Regulation and Supervision of Trust Business

Supervisory Policy Manual
This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Purpose To describe the HKMA’s approach to regulating and supervising trust business and related activities of AIs Classification A statutory guideline issued by the MA under the Banking Ordinance, §7(3) Previous guidelines superseded This is a new guideline. Application To all AIs Structure

1. Introduction
   1.1 Terminology
   1.2 Background
   1.3 Application
   1.4 Exemptions
2. Conduct requirements
   2.1 General
   2.2 Appointment of managers and responsible officers
   2.3 Non-compliance
3. Introduction or referral services

Supervisory Policy Manual
4. Supervisory approach
4.1 General
4.2 Guidelines and supervisory standards
4.3 On-site examinations
4.4 Off-site reviews
5. Notification and reporting requirements
6. List of trustees
Annex: Code of Practice for Trust Business
—————————

1. Introduction
   1.1 Terminology
   1.1.1 In this module:
    “trust” means an obligation imposed on a person to hold or control and administer assets for the benefit of others (i.e. the beneficiaries) or for a specified purpose (e.g. charitable purpose, wills or estate planning); and  “trust business” means provision of one or more of the following services, by way of business:
   (i) setting up a trust;
   (ii) acting as a trustee (or a party by whatever name called performing the functions of a trustee) for a trust; (iii) managing the assets held on trust; (iv)administration services for a trust; (v) eventual transfer of assets to beneficiaries. For the avoidance of doubt, service (iii) above does not

Supervisory Policy Manual cover investment management of the trust assets by a licensed or registered person for Type 9 regulated activity under Schedule 5 to the Securities and Futures Ordinance (Cap. 571). For service (iv), non-exhaustive examples of one or more activities that will be taken into account in considering whether administration service for a trust is involved include keeping of accounting records relating to a trust and preparation of accounting records for a trust; custody of trust assets; and payment of expenses or remuneration out of a trust. However, as far as a collective investment scheme (“CIS”) as defined in Schedule 1 to the Securities and Futures Ordinance is concerned, service (iv) does not cover an activity the exercise of which is the responsibility of the management company of the CIS.
1.1.2 The explanations of terms given above and the summaries of
requirements provided in the remainder of this module are for readers' reference and guidance only. Appropriate advice should be sought where precise interpretation is required.
1.2 Background
1.2.1 Hong Kong is positioned as a premier asset and wealth
management centre. To reinforce this position, it is reckoned that Hong Kong should continue to attract and provide services in asset and wealth management, including those for high net worth individuals and family offices. Among others, trust, as a means of protecting assets and controlling how they are used, is an important tool for managing wealth. Protection of client assets held on trust is thus paramount.
1.2.2 Financial institutions should treat their customers fairly. Retail
banks and private banks in Hong Kong have adopted their respective Treat Customers Fairly Charters to foster a sound corporate culture that supports prudent risk management and contributes towards incentivising proper staff behaviour leading to positive customer outcomes and high ethical standards in the banking industry. Treating customers fairly therefore would also be a key spirit in developing a regulatory code for trust business.

Supervisory Policy Manual
1.2.3 Against this backdrop, the HKMA introduces a Code of
Practice for Trust Business (“the Code”) (see Annex for the Code) to enhance protection of client assets held on trust; promote treating customers fairly and customer-centric culture in trust industry; and better align with the international standards and practices. This would in turn enhance clients’ confidence in entrusting assets to trustees in Hong Kong, thereby reinforcing Hong Kong’s position as a leading asset and wealth management centre.
1.2.4 This module does not include trust-specific prudential
requirements, as an AI is already subject to the prudential requirements applicable to it. This module also does not include anti-money laundering and counter-financing of terrorism requirements, which are already set out in the applicable statutory and regulatory requirements including the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615).
1.3 Application
1.3.1 This module applies to all AIs.
1.3.2 The trust business services subject to the Code are those
provided by a trustee or prospective trustee (or a party by whatever name called performing the functions of a trustee) of the trust concerned.
1.3.3 As stated therein, the Code applies to AIs and subsidiaries of
locally incorporated AIs (“AI subsidiaries”) that conduct trust business in Hong Kong. The locally incorporated AIs should ensure that the business conduct, practices and controls of such subsidiaries are in line with the Code, and such subsidiaries follow other relevant requirements in this module. For better protection of client assets, other trustees (i.e. other than AIs or AI subsidiaries) that conduct trust business in Hong Kong are encouraged to adopt the Code.
1.3.4 Where the operations and functions of a trustee are performed
by delegates or other parties, while the delegates and other parties do not by themselves fall within the scope of the Code, the trustee should have a proper oversight of them and ensure

Supervisory Policy Manual that the operations and functions concerned are performed in accordance with the relevant legal and regulatory requirements (including the Code) and the trust governing documents.
1.3.5 Where an AI merely introduces or refers a trustee to its
customers for provision of trust services (regardless of where the trustee provides the trust services), the AI is not required to observe the Code, but the AI is still subject to the requirements stated in paragraph 3.1 below. Such requirements also apply to AI subsidiaries. Locally incorporated AIs with subsidiaries so introducing or referring a trustee to customers should ensure that such subsidiaries follow the requirements in paragraph 3.1 below.
1.3.6 This module should be read in conjunction with any other
relevant guidance issued and updated by the HKMA from time to time.
1.4 Exemptions
1.4.1 To minimise regulatory overlap, certain trust services are
exempted from the scope of the Code as specified therein.
2. Conduct requirements
2.1 General
2.1.1 The Code sets out the general principles and practical
standards to govern the conduct of trustees in their trust business in Hong Kong.
2.1.2 In carrying on trust business in Hong Kong, a trustee should
observe the general principles and the practical standards detailed in the Code. A trustee has the responsibilities over services outsourced or performed by its delegates, although the outsourced service providers and delegates do not fall within the scope of the Code.

