25 March, 2020
In view of the recent novel coronavirus (2019-nCoV) outbreak in Asia (including Hong Kong), financial regulators and financial institutions have continued to be pro-active in monitoring the evolving situation and the implications on the market. It is important for financial institutions to have in place relevant measures to ensure continuity and sustainability.
Since the outbreak of Severe Acute Respiratory Syndrome (SARS) in Hong Kong back in 2003, financial institutions in Hong Kong have been cautious in reinforcing their preventive measures, contingency procedures, and recovery equipment and facilities to ensure they are effective in handling an outbreak of communicable disease.
At the time of SARS, the regulators in Hong Kong including the Hong Kong Monetary Authority (HKMA) and the Securities and Futures Commission (SFC) issued various guidance and recommendations. In the recent 2019- nCoV situation, the HKMA and the SFC have issued further guidance. We will discuss below the regulatory expectations, the risk areas financial institutions should watch out for and the steps to take.
Regulatory Standards and Best Practice
The "best practices" suggested by both the HKMA and SFC in the event of an outbreak of a serious communicable disease are broadly similar and we summarise the recommendations as follows:1
1. Activation of Business Continuity Plan (BCP)
-
Determine the bare minimum services that should continue to be provided to customers in a worst-case scenario
-
Make relevant staff arrangements such as work from home,and for each critical operation area, identify a small team of skeleton staff and send them to work in an alternative location
-
Make alternative internal plans to ensure continuity of services such as making arrangements with head office and other overseas offices to cover certain activities (e.g. dealing room activities) in case of need
-
Check with critical suppliers and major outside service providers to ensure their capability to continue to provide services in contingency situations
2 – Information technology, capability and cybersecurity
- Encourage customers and staff to use telephone or online facilities
-
Ensure mobile computing equipment and computer networks including any telephone recording systems can support "work from home" and "split operations" for a prolonged period
-
Review system capacity to cater for the potential upsurge in transaction volume via electronic channels
-
Ensure adequate back-up facilities, mobile computing/communication devices and network bandwidth
-
Ensure that the additional cyber-security risks (e.g., scams, phishing and ransomware attacks) are properly managed
3 – Work environment, monitoring and reporting of infection cases
-
Maintain a high level of environmental hygiene and ensure adequacy of face masks, hand gloves, disinfectant, etc., and consider retaining medical practitioners to provide advice on latest developments
-
Establish a clear command, control and communication structure (including a command centre for information sharing, corporate decision making and revising arrangements) to effectively monitor the latest developments of the pandemic and manage any possible incidents
-
Track any abnormal sickness and suspected infection of staff
-
Report all confirmed or suspected cases of infection to the internal command centre, which should decide on the actions to be taken (e.g. release of staff members who sit close to, or have frequent contact with the infected staff)
-
Notify the regulator(s) promptly if there is any confirmed or suspected case, and ensure continued communications with them on the developments
4. Communications with customers and counter-parties
- Clearly communicate with customers and counter-parties on any limitation or interruption on the service offerings and also the alternative arrangements that are made available to them
Latest SFC guidance
On 5 February 2020,2 the SFC reminded the market that licensed corporations, applicants and other market participants are generally expected to make all reasonable efforts to maintain “business as usual” in respect of regulatory obligations, including the meeting of deadlines. These market players should promptly communicate with the SFC if they encounter specific difficulties arising from the coronavirus situation.
Latest HKMA guidance
On 6 February 2020, the HKMA issued a letter on the temporary relief measures that authorised institutions (AIs) are encouraged to implement to mitigate the financial impact of the coronavirus outbreak on the AIs’ customers.3 In particular, the HKMA welcomes initiatives such as principal moratorium for mortgages, fees reduction for credit card borrowing and restructuring of repayment schedules for corporate loans.
The HKMA has advised the banking industry to take a proactive approach and adopt a sympathetic stance in dealing with customers facing financial stress due to the coronavirus situation. AI's should, to the extent permitted by prudent risk management principles, consider requests for temporary relief arrangements favourably and ensure its staff are aware of such policies.
Actions to Consider
As the situation develops and the impact of the outbreak remains evolving, financial institutions are advised to ensure compliance by:
-
assessing how the business could be disrupted by coronavirus and activate BCP;
-
evaluating staff arrangements and the working environment and consider / implement temporary closures of office, work from home, and/or other alternative arrangements;
-
evaluating operations and resources arrangement and consider the need to obtain support from head office or other offices;
-
evaluating technology needs and ability to support increased demand and address potential cybersecurity risks;
-
evaluating existing contracts and arrangements with customers, suppliers and service providers, consider / implement alternative arrangements to ensure continuity and where appropriate consider force majeure provisions to suspend / terminate relationships and have a back-up plan;
-
continuing to communicate with customers and counter-parties on the developments; and
-
assessing any practical difficulties in complying with regulatory deadlines (e.g., filing deadlines) and continue to communicate with the regulators.
Financial institutions are also reminded of the importance of keeping abreast with the latest developments and monitoring any further guidance that may be issued by the SFC, the HKMA or other relevant home or regional regulators. Failure to do so has the potential to create not only regulatory gap risk but also client derived complaints and litigation.
For further information, please contact:
Karen H.Y. Man, Partner, Baker & McKenzie
karen.man@bakermckenzie.com
- https://www.sfc.hk/edistributionWeb/gateway/EN/circular/intermediaries/licensing/openFile?ref No=H289; https://www.sfc.hk/edistributionWeb/gateway/EN/news-and- announcements/news/doc?refNo=03PR86 ; https://www.hkma.gov.hk/eng/regulatory-resources/regulatory- guides/circulars/2003/04/circu_20030402-1; https://www.hkma.gov.hk/eng/regulatory-resources/regulatory- guides/circulars/2003/10/circu_20031008-1/
- https://www.sfc.hk/edistributionWeb/gateway/EN/news-and- announcements/news/doc?refNo=20PR10
-
https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and- circular/2020/20200206e1.pdf