Bank Culture Reform

Our Ref: B1/15C B9/146C 2 March 2017 The Chief Executive All Authorized Institutions Dear Sir/Madam, Bank Culture Reform I am writing to provide guidance for Authorized Institutions (AIs) to develop and promote a sound corporate culture 1 that supports prudent risk management and contributes towards incentivising proper staff behaviour leading to positive customer outcomes and high ethical standards in the banking industry. The content of this circular supplements the corporate governance guidelines set out in the Supervisory Policy Manual (SPM)2 and provides additional practical guidance to AIs. In recent years, while considerable efforts have been made globally by banking supervisors and senior management of banks in enhancing standards and practices in respect of governance and risk management framework, it is increasingly recognised that much more needs to be done to promote a sound culture at all levels of banks. In particular, despite the fact that banks have generally adopted practices that are indicative of efforts to promote a proper culture 3 , cases involving undesirable behaviour of staff, which very often 1 In this context, “culture” can be regarded generally as a set of professional and ethical values which defines attitude and behaviours as pursued and observed by a bank’s shareholders, board members and staff. 2 References should be made to relevant SPM modules such as CG-1 “Corporate Governance of Locally Incorporated Authorized Institutions”, CG-3 “Code of Conduct”, CG-5 “Guideline on a Sound Remuneration System” and CG-6 “Competence and Ethical Behaviour”. 3 These refer to practices in respect of “tone from the top”, accountability, effective communication and challenge, and incentives.

• 2 - affected the interests not only of the institutions concerned but also of customers, continued to happen. This signifies that further work needs to be done to explore how to enhance the effectiveness of the culture enhancement initiatives of banks, and what governance arrangements can better promote a culture that puts the safety and soundness of banks as well as the interests of depositors and customers at the centre stage in the pursuit of commercial interests. While it is recognised that there is no “one-size-fits-all” approach, the HKMA expects AIs to adopt a holistic and effective framework for fostering a sound culture within the institution, and particular attention should be given to the following three pillars for promoting sound bank culture: (i) Governance: The board and senior management of an institution should, in their respective roles, set an appropriate “tone from the top” and lead by example. The board should play a leading role in establishing the institution’s culture and behavioural standards that promote prudent risk-taking and fair treatment of customers. Senior management is expected to put in place effective mechanisms for ensuring that the institution’s desired culture is understood and shared by all levels of staff. In practice, AIs should have a dedicated board-level committee, chaired by an independent non-executive director, to advise and assist the board in discharging its responsibilities for the institution’s culture-related matters. Either a stand-alone committee may be set up for such purposes, or the remit of an appropriate board-level committee (e.g. the remuneration committee) should be expanded to encompass culture-related responsibilities. The board-level committee, assisted by internal audit functions or other experts where appropriate, should introduce a regular process to review and confirm the effectiveness of the overall culture enhancement initiatives pursued by the institution. In particular, the committee should approve, review and assess, at least annually, the adequacy of any relevant statement which sets out the institution’s culture and behavioural standards, and seek to ensure that such statement is translated into policies and procedures (including training) that are relevant to the day-to-day work of different levels of staff; (ii) Incentive systems: The incentive systems of an AI (including staff recruitment, performance management, remuneration and promotion systems) should not only reward good business performance but also take into account adherence (and non-adherence) to the institution’s culture and behavioural standards, with a view to avoiding incentivising short-term business performance at the expense of the interests of customers and the safety and soundness of the institution. There should

• 3 - be clear and appropriate consequences established, articulated and applied for individuals engaging in any undesired or unacceptable behaviours. Furthermore, for an incentive system to be effective, the relevant arrangements and/or remuneration structure for different levels of staff and management should be commensurate with their respective seniority and responsibilities; and (iii) Assessment and feedback mechanisms: AIs should develop appropriate tools to monitor adherence of individual business units and relevant staff to an institution’s culture and behavioural standards. An effective escalation policy (including “whistle-blowing” mechanism) should be put in place within the institution to allow timely reporting of any illegal, unethical or questionable practices observed by staff and stakeholders in a confidential setting without the risk of reprisals, and the effectiveness of such channels of escalation should be reviewed from time to time. Results from the relevant assessment and feedback mechanisms should be reported to the senior management and the relevant board-level committee at appropriate intervals (at least annually) and when warranted. The development of effective feedback mechanisms is a very important area that warrants dedicated improvement efforts by AIs judging from our recent review efforts of industry practices. A Practice Guide on the Three Pillars for Promoting Sound Bank Culture is at Annex. AIs are required to review their governance arrangements as well as policies and procedures in relation to corporate culture drawing references from this circular. The necessary enhancement measures should be implemented within one year of the date of this circular. Specifically, locally incorporated AIs should aim to implement the guidance in this circular, including but not limited to the establishment of a dedicated board-level committee. For overseas incorporated AIs, it is expected that similar frameworks and mechanisms, albeit tailored to fit individual circumstances, should be put in place. The intended emphasis is on the effectiveness of individual institution’s governance arrangements, policies and procedures in promoting a sound corporate culture, and the guidance may be applied on a proportionate basis for those institutions with smaller and less complex business. Where an institution is part of an international banking group and adopts a relevant framework formulated at the group level, it should make any necessary adjustments, having regard to local circumstances and any applicable guidelines and circulars issued by the HKMA. This circular should also be circulated to all board directors in the case of a locally incorporated AI and the head of the regional/head office in charge of the governance function in the case of an overseas incorporated AI. The boards of locally incorporated AIs and the senior management of regional/head offices of overseas incorporated AIs are required to take a proactive role in implementing the guidance set out in this circular.

