO, is lengthy and complex. Those already familiar with the statutory provisions who are looking for practical guidance on how to apply them may wish to head straight to the last section of this article.
Statutory Secrecy And The SFC
The secrecy obligations in the SFO are contained in section 378. In summary, this section provides that, except in the performance of a function, carrying into effect, or doing anything required or authorised under the "relevant provisions", a "specified person" must:
(a) preserve and aid in preserving the secrecy of any matter coming into his knowledge by virtue of his (i) being appointed under a relevant provision, (ii) performing a function under a relevant provision, or (iii) in the course of assisting any other person who has been appointed to or is performing a function or carrying into effect any of the relevant provisions;
(b) not communicate any such matter to any other person; and
(c) not permit any other person to have access to any record or document coming into his possession as a result of his being appointed to, performing a function, or assisting a person under a relevant provision.
The "relevant provisions" are defined in Schedule 1 of the SFO as including all of the provisions of the SFO and certain parts of Hong Kong's companies and antimoney laundering legislation. A "specified person" is defined in section 378(15) as not only including the SFC, its staff, agents and advisors, but also any person "assisting" them in carrying out their functions under a relevant provision.
It is a criminal offence to breach the SFO's secrecy obligations, the maximum penalty for which is a fine of HKD 1m and imprisonment for up to 2 years.
The SFC takes the obligations imposed by section 378 seriously. It considers statutory secrecy to be necessary to protect the integrity of the market, the integrity of its investigations, and also to ensure that those under investigation have the benefit of the presumption of innocence. The SFC has issued guidance that outlines its view of how the section applies.1 However, other than the SFC's own interpretation of section 378 as set out in its guidance note, there has been very little case law to clarify the scope of the provision.2
The obligations in section 378 clearly apply to the SFC, its staff, and other persons appointed or authorised to carry out tasks under the SFO. Importantly for financial intermediaries, their employees, and potentially anyone else who comes in to contact with the SFC, the concept of providing assistance extends the scope of the secrecy obligation much further. Anyone providing information to the SFC under one of its formal statutory powers, such as sections 180, 181 or 183 of the SFO, even though they are being compelled under force of law, is viewed as "assisting" the SFC and will therefore ordinarily be subject to the secrecy obligation. Accordingly, they cannot disclose any information obtained through assisting the SFC to any other person unless it falls in one of the exceptions to the provision.
The SFC's guidance note also suggests that the secrecy obligation could also apply to more informal approaches and requests for information. This is because the guidance note describes the fact that the SFC has a regulatory interest in information, including through an "informal request", as being information that is able to be disclosed by the SFC in performance of its duties. The ability to disclose such information would not be of concern if the underlying information was not secret. If the fact an informal request has been made is secret, the person assisting the SFC by responding to that request would also be bound by the secrecy obligation (albeit without the benefit of the express warning regarding statutory secrecy obligations that is contained in formal investigation notices).
There are a number of exceptions to the secrecy obligations in the SFO contained in section 378 which are relevant to persons assisting the SFC. Secrecy does not apply to information which is already available to the public, information which is disclosed in connection with judicial proceedings to which a person is a party or where the disclosure is required under a court order or other law (e.g. discovery in civil proceedings). The section also makes clear that a person can disclose the information to a barrister, solicitor, or other professional advisor acting in connection with the matter. Finally, section 378(7) also provides that the secrecy obligations do not apply where the SFC has given its consent in writing to the disclosure of the matter. The SFC has stated in its guidance note that "deemed consent" can be assumed in a limited number of circumstances, including disclosing that the person is subject to a secrecy obligation and how they became bound by it (e.g. receiving a notice to provide information), and if only the general nature of a matter, without revealing anything specific about it, is disclosed.
Statutory Secrecy And The HKMA
The BO also contains a statutory secrecy provision, which can be found in section 120. This section provides that, except as may be necessary for the exercise of a function under the BO or for carrying into effect its provisions, every person to whom the secrecy obligation applies shall (i) preserve and aid in preserving secrecy with regard to all matters relating to the affairs of any person that may come to his knowledge in the exercise of any function under the BO, (ii) not communicate any such matter to any person other than the person to whom such matter relates and (iii) not allow any other person to have access to any records to which the secrecy obligation applies.
