Circular Issued by the Securities and Futures Commission on Guarding against Risk of Client Asset Misappropriation

Our Ref: B1/15C
G16/1C

5 February 2013
The Chief Executive
All Registered Institutions
Dear Sir / Madam,
Circular Issued by the Securities and Futures Commission (SFC) on Guarding against Risk of Client Asset Misappropriation I am writing to draw your attention to the attached circular issued by the SFC, which reminds licensed corporations to put in place internal controls to protect their operations and their clients from financial loss arising from theft, fraud, and other dishonest acts. The circular also highlights some control areas that warrant special attention. Registered Institutions should stay vigilant in the supervision of their operations and personnel in order to guard against the risk of misappropriation of client assets, and ensure compliance with the standards as set out in the SFC’s circular. Yours faithfully, Meena Datwani Executive Director (Banking Conduct) Encl. c.c. Securities and Futures Commission (Attn: Mr Stephen Po, Senior Director of Intermediaries Supervision)

---

Circular
Tel: (852) 2231 1222 Fax: (852) 2523 4598 Website: www.sfc.hk 1 February 2013 Circular to Licensed Corporations Guarding against Risk of Client Asset Misappropriation The SFC would like to urge licensed corporations to stay vigilant in the supervision of their operations and personnel in order to guard against the risk of misappropriation of client assets. The SFC has reminded licensed corporations in previous circulars 1 about the importance of fraud prevention and drew to their attention circumstances which might facilitate misappropriation of client assets by unscrupulous employees and the need to put in place comprehensive internal control systems and exercise close management supervision. However, failures in management supervision and internal control procedures were still noted in some complaint cases involving unauthorized use of client accounts or misappropriation of client assets. Licensed corporations are reminded that they must put in place internal controls to protect their operations and their clients from financial loss arising from theft, fraud, and other dishonest acts. In particular, senior management of licensed corporations should:
 implement effective policies and procedures to prevent and detect potential fraud (such as the existence of more than one set of books and records, and client statements) as early as possible;  diligently supervise the firm’s operations including exercising adequate supervision over all front office and back office functions;  ensure that trading activities and other movements in client accounts are subject to regular review, with emphasis on high risk accounts such as discretionary client accounts, highly active accounts, dormant accounts which suddenly become active, and staff accounts and staff-related accounts; and  strictly enforce segregation of duties between front office, middle office and back office functions and ensure that proper checks and balances are exercised over the handling and recording of client assets and reconciliation of client asset records; where complete segregation of duties is not feasible in respect of a function, management must put in place adequate review procedures over the operation of such function with a view to identifying any error, abuse and fraud. We also remind licensed corporations to pay special attention to the following control areas, as failures in these areas may