Supervisory Policy Manual
2.2 Appointment of managers and responsible officers
2.2.1 A trustee that is an AI should appoint (a) manager(s) in respect
of section 72B of the Banking Ordinance (Cap. 155) to be principally responsible (alone or with others) for the conduct of its trust business under different lines of business (e.g. retail banking, private banking, corporate banking, or other business which is material to the institution). The AI is required to comply with the HKMA’s Supervisory Policy Manual CG-2 on Systems of Control for the Appointment of Managers ("SPM CG-2”) which sets out, among others, the fit and proper criteria and the respective controls to ensure fitness and propriety of individuals appointed as managers, and notification requirements and timeline to the HKMA.
2.2.2 A trustee that is an AI subsidiary should appoint appropriate
individual(s) to be principally responsible (alone or with others) for the conduct of the trust business (hereafter called “responsible officer(s)”) and notify the HKMA in respect of the appointment of the responsible officer(s):
(i) the name of the responsible officer(s); (ii) the Hong Kong identity card (if not available, passport) number of the responsible officer(s); (iii) the position or title of the responsible officer(s); and (iv) the date of new appointment, cessation of existing appointment or change in responsibilities, within 14 days of the appointment, cessation or change.
2.2.3 In assessing the fitness and propriety of individual(s) to be
appointed as responsible officers, reference could be drawn from the attributes and the fit and proper criteria as set out in SPM CG-2.
2.2.4 For the avoidance of doubt, the managers and responsible
officers referred to in paragraphs 2.2.1 and 2.2.2 above respectively are subject to the requirements in paragraph A.4.4.4 of the Code.
2.3 Non-compliance
2.3.1 The HKMA oversees the trust business of AIs and AI
subsidiaries as part of its supervision of the businesses of the

Supervisory Policy Manual
AIs as a whole. The HKMA will monitor their compliance with the Code in its ongoing supervision.
2.3.2 Where a trustee identifies that there is material non￾compliance with the Code or it comes to its attention that there
is material non-compliance, the case should be promptly reviewed and timely reported to the senior management and relevant regulator(s) in accordance with the guidance under Principle 6 Co-operation with regulators in the Code.
2.3.3 Failure of a trustee to adhere to the Code may call into
question the fitness and propriety of the trustee, whether the AI concerned continues to satisfy the minimum criteria for authorization in the Banking Ordinance, and/or the fitness and propriety of the chief executive, directors, shareholder controllers and managers as defined under the Banking Ordinance of the AI concerned.
3. Introduction or referral services
3.1 Where an AI introduces or refers a trustee to its customers for
provision of trust services (regardless of where the trustee provides the trust services), the AI should observe the following requirements for protecting customers if recommendation is made, or commission, fee or similar remuneration is received or receivable, by the AI in the introduction or referral:
(a) The AI should perform proper due diligence on the trustee to be introduced or referred to its customers, taking into account whether the trustee follows the Code or requirements comparable to the Code, and other factors such as track record, reputation and standing, financial soundness, operational capability and capacity, and relevant internal controls and practices; (b) In the case of an introduced or referred trustee that operates outside Hong Kong, due diligence by the AI should also take into account any implications to customers and the AI (e.g. different or diminished consumer protection in the jurisdiction concerned). In any case, the AI should be satisfied that it is appropriate to make such introduction or referral of the trustee outside Hong

Supervisory Policy Manual
Kong; and
(c) The AI should ensure that the trustee has put in place proper arrangement to handle incidents (e.g. disruption of services, data leakage), including notifying any impacted customers and safeguarding customer interests. The above requirements do not apply if the relevant trust services fall within the scope of Exemptions from the Code.
4. Supervisory approach
4.1 General
4.1.1 Pursuant to §7 of the Banking Ordinance, one of the functions
of the MA is to take all reasonable steps to ensure that the businesses of AIs are carried on with integrity, prudence and the appropriate degree of professional competence. Further, one of the mandates of the MA is to promote and encourage proper standards of conduct and sound and prudent business practices amongst AIs.
4.1.2 In its efforts to enhance bank customer protection, the HKMA
takes into account the G20 High-level Principles on Financial Consumer Protection. These principles include, among others, equitable and fair treatment of customers, disclosure and transparency, and responsible business conduct. The HKMA has also worked closely with the banking industry to promote sound bank culture that supports prudent risk management and contributes towards incentivising proper staff behaviour leading to positive customer outcomes and high ethical standards in the banking industry.
4.1.3 In the context of trust business and related activities of AIs,
the HKMA supervises AIs’ compliance with the relevant requirements, in order to provide an appropriate degree of protection to AIs’ customers.