In contrast to the SFC, the HKMA has not issued any public guidance on section 120 and nor is there any case law which has sought to determine its scope. Notwithstanding this, an argument can be made that the secrecy provisions contained in the BO are only binding on the HKMA, its employees and agents, and not those it regulates or who are otherwise responding to its enquiries. This is because the persons to whom the provision applies, which are listed in section 120(2), are nearly all expressly directed at the HKMA and its officers. While the list also includes "a person authorised by" the HKMA and "a person assisting" someone to whom section 120(2) applies, these are very unlikely to apply to banks or those assisting the HKMA in the performance of its regulatory functions. The wording "a person authorised by" appears to be directed at those persons authorised by the HKMA to carry out a specific regulatory power or function under the BO, and is therefore distinguishable from an "authorised institution", which is the term used to refer to those regulated by the HKMA elsewhere in the legislation. The reference to a "person assisting" is also framed more narrowly than the comparable wording in the SFO, with section 120(2) requiring the person assisting to also be one who "exercises or has exercised" a function under the BO. It is difficult to see what function a person responding to any enquiry under the BO would be "exercising." Finally, there is no provision enabling the HKMA to give consent to onward disclosure as the SFC has under section 378(7) of the SFO, which suggests it would not apply to authorised institutions or others assisting the HKMA.
Notwithstanding the more limited scope of the secrecy obligations in the BO, the HKMA may still have an expectation that certain information it provides to authorised institutions be held in strict confidence and not disclosed to any third parties. This is likely to include any information related to thematic inspections or reviews being carried out by the HKMA across several banks where they are still on-going.
It is also important to note that in some instances the HKMA has the ability to exercise powers under the SFO, including the ability to commence inspections under section 180. Where the HKMA is exercising a power under the SFO, the secrecy obligations contained in section 378 will apply, and consequently any financial institution or individual "assisting" the HKMA will be bound by them.
Secrecy And Safety – Applying The Provisions In The Real World
There are a number of steps financial institutions and funds can take to ensure that they do not breach section 378 of the SFO.
Staff should be made aware of the secrecy obligations, and particularly their impact on investigations or inspections being carried out under the SFO. If the firm receives a statutory notice, information about the matter should not be disclosed to employees, affiliated companies or business partners without the SFC's consent. This can impact on the ability to follow normal corporate reporting lines, particularly where other (non-holding) group companies or joint venture partners are involved.
Staff should also be made aware that, if they receive an SFC notice, they should not disclose any details about the matter unless they fall within the limited deemed consent provisions under the guidance note – namely to let their employer and/or spouse know that they are subject to a statutory secrecy obligation and are required to attend an interview with the SFC. The risk of staff inadvertently breaching section 378 is higher if they are not aware of their secrecy obligations before they receive a notice from the SFC. Staff should also be reminded that anyone who receives an SFC notice has the right to seek legal advice, and they should never be encouraged to attend an interview without legal counsel being present. Financial intermediaries may wish to make available to staff a list of pre-approved law firms that they can turn to for independent advice if they receive a statutory notice.
Particular care should also be taken in the M&A context, where potential purchasers of a business will often want information on the regulatory issues it has encountered. Disclosing non-public information about current or past SFC investigations, without first obtaining the SFC's consent, would be in breach of section 378.
If there is any doubt as to whether an item of information is subject to the statutory secrecy obligations in the SFO, seek legal advice. In cases where doubt still remains, the safest course may be to raise the matter with the SFC and seek its consent for onward disclosure. The SFC has well-established guidelines for seeking and granting consent which are set out in its guidance note and it is often able to respond to those requests in a timely manner.
As discussed above, information obtained from the HKMA when exercising its powers under the BO is not likely to be subject to any legal secrecy requirements. However, the HKMA may still have a desire to keep information it provides strictly confidential, particularly if it relates to its on-going enforcement activities and which could be of interest to other authorised institutions that it regulates, or information relating to its overall assessment of a bank (e.g. its CAMEL rating). While disclosing such information to a third party might not be in breach of section 120, doing so may still place significant strain on an authorised institution's relationship with the HKMA. If there is a need to disclose this type of information to any third party, it may be advisable to raise the issue with the HKMA before disclosing it to ask whether it has any concerns about the proposed disclosure and, if so, what its preferred approach is.
End Notes:
1 The SFC's guidance note can be found at
http://www.sfc.hk/web/EN/regulatory-functions/enforcement/secrecyprovision.html
2 The SFC's first conviction for breaching section 378 was obtained in 2006. The defendant, Choi Chi Ming, was a licensed person and pleaded guilty after it had been identified that he had disclosed details of interviews with the SFC to two co-workers.
For further information, please contact:
Ben Hammond, Partner, Ashurst
ben.hammond@ashurst.com
Gareth Hughes, Partner, Ashurst
gareth.hughes@ashurst.com
Angus Ross, Partner, Ashurst
angus.ross@ashurst.com
James Comber, Ashurst
james.comber@ashurst.com