• 4 - Should you have any questions on this circular, you may contact Ms Ying-ying Cheng of Banking Supervision Department at yycheng@hkma.gov.hk and Ms Yvonne Chan of Banking Conduct Department at yyochan@hkma.gov.hk. You may also approach your usual supervisory contacts at the HKMA regarding implementation issues. Yours faithfully, Arthur Yuen Deputy Chief Executive Encl.

1 Annex Three Pillars for Promoting Sound Bank Culture

1. Governance An AI must articulate and communicate its desired culture and values clearly. While culture statements are promulgated from the top, the following factors must be taken into full consideration:  Lead by example : Senior management should lead by example to demonstrate commitment and conviction to promote proper bank culture and values, e.g. by participating in training and/or examinations relating to culture and ethics;  Relevance to different levels of staff : An AI should supplement existing codes of conduct, values statements and related ethics and compliance manuals with summary sheets setting out the conduct and behaviours expected of employees in carrying out their day-to-day responsibilities. In particular, Risk Appetite Statements are generally formulated in highly generalised language with specialised quantitative targets which are not directly related to the operations of middle level and frontline staff. Summary sheets would help to make the institution’s culture and behavioural standards stipulated by the board and senior management more relevant to and easily understood by different levels of staff;  Effective and continual communications from the top and training : Chief executive and other members of senior management should communicate regularly with employees – through e.g. town hall meetings, dedicated conduct events, internal newsletters and blogs, webcasts and video – to share examples of desirable and undesirable behaviours and promote an open exchange of views. Such communications need reinforcement throughout an employee’s lifecycle, including recruitment, on-boarding, ongoing training (specifically on ethical values and conduct issues with case studies to provide guidance on dealing with “grey areas”), remuneration and promotion.  Clear ownership of risk and culture reform : An AI should put in place a clear ownership structure for the core risks and culture reform initiative. For example, it may appoint senior staff members as “conduct risk champions” to take responsibility for cascading messages relating to conduct risk further down the institution;
2. Incentive Systems An AI must review and introduce reform to its incentive system where appropriate to induce behaviours which promote its desired culture and values. The following factors must be taken into full consideration:

2  Avoidance of over reliance on sales/revenue targets in performance measurement : An AI should avoid using a quantitative, formula-based target (e.g. sales quota, profits target) as the sole or primary determinant of a staff’s performance and remuneration, bearing in mind the inherent risks and limitations of such targets;  Adequate consideration of behavioural indicators : An AI should require line managers to affirm that risk management, compliance and conduct-related behaviours (e.g. focus on “total customer relationship”) have been taken into account in performance assessments of individual employees;  Separate performance rating for adherence to corporate values : An AI should introduce or increase the weight for a separate rating in respect of adherence to “corporate values” (which is separate from “regulatory and compliance” objectives) in annual performance assessments, with implications for the determination of variable remuneration of employees who receive a poor rating in the relevant year regardless of their financial performance;  Balanced use of incentives and disincentives : An AI’s incentive system should be designed to not only sanction mis-behaviours but also promote positive behaviours, such as through monetary (e.g. positive adjustment to variable remuneration) and non-monetary (e.g. recognition scheme) rewards for those employees who demonstrate exemplary behaviours that enhance the culture of the institution; 3. Assessment and Feedback Mechanisms An AI must put in place an effective mechanism to assess actual behaviour on the ground and provide useful feedback to help management consider whether any enhancements are necessary. The following factors must be taken into full consideration:  Monitoring core parameters : An AI should produce and analyse a dashboard of indicators for assessing the institution’s culture and to help gauge changes over time. Some common examples of indicators include risk limit breaches, compliance breaches, transactional communication surveillance, staff feedback surveys, customer feedback surveys and complaints (identifying trends and root causes), whistle-blower reports;  Staff feedback : While an AI should draw qualitative information relating to culture from employee surveys, focus group discussions or individual interviews, care is needed in designing the structure and contents for such exercises to minimise the potential bias arising from employees trying to provide answers that are regarded as “correct” rather than “honest”;

3  Customer feedback : An AI should conduct customer satisfaction surveys and mystery shopping programmes and review complaints to collate feedback from customers to assess whether customer-facing staff have behaved in a manner that is in line with the institution’s culture and behavioural standards;  Sharing of lessons learned : An AI should share lessons from internal misconduct and disciplinary cases with employees to reinforce proper understanding of the institution’s culture and behavioural standards and illustrate the consequences for inappropriate behaviours and transgressions. It should also gauge staff’s views and responses in such case studies to identify possible weaknesses and remedial measures;  Internal escalation channels : An AI should design and put in place appropriate channels for staff to directly report issues and concerns (including “whistle-blowing” and unusual activity reporting), or to provide general feedback or comments, to senior management and/or a dedicated team without the need to go through line management or local offices, while protecting staff from reprisals. Each reported case should be subject to independent review or investigation. The AI’s escalation policy should describe the types of issues to escalate, and when, to whom, and how to escalate those issues. Such an escalation policy may make it an obligation for staff to escalate (e.g. failure to promptly escalate significant issues to appropriate parties may be subject to disciplinary actions) and/or there is an incentive arrangement to encourage employees to speak up.