Supervisory Policy Manual
4.1.4 In practice, the board of directors1
(“the board”) and senior management of an AI bear the primary responsibility for putting in place sound controls and systems commensurate with the AI’s risk profile for properly managing the risks associated with the trust business and related activities. They have the responsibility of, among others, protecting their customer interests, and are expected to play a proactive role in ensuring effective risk management and establishing the AI’s culture, values and behavioural standards that promote prudent risk-taking and fair treatment of customers. The HKMA monitors AIs’ compliance with relevant laws and regulatory standards, promotes good corporate governance and sound bank culture, and takes a range of supervisory and enforcement actions to address issues identified.
4.1.5 The HKMA adopts a risk-based supervisory approach and
measures that are appropriate and proportionate to the risks posed by AIs’ trust business and related activities to the public. To ensure a fair and consistent supervisory process, generally speaking, there are three levels of measures that the HKMA would consider.
4.1.6 The first level of supervisory action is sharing good practices
with the industry to facilitate AIs to strengthen their practices and controls.
4.1.7 In addition, where the HKMA identifies management, system
or control deficiencies of AIs in its supervisory process, the HKMA would consider the second and the third levels of supervisory action, taking into consideration the nature and the severity of the deficiencies and implications.
4.1.8 The second level of supervisory action would be deployed
where deficiencies in controls and practices of AIs are identified. Such deficiencies may include AIs’ controls or

1 For a locally-incorporated AI, the board may delegate its oversight duties to designated board-level committee(s). As regards the Hong Kong operations of an overseas incorporated AI, the term “board” generally refers to the local senior management of the AI under the scrutiny by its head office or regional headquarters.

Supervisory Policy Manual practices that do not meet the regulatory requirements and/or the regulators’ expected standards. To address such deficiencies, the HKMA would consider various supervisory actions according to the specific circumstances of each case. Usually, the AI concerned would be required to implement corrective actions to rectify the problem. Where the deficiencies suggest systemic issues, the AI concerned would be required to take more rigorous actions. Typically, it would be instructed to commission an independent review of the relevant controls and/or transactions according to the HKMA’s requirements and take proper actions to address the review findings, including to address the aggrieved customers’ concerns. The AI concerned may also be required to cease business practices that had caused serious supervisory concerns.
4.1.9 The third level of supervisory action would be triggered when
the HKMA finds prima facie case of any ground for discipline. Failure of a trustee to adhere to the Code may call into questions the fitness and propriety of the AI concerned, whether the AI concerned continues to satisfy the minimum criteria for authorization in the Banking Ordinance, and/or the fitness and propriety of the chief executive, directors, shareholder controllers and managers as defined under the Banking Ordinance of the AI concerned.
4.1.10 The HKMA will, through enforcement and other appropriate
follow-up actions against offenders, seek to deter improper practices and behaviour, promote proper standards of conduct and prudent business practices among AIs, and to provide a measure of protection to bank customers.
4.1.11 While the HKMA will generally have regard to the above
categorisation of supervisory and enforcement actions, the actual measures to be taken in each case will be subject to the facts and circumstances of individual cases.
4.2 Guidelines and supervisory standards
4.2.1 In relation to trust business and related activities, the general
approach adopted by the HKMA is to require AIs to comply with the relevant legal requirements as well as regulatory

Supervisory Policy Manual standards and requirements promulgated by the HKMA. The HKMA will also take into account an AI’s compliance with these standards and requirements in considering whether the AI satisfies the continuing authorization criteria in respect of adequate systems of control and business manner under paragraphs 10 and 12 of the Seventh Schedule to the Banking Ordinance.
4.2.2 AIs should ensure their management and staff are well
informed of the legal and regulatory requirements applicable to carrying on of trust business and related activities and keep abreast of any new requirements and updates.
4.3 On-site examinations
4.3.1 The HKMA conducts on-site examinations of trust business
and related activities conducted by AIs and AI subsidiaries.
4.3.2 The objectives of the examinations are to enable the HKMA to
understand the way in which an AI or AI subsidiary carries on trust business and related activities and to determine whether it has in place appropriate and effective policies, procedures and control measures to ensure compliance with the Code and any relevant guidelines and circulars issued by the HKMA. AIs and AI subsidiaries should be able to demonstrate that the relevant policies, procedures and control measures are well established and effectively applied.
4.3.3 The HKMA may require AIs and AI subsidiaries to provide a
copy of the auditors’ report, together with their management response and the remedial action plans.
4.4 Off-site reviews
4.4.1 To facilitate the continuing supervision of trust business and
related activities of AIs, the HKMA will conduct regular survey(s) to collect information on trust business and related activities conducted by AIs and AI subsidiaries.
4.4.2 The HKMA may also require AIs or AI subsidiaries to submit
ad-hoc surveys or reviews for off-site surveillance.

Supervisory Policy Manual
4.4.3 The HKMA will take into account, among other things, the
information collected from off-site surveillance in prioritising supervisory resources to focus on potential issues (e.g. in determining the scope and focus of on-site examinations). The HKMA will also follow up with individual AIs or AI subsidiaries as necessary if the information collected reveals weaknesses or deficiencies in regulatory compliance, internal controls or management supervision.
5. Notification and reporting requirements
5.1 A trustee that is an AI or AI subsidiary should promptly report to the
HKMA or notify the HKMA of significant changes in its business plans, material non-compliance with any legal and regulatory requirements (including the Code), major incidents and any other matters that may have material impact on the fitness and propriety of the trustee (which may include, depending on the circumstances and severity of the matter, a major dispute or litigation involving the trust parties).
5.2 For the matters mentioned in paragraph 5.1 above, the AI or AI
subsidiary (as the case may be) should report to the HKMA and notify the HKMA of any rectification and remedial action plan as soon as reasonably practicable and within any prescribed timeline in accordance with the requirements applicable to AIs.
5.3 The established reporting arrangement of banking conduct incidents
should be complied with, including that for non-compliance with a requirement in this module.
5.4 AIs and AI subsidiaries should put in place adequate policies and
procedures to ensure compliance with their notification and reporting obligations.
6. List of trustees
6.1 For access by members of the public, the HKMA will maintain and
publish a list of trustees consisting of AIs and AI subsidiaries that carry on trust business in Hong Kong. The list will also include other trustees within an AI group where the trustees carry on trust business

Supervisory Policy Manual in Hong Kong and annually declare that they observe the Code, if such other trustees wish to be included in the list. Such other trustees refer to a holding company, subsidiary (for AIs incorporated outside Hong Kong) or affiliate of an AI.
6.2 For the purposes of the list, such other trustees will be required to
provide to the HKMA initially and subsequently for each calendar year a declaration, in the form and subject to the requirements the HKMA thinks fit, on compliance with the Code, and any other information considered necessary by the HKMA.
6.3 The list will contain basic particulars of the trustees at the entity level.
For suspension or cessation of trust business, and any subsequent changes in the basic particulars and any other information deemed necessary, the trustees should notify the HKMA within seven business days2 .
6.4 The HKMA does not guarantee performance or creditworthiness of
any entities that are published on the list. It is at the discretion of the HKMA to not include particulars of a trustee in the list or to permanently or temporarily remove particulars of a trustee at any time from the list if the HKMA thinks it appropriate or situation warrants, including if the HKMA is aware that the trustee on the list does not comply with the Code depending on the circumstances. ————————— Contents Glossary Home Introduction

“Business day” refers to any day other than (a) a public holiday; or (b) a gale warning day or a black rainstorm warning day as defined in §71(2) of the Interpretation and General Clauses Ordinance (Cap. 1).

Supervisory Policy Manual
Annex: Code of Practice for Trust Business
Contents
A.1 Introduction
A.2 General principles
A.3 Principle 1: Fairness, honesty and integrity A.4 Principle 2: Due skill, care and diligence A.5 Principle 3: Management and control of trust assets A.6 Principle 4: Corporate governance and internal controls A.7 Principle 5: Compliance with legal and regulatory requirements and standards A.8 Principle 6: Co-operation with regulators A.1 Introduction A.1.1 Purpose A.1.1.1 This Code of Practice for Trust Business (“the Code”) sets out the general principles and practical standards to govern the conduct of trustees in their trust business in Hong Kong. A.1.1.2 The Code does not have the force of law and should not be interpreted in a way that would override the provision of the law. It supplements all legal requirements and obligations under the trust governing documents or otherwise applicable to trustees in the exercise of their trustee functions and is not to be interpreted or used to permit or require a trustee to derogate from such requirements and obligations. A.1.1.3 Trustees should, in addition to observing all applicable legal requirements and the requirements in this Code, also

Supervisory Policy Manual observe other regulatory requirements as relevant to their trust business, including but not limited to other conduct requirements, prudential requirements, and anti-money laundering and counter-terrorist financing requirements. A.1.2 Terminology For the purpose of the Code – A.1.2.1 “Trust” refers to an obligation imposed on a person to hold or control and administer assets for the benefit of others (i.e. the beneficiaries) or for a specified purpose (e.g. charitable purpose, wills or estate planning). A.1.2.2 “Trust business” refers to provision of one or more of the following services, by way of business:
(i) setting up a trust;
(ii) acting as a trustee (or a party by whatever name called performing the functions of a trustee) for a trust; (iii) managing the assets held on trust; (iv) administration services for a trust; (v) eventual transfer of assets to beneficiaries. For the avoidance of doubt, service (iii) above does not cover investment management of the trust assets by a licensed or registered person for Type 9 regulated activity under Schedule 5 to the Securities and Futures Ordinance (Cap. 571) (“SFO”). For service (iv), non-exhaustive examples of one or more activities that will be taken into account in considering whether administration service for a trust is involved include keeping of accounting records relating to a trust and preparation of accounting records for a trust; custody of trust assets; and payment of expenses or remuneration out of a trust. However, as far as a collective investment scheme (“CIS”) as defined in
Schedule 1 to the SFO is concerned, service (iv) does not
cover an activity the exercise of which is the responsibility of the management company of the CIS.

Supervisory Policy Manual
A.1.2.3 “Customer” means:
(a) A person who has entered into or may enter into an agreement for services to be provided by a trustee. (b) A person who has received or may receive trust services to be provided by a trustee. The definition of “customer” is to be applied to the individual provisions of the Code according to whether it applies to settlor or beneficiaries only, or settlor and beneficiaries together, or any other applicable trust party, in the given circumstances. A.1.2.4 “Trust governing documents” means, in respect of a trust, the trust deed and any other documents setting out the general and specific terms governing the trust services provided or to be provided by a trustee to the trust. A.1.2.5 “Relevant staff” refers to staff engaged by a trustee to provide direct assistance in the provision of trust business (including customer-facing staff, operations staff, and supervisors of such staff). Staff acting as an accountant for the overall book-keeping at the corporate level, providing human resources, general secretarial or administrative support or information technology support at the corporate level, or performing legal, compliance or risk control function are not regarded as relevant staff. A.1.3 Applicability A.1.3.1 The trust business services subject to the Code are those provided by a trustee or prospective trustee (or a party by whatever name called performing the functions of a trustee) of the trust concerned. A.1.3.2 The Code applies to authorized institutions 3 (“AIs”) that conduct trust business in Hong Kong.

3 As defined by the Banking Ordinance (Cap. 155).

Supervisory Policy Manual
A.1.3.3 The Code also applies to subsidiaries of locally incorporated AIs that conduct trust business in Hong Kong. The locally incorporated AIs should ensure the business conduct, practices and controls of such subsidiaries are in line with the Code. A.1.3.4 Any other trustees that conduct trust business in Hong Kong are encouraged to adopt the Code. A.1.3.5 Where the operations and functions of a trustee are performed by delegates or other parties, while the delegates and other parties do not by themselves fall within the scope of the Code, the trustee should have a proper oversight of them and ensure that the operations and functions concerned are performed in accordance with the relevant legal and regulatory requirements (including the Code) and the trust governing documents. A.1.4 Exemptions A.1.4.1 The persons mentioned in paragraphs A.1.4.2 to A.1.4.5 below are exempted from the scope of this Code. A.1.4.2 Depositaries licensed or registered for Type 13 regulated activity (“RA13”) under Schedule 5 to the SFO insofar as the trust services provided relate to a CIS authorized by the Securities and Futures Commission under section 104 of the SFO and form part of the regulated functions for RA13 under the SFO4 . A.1.4.3 Trustees insofar as the trust services provided relate to the products mentioned below:
(a) a registered scheme or its constituent fund, as defined in section 2(1) of the Mandatory Provident Fund Schemes Ordinance (Cap. 485) (“MPF schemes”); and

4 This exemption applies when the RA13 regime is implemented. For the existing depositaries of CIS authorized by the Securities and Futures Commission, an exemption is provided during the interim period between the implementation of this module and that of the proposed RA13 regime, to the extent that the trust services are related to the proposed RA13.

Supervisory Policy Manual
(b) an approved pooled investment fund as defined in
section 2 of the Mandatory Provident Fund Schemes
(General) Regulation (Cap. 485A) (“APIF”) which is or is intended to be offered only to:
(i) MPF schemes;
(ii) occupational retirement schemes as defined in section 2(1) of the Occupational Retirement Schemes Ordinance (Cap. 426) (“ORSO”) (“ORSO schemes”); (iii) pooling agreements as defined in section 2(4) of the ORSO; or (iv) other APIFs which are or are intended to be offered only to a product specified in (i), (ii) or (iii) above. A.1.4.4 Trustees insofar as the trust services provided relate to ORSO schemes. A.1.4.5 A person when acting in the capacity of a trustee where that
part of its trust business is specifically in relation to a trust
that is created or proposed to be created in connection with loans and/or the issuance of debentures (which include debt securities, such as notes and bonds) and aims to ensure the fulfilment of applicable rights and/or obligations between creditors and debtor(s) including between debenture holders and debenture issuer(s) and between borrowers and lenders under loan facilities. Such rights and/or obligations include for example the benefit of a covenant to repay debt, and/or the benefit of security for such a covenant (or assets held as a result of the performance or enforcement of the covenant to repay or security). A.1.5 Non-compliance A.1.5.1 Where a trustee identifies that there is material non￾compliance with the Code or it comes to its attention that there is material non-compliance, the case should be promptly reviewed and timely reported to the senior management and relevant regulator(s) in accordance with

Supervisory Policy Manual the guidance under Principle 6 Co-operation with regulators in the Code. A.2 General principles A.2.1 Principle 1: Fairness, honesty and integrity A.2.1.1 A trustee should act honestly, fairly, and with integrity in conducting its trust business. A.2.2 Principle 2: Due skill, care and diligence A.2.2.1 A trustee, in conducting its trust business, should act with due skill, care and diligence, and in the interests of its customers. A trustee should ensure that the entity through which trust business is conducted and all relevant staff are fit and proper to perform their roles and functions. A.2.3 Principle 3: Management and control of trust assets A.2.3.1 A trustee should exercise due care in understanding, managing and controlling all assets held within the trust in full conformity with its fiduciary obligations. A.2.4 Principle 4: Corporate governance and internal controls A.2.4.1 A trustee should establish a proper corporate governance structure and implement adequate internal controls and risk management systems to ensure that its trust business is effectively managed. A.2.5 Principle 5: Compliance with legal and regulatory requirements and standards A.2.5.1 A trustee should comply with relevant legal and regulatory requirements and standards applicable to the conduct of its trust business activities. A.2.6 Principle 6: Co-operation with regulators A.2.6.1 A trustee should deal with relevant regulators in an open and co-operative manner.

Supervisory Policy Manual
A.3 Principle 1: Fairness, honesty and integrity A.3.1 A trustee should ensure that its actions comply with relevant requirements and standards applicable to the trustee and/or its staff, where appropriate. The higher standards should prevail. A.3.2 A trustee should observe the following:
A.3.2.1 A trustee should conduct its trust business with integrity. A trustee should not engage in any conduct involving fraud or dishonesty or commit any act that reflects adversely on its honesty, trustworthiness or that compromises its integrity. A.3.2.2 A trustee should, subject to the duties and obligations conferred by the trust governing documents, not attempt to avoid its responsibilities under the Code and any other applicable requirements and standards. A.3.2.3 Subject to the terms of the trust governing documents and its legal and fiduciary obligations applicable from time to time, a trustee should act fairly and objectively when dealing with customers. In particular, a trustee should:
(a) act in accordance with the objects of a trust and work within the parameters and terms set out in the trust governing documents and/or any directions from a relevant party where permitted, in accordance with applicable requirements and standards; (b) treat its customers fairly at all stages of the relationship, while having regard to its legal and fiduciary obligations; and (c) provide advice where required and appropriate to its customers and exercise independent professional judgement in performing its duties, including the appointment and oversight of delegates and other service providers performing services for the trust e.g. investment managers.

Supervisory Policy Manual
A.3.3 Disclosure of information
A.3.3.1 Where appropriate and permitted under applicable laws and regulations and subject to the terms of the trust governing documents, a trustee should:
(a) ensure that a customer has access to relevant and updated information concerning that trust; and (b) make adequate and accurate disclosure of relevant information to help customers make an informed decision prior to entering into any contract or agreement (for example, key risks, terms and conditions, fees and charges). A.3.4 Fees and charges A.3.4.1 A trustee should ensure that fees and charges in relation to a trust are fair and reasonable. A.3.4.2 Unless restricted by the terms of the trust governing documents, a trustee should be open and transparent with customers about fees and charges, for example:
(a) prior disclosure of and agreement on fees and charges, and documentation of the basis for such fees and charges; (b) prior disclosure, where practicable, of benefits received or receivable associated with the trust service provided from parties other than the customers; (c) disclosure of the manner by which fees and charges will be collected; (d) giving adequate notice before introducing any change in fees and charges; and (e) disclosure of the arrangement of fees and charges in relation to the termination of services, such as whether fees paid in advance are refundable in the event of termination.

Supervisory Policy Manual
A.3.5 Representations
A.3.5.1 A trustee should take reasonable steps to ensure that representations made, including invitations and advertisements, are accurate, and do not contain information that is false, misleading or deceptive. A.4 Principle 2: Due skill, care and diligence A.4.1 Prompt execution A.4.1.1 A trustee should take all reasonable steps, having obtained sufficient information in order to exercise properly its discretion or other powers, to consider and deal effectively and in a timely manner with requests from its customers, including the establishment, transfer or closing of business relationships. A.4.2 Acting in the interests of customers A.4.2.1 A trustee should act in good faith with proper purpose, and act with due skill, care and diligence in performing its duties. A trustee should not take up outside duties or responsibilities which may pose undue influence on the trustee’s decisions or compromise the trustee’s ability to act in the interests of the trust. Where such outside duties and responsibilities arise as a function of the trustee conducting its business within a wider organisation e.g. a bank with multiple service lines, the trustee should ensure there is proper segregation of decision making and other activities in place to avoid any undue influence on trustee decision making or compromise the trustee’s ability to act in the interests of the trust. A.4.2.2 A trustee should have a complete and updated understanding of the trust governing documents in each case, and seek legal or other professional advice where necessary. A.4.2.3 A trustee should treat the interests of customers as paramount, subject to any legal obligations to other parties. Where there is more than one trustee, a trustee should act

Supervisory Policy Manual in accordance with the trust governing documents in making collective decisions, and only act on an individual basis if empowered to do so by the trust governing documents. A.4.2.4 When a trustee exercises power or discretion in relation to a trust (such as the power to invest, manage or arrange for investment), it should act with due care and attention to ensure that it suitably exercises such power or discretion. For example, a trustee should:
(a) act responsibly on any available information considered by the trustee to be relevant and appropriate; and (b) exercise power or discretion properly in accordance with the objects and terms set out in the trust governing documents and applicable legal and regulatory requirements. A.4.3 Handling conflicts of interest A.4.3.1 A trustee should establish and implement effective policies and procedures to identify and manage actual or potential conflicts of interest. A.4.3.2 A trustee should consider the circumstances in determining the appropriate actions to handle actual or potential conflicts of interest so that they can be avoided or prevented, and if not possible, at least appropriately managed. For example, subject to the terms of the trust governing documents, a trustee should:
(a) segregate duties adequately;
(b) establish internal rules of confidentiality as appropriate, including necessary information boundaries, such as physical separation of certain departments or data segregation; (c) identify the relationships, services, activities or transactions of the trustee in respect of which conflicts of interest may arise, and set out possible measures for preventing or managing these conflicts, such as:

Supervisory Policy Manual
 ensuring that deliberations, voting and decision making on issues exclude those persons whose participation may give rise to a real or perceived conflict;  disclosing interests or conflicts to the customers and any other impacted trust parties, and if appropriate, seeking written consent from customers and those parties;  advising customers to seek independent professional advice if needed; and (d) take reasonable steps to ensure that customers are fairly treated. A.4.3.3 If a trustee has involvement with any connected party, including those within its wider organisation or to whom it has properly delegated or outsourced a function or operation, it should implement proper internal controls, including dealing with connected parties on an arm's length basis and in the interests of the trust, disclosure of connections, and maintaining proper documentation of the justifications for approving a transaction with a connected party. A.4.4 Fitness and propriety of a trustee and its staff A.4.4.1 A trustee should possess and maintain sufficient skills, knowledge and expertise to conduct its trust business. It should only conduct those areas of trust services for which it has relevant professional knowledge and expertise. A.4.4.2 A trustee should ensure that its key personnel and relevant staff are and remain fit and proper for their roles and responsibilities. Key attributes in assessing fitness and propriety include financial soundness, competence, honesty, integrity, reputation and reliability. Commensurate with the scale, complexity and risks of the trust business, a trustee should also ensure that staff engaged in compliance, internal controls, risk management and internal audit functions possess the necessary technical

Supervisory Policy Manual knowledge and skills, ethics and compliance knowledge, qualifications and experience. A.4.4.3 A trustee should establish and implement appropriate policies, procedures and plans that take into account the following:
(a) assessing the adequacy of relevant academic and professional qualifications, knowledge, skills, work experience and soundness of judgement of staff; (b) providing adequate level of supervision to staff; and (c) establishing a training plan and providing relevant and timely guidance and training to staff initially and on an on-going basis, including relevant induction and continuous training and development on technical knowledge and skills, industry developments, applicable legal and regulatory requirements (including ethics and compliance knowledge), and relevant internal control policies and procedures. A.4.4.4 In order to maintain on-going professionalism and keep abreast of the latest development, individuals principally responsible for the conduct of trust business and relevant staff are expected to fulfil not less than 10 hours of trust￾related continuous professional training (“CPT”) in each calendar year, of which at least 2 hours are on ethics and compliance. For the avoidance of doubt, trust-related professional training or development activities fulfilled by an individual under relevant professional qualifications can count towards the CPT hours in the same calendar year under the Code, provided that such training or development activities are achieved through the acceptable means:
(i) classroom training courses, workshops, lectures, seminars; (ii) distance learning or self-study, which requires submission of assignments or assessments; (iii) online learning courses with assessments or proof of attendance; (iv) industry research, publication of paper, delivery of speeches or providing comments to industry

Supervisory Policy Manual consultation papers; and/or (v) time spent in giving lectures or teaching (although repeatedly giving the same lecture or teaching will not satisfy the requirement). Trust-related training may be organised by relevant professional bodies, training providers or employing institutions. Individuals principally responsible for the conduct of trust business and relevant staff can choose relevant training that is suitable to their needs and circumstances. A.4.4.5 A trustee should keep records to evidence the competence and on-going professional development of key personnel, relevant staff, and staff engaged in compliance, internal controls, risk management and internal audit functions. Such records should be retained for a minimum period of 3 years. A.5 Principle 3: Management and control of trust assets A.5.1 Ownership and entitlement of trust assets A.5.1.1 A trustee, where managing the assets of a trust, should act in accordance with the terms of the trust governing documents, the directions of the trust parties subject to the trust governing documents and applicable legal and regulatory requirements. A.5.1.2 A trustee should exercise care in safeguarding those assets held on trust within its control. Where physical assets in this respect are held, physical storage should be secure. A.5.1.3 Adequate procedures should be effectively implemented to minimise the risk of loss, theft, fraud, and other acts of misappropriation. Proper records should be maintained in respect of assets within the trustee’s control to evidence their registration and good title where available and security as appropriate and to ensure their availability for distribution in accordance with the trust governing documents and/or trustees’ exercise of its discretion. Proper audit trails

Supervisory Policy Manual should be created to evidence the receipt, delivery and other movements of assets. A.5.2 Segregation of trust assets A.5.2.1 A trustee should ensure assets held on trust are clearly identified and segregated from one another and from the assets of the trustee and any delegates or other parties involved in the operations of the trust. A.5.3 Reconciliation of trust assets A.5.3.1 Regular reconciliation of client monies and where practicable other assets held on trust against the trustee or third-party records, and where practicable verification of asset ownership, should be conducted by staff of the trustee operationally independent of the regular management and administration of the trust and be subject to periodic review and approval by appropriate management staff. For physical assets, commensurate with the prudent and effective exercise of trustee’s duty, periodic audits should be conducted at the premises where the physical assets are kept. A.5.3.2 Proper procedures should be implemented to follow up any issues or discrepancies identified, take any rectification and remedial measures, and report or escalate matters as appropriate. A.6 Principle 4: Corporate governance and internal controls A.6.1 A trustee should establish and maintain robust corporate governance policies and practices as well as effective internal controls and risk management processes that are commensurate with the nature, scale and complexity of the trust business. A.6.2 A trustee should implement processes to ensure that its senior management can timely obtain updates and appraise the affairs of the trust business.

Supervisory Policy Manual
A.6.3 A trustee should ensure that reporting lines are clearly identified with supervisory and reporting responsibilities assigned to appropriate staff with separation of duties as appropriate. A.6.4 A trustee should regularly review the effectiveness and appropriateness of its governance policies and practices, and its internal controls, taking into account the business activities, risk profile and market development. A.6.5 A trustee should have proper oversight of all delegates and other parties, e.g. agents, nominees, custodians, and other service providers, appointed or engaged for providing services related to its trust business. Among others, a trustee should have adequate internal control policies and procedures for ongoing monitoring of such delegates and other parties to be satisfied that the operations and functions concerned are performed in compliance with relevant legal and regulatory requirements (including those in this Code) and the trust governing documents. A.6.6 Management accountability A.6.6.1 The ultimate responsibility for the operation and conduct of a trust business of a trustee lies with the board of directors, or other relevant governing body (if the trustee is not a corporate entity) of that trustee. A.6.6.2 Senior management of a trustee are accountable to the board, or other relevant governing body (if the trustee is not a corporate entity) and are responsible and accountable for running the trust business on a day-to-day basis, and should ensure that the business activities comply with applicable legal and regulatory requirements and internal procedures. A.6.7 Confidentiality A.6.7.1 In accordance with confidentiality obligations conferred by the provisions of the trust governing documents and relevant personal data privacy legislation in force, a trustee should implement appropriate policies, procedures and controls on collection, use and transmission of trust related

