Abuse and Fraud Prevention in Private Banking and Wealth Management

Circulars
14 Jul 2009
Abuse and Fraud Prevention in Private Banking and Wealth Management Our Ref.: B1/15C 14 July 2009 The Chief Executive All authorized institutions Dear Sir/Madam, Abuse and Fraud Prevention in Private Banking and Wealth Management The purpose of this circular is to share with authorized institutions (AIs) on some of the lessons learnt recently on staff abuses and frauds in private banking and the higher end of retail wealth management business (collectively referred to as "PB" in this circular) and remind AIs to maintain vigilant management control and oversight of this business. A unique characteristic of PB is the close relationship between customer and relationship manager (RM) and the "all-inclusive" money management services provided by the RMs to their customers. Unless strong management control and oversight are maintained, the close customer-RM relationship, as well as the large amount involved in transactions, may make it susceptible to staff abuses or even frauds, such as unauthorized transactions and misappropriation of client funds. This letter sets out some of the lessons learned recently on the prevention of staff abuses and frauds in PB, particularly in the areas of hold-mail service, address changes, and escalation and prompt reporting of non-compliance and suspicious transactions. In addition, the attachment to this circular puts forth some good practices in general on management control and oversight to minimise chances of staff abuses and frauds in PB operations. Control on hold mail service and address change - customers should receive bank statements on their cash and investment transactions. Some institutions provide hold mail service to their customers (because for instance the customers demand a confidential relationship). This may be open to abuse such as concealment of unauthorized transactions as customers may not be able to verify the accuracy of their cash and investment transactions in a timely manner. In general, AIs should not allow hold mail service. If the customer insists on this service, AIs must have control measures in place to mitigate the risks. These control should include having such applications (which should be submitted in writing by the customer) reviewed and

approved by the supervisory staff of the responsible RM and the compliance department, separating custody of the customer's mail and independent reconfirming with customers requesting this service by an independent person in the back office. Also, there must be a limit on the period (no more than 3 months) within which the customer must collect their mails held by the AI from a person independent of the RM, such as the back office. There should also be an independent process to verify and approve change of customer address and request for cheque books handled by the RM. Staff compliance - AIs should adopt zero tolerance for exceptions in processing cash withdrawals or fund transfers. If exceptions are provided, they should be subject to independent and close monitoring. Non-compliant staff should be given formal warning and/or disciplined. Whistle blowing and reporting of suspicious cases - as shown in a number of abuse and fraud cases, the junior staff may feel compelled or be intimidated to cooperate with the culprit despite observing irregularities. Senior management of AIs must be made aware of any suspicious cases involving possible criminal elements in a timely manner. To this end, AIs should have policies and procedures in place on when and how to escalate suspicious cases (which may arise from customer complaints, MIS reports, or whistle blowing by another staff) to the senior management for attention. A hotline or compatible reporting channels should be set up for staff to report in confidence irregular activities encountered at work to an independent unit such as Compliance or Internal Audit. In addition, whenever there is a suspected case involving possible criminal elements, AIs are expected to report the incident to both the Police and the HKMA in a timely manner. Transaction control and monitoring - if left unchecked, a close customer-RM relationship may make unauthorized fund transfers/ withdrawals and investment transactions more susceptible because of the customer's trust and reliance on the RM. Activities of RMs should be subject to frequent (preferably daily) reporting to and review by their supervisors. AIs should develop an independent and robust process to review and confirm client orders, and cash transfers/withdrawals over certain value and investment instructions handled by the RM. For high risk transactions, such as transfers to unregistered third parties, AIs should have procedures to confirm these transactions with the customers, such as phone call-back by an independent person of the back office or by SMS messages to the customers. Also, AIs should have in place a system to sample check and monitor irregular transactions. Where irregular, unusual, high-risk, or suspicious transactions are identified, back-end checkers should call back customers to seek confirmation. More checks on transactions should be carried out on customers who are old-aged, reside outside Hong Kong, or have opted for hold mail service. There
should also be management monitoring and review of staff's transactions through the bank to ensure that any irregularities (such as any unusual increases in securities trading) can be explained or investigated.