Supervisory Policy Manual information and collection, use, storage, protection, transmission and destruction of personal data. A.6.7.2 Staff are required to hold in strict confidence all trust related information and personal data the trustee has collected or obtained from persons related to trusts (e.g. settlors, protectors, enforcers and beneficiaries). A trustee should not disclose such information to third parties unless required or permitted by applicable legal and regulatory requirements and the trust governing documents; where the trustee needs to seek advice under legal privilege or other necessary professional advice; where the trustee must disclose to discharge the trustee’s duties or where consent is given by the person concerned. An institution should take all necessary steps to safeguard the confidentiality of trust related and personal information, including formulating internal policies for the collection, use, storage, protection, transmission and destruction of confidential data. A.6.7.3 A trustee should implement adequate controls to prevent staff from benefiting in financial or non-financial terms from the improper use of confidential information which may lead to unfair, improper or illegal behaviour. A.6.8 Delegation and outsourcing A.6.8.1 A trustee should assess and continually manage the risks associated with a delegated or outsourced function or operation. A.6.8.2 Commensurate with the scale, complexity and risk profile of the trust business, a trustee should establish adequate policies, procedures and control measures in relation to the selection, appointment, monitoring, assessment and supervision of delegates and other service providers, including:
(a) setting selection criteria (taking into account the costs, quality of services, financial soundness, reputation, managerial skills, technical capabilities, operational capability, compatibility and other relevant factors) and

Supervisory Policy Manual performing appropriate due diligence of a delegate or other service provider prior to appointment or engagement; (b) executing an agreement which clearly sets out the type and level of services to be provided and the liabilities and obligations of the delegate or other service provider; and (c) implementing controls to monitor the performance, manage the relationship with the delegate or other service provider on a continuous basis, and implementing safeguards to protect the integrity and confidentiality of customer information. A.6.9 Internal controls on managing and administering the trust A.6.9.1 A trustee should implement adequate procedures and controls in managing, administering, and overseeing, as applicable, the operation of the trust. Examples of these controls include cashflow monitoring, investment monitoring, safekeeping and valuation of assets, trust accounting, receipt and distribution of payments and assets, where applicable and in accordance with the trust governing documents together with all applicable legal and regulatory requirements. A.6.9.2 A trustee should ensure it has in place an adequate business continuity plan and procedures to handle potential disruptions, failures, and other contingencies for its trust business activities. A trustee should also establish an appropriate contingency plan for the appointment or engagement of delegates and other parties. A.6.10 Complaint handling A.6.10.1 A trustee should implement adequate policies and procedures for handling complaints lodged by customers or a third party on behalf of customers related to its trust business. (a) Policies and procedures should cover receiving complaints, investigation of complaints, responding to

Supervisory Policy Manual complaints, and availability of any redress or compensation in appropriate circumstances. (b) Complaints should be handled, investigated and addressed in a fair, prompt and appropriate manner. Staff assigned to handle the complaint should be independent and should not be involved in the subject of the complaint. (c) Details on where and how to lodge a complaint should be communicated and made available to customers. (d) Records of complaints should be maintained which show the complainant’s name, details of the complaint, assessment result, correspondence between a trustee and the complainant, and any actions taken. A.6.10.2 A trustee should set up effective procedures to monitor complaints and prepare regular reports with complaint related data to the senior management for review. A.6.11 Risk management A.6.11.1 A trustee should establish an effective risk management framework and implement adequate procedures and internal controls to identify, monitor and manage risks in acting as a trustee. A.6.12 Accounting and other record keeping A.6.12.1 A trustee should maintain adequate records and adequate internal controls of its records to demonstrate compliance with the Code, other applicable legal and regulatory requirements, and trust governing documents. A.6.13 Professional indemnity insurance A.6.13.1 A trustee should maintain professional indemnity insurance with adequate coverage that is commensurate with its trust business to cover claims for liability related to its duties and obligations in the course of conducting trust business. Coverage may be taken at the entity or group level, so long as it is adequate.

Supervisory Policy Manual
A.7 Principle 5: Compliance with legal and regulatory requirements and standards A.7.1 A trustee should comply with applicable legal and regulatory requirements, regulatory standards, and internal policies and procedures relevant to its trust business. A.7.2 Compliance policies and procedures A.7.2.1 A compliance policy should be established with proper approval from senior management of a trustee, and be commensurate with the scale, complexity and risk profile of the trust business. The policy should be subject to regular review to ensure adequacy and relevancy. A.7.2.2 Adequate procedures and internal controls should be implemented to ensure compliance with relevant legal and regulatory requirements, regulatory standards, and internal policies and procedures. A.7.3 Compliance function and review A.7.3.1 Senior management of a trustee should establish a compliance function comprising staff with relevant knowledge, skills, qualification and experience to execute their duties effectively. A.7.3.2 Commensurate with the scale, complexity and risk profile of the trust business, the compliance function should be appropriately independent of business functions, and report to senior management directly. It should have unfettered access to all business and supporting units, as well as documentation, records and information necessary to properly discharge its roles and responsibilities. A.7.3.3 The trustee should establish a compliance program for planning and conducting regular independent review of its trust business activities and operations. Effective systems and controls should be implemented to identify, monitor and manage any conduct issues, control deficiencies and non￾compliance with relevant requirements (including the Code) and standards governing the trust business.

Supervisory Policy Manual
A.7.3.4 Appropriate remedial measures should be taken to rectify the issues and weaknesses identified and prevent similar occurrences in future. Such action plans and measures should be reviewed and monitored by relevant control and risk management functions and management, including the compliance function. A.7.3.5 The trustee should establish and ensure observance of relevant guidelines to escalate to senior management and report to regulators any material non-compliance and other relevant matters as appropriate. A.8 Principle 6: Co-operation with regulators A.8.1 A trustee should deal with relevant regulators in an open and cooperative manner. A.8.2 Communications made by a trustee with relevant regulators should be timely and accurate.