AIs should review their PB operations to ensure that their controls are effective, having regard to the points mentioned above and the good practices set out in the Attachment. AIs which have grown rapidly in this area and which have not carried out any review in the past year should conduct the review as a matter of priority. Going forward, the HKMA will examine selected AIs' PB operations and retail wealth management to assess the sufficiency of their management control and oversight. Should you have any questions on the above, please get in touch with your usual supervisory contacts at the HKMA. Yours faithfully, Nelson Man Executive Director (Banking Supervision) Encl. Management Control and Oversight (PDF file, 192KB) Last revision date : 01 August 2011

---

1
Attachment
Abuse and Fraud Prevention in Private Banking and Wealth Management Management Control and Oversight’ Board and senior management oversight Policies and procedures should be properly approved by the board / management to control business operation, with clear accountability established for the risk management and control functions. Regular meetings should be held to oversee the operation / business as well as compliance with corporate policies and procedures. Complete, accurate and timely MIS reports should be provided to the management for review of business activities, customer services, compliance and exceptions. Policies and procedures Policies and procedures governing the PB and wealth management operations should cover, but not limited to, the following areas:
background and integrity checks on RMs account and transaction monitoring responsibilities of RMs staff code of conduct compliance discretionary investment management (if this is provided) customer transaction processing and order execution hold mail service inactive and dormant account handling complaints handling fraud detection and reporting. These policies and procedures should be reviewed and updated on a regular basis. There should also be established processes and procedures for ensuring staff’s awareness of and compliance with these policies and procedures. This attachment puts forth some good practices in general on management control and oversight to minimise chances of staff abuses and frauds in PB operations. Many of them are also applicable to the higher end of retail wealth management. They are not however meant to be exhaustive. It remains the full responsibility of each Al to develop its own policies and procedures to prevent abuses and frauds suited to its needs and scale of operation.

Risk measurement, monitoring and management reporting system There should be procedures in place for reporting of operational losses and irregularities to the appropriate officers. Complete, accurate and timely MIS reports (e.g. performance by individual RMs, exceptions on operational losses and transaction irregularities, customer complaints, inactive and dormant accounts) should be prepared for review by the responsible officers or line managers. Internal controls Internal control environment Job responsibilities should be well-defined, with duties properly segregated among the front and back office staff, in particular:
there should be dual control on the approval of new customer relationships new account documentation processing and account activation should be performed by departments independent from marketing RMs should not single-handedly be responsible for the execution of customer instructions without involvement of other control units for checks and controls customer complaints, customer statements, hold mail services, and inactive and dormant accounts should not be handled by RMs only. Conduct of staff and compensation scheme There should be rules governing staff dealing activities and these activities should be subject to management approval / regular monitoring. Staff relatives’ in-house accounts should also be subject to regular monitoring. Compensation schemes of staff should not be solely driven by financial performance without taking into account satisfactory audit / compliance review results and complaint investigation results. Block-leave policy should be imposed on staff and properly enforced. Account monitoring Where feasible, consideration should be given to periodic rotation of RMs / introducing the immediate supervisor of the RM to the customer. Audit trails of communication with clients (e.g. call reports) should be maintained.

Formal annual review of customer relationships should be conducted on a timely basis to ensure that customer information remains up-to-date. Hold mail If hold mail service is maintained, there should be control measures in place to mitigate the risks, e.g. tighten the control on such applications, separate custody of the customer’s mail from the RM, reconfirming with customers who have requested for this service. Procedures should be established to verify customer authorization for releasing hold mail. If RMs were allowed to release mail on hold to customers directly, there should be control measures, e.g. customers’ signatures should be obtained to acknowledge receipt of the mail and the signatures should be verified by an independent unit. Inactive and dormant accounts There should be a clear policy to classify an account as inactive / dormant. These accounts should be subject to monitoring by units independent of the RMs. Sufficient control procedures should be formulated for reactivating these accounts. Customer account statements There should be proper segregation of duties in (i) generating and delivering customer statements, (ii) handling customer request for change of correspondence address and (iii) collecting and following up with returned mail / advice / statements. Voice logging All the telephone lines of RMs/assistants should be tape-recorded. Procedures should be established to control the tape-recording system and the safe-keeping of tapes. Procedures should be in place for periodic tape listening on sufficient samples. Whistle blowing A hotline or compatible reporting channels should be set up for staff to report irregular activities encountered at work to an independent unit such as Compliance. Compliance Regular review should be performed on compliance with the established operational

control policies and procedures. Vulnerable customers, e.g. users of hold mail service, residing outside Hong Kong, old-aged, should be subject to more frequent checking of account activities to ensure no irregularities. Internal audit Regular internal audit should be conducted, with the implementation of the audit recommendations properly followed up by Internal Audit. Reporting of suspicious cases Senior management of Als must be made aware of any suspicious cases involving serious implications and/or possible criminal elements in a timely manner. To this end, Als should have policies and procedures in place on when and how to escalate suspicious cases (which may arise from customer complaints, MIS reports, another staff’s report, etc) to the senior management for attention. To ensure timeliness of the reporting, Als should establish a designated unit on fraud detection and prevention which can report directly to the senior management. In addition, whenever there is a suspected case involving possible criminal elements, Als are expected to report the incident to both the Police and the HKMA in a timely manner. July 2009 Hong Kong Monetary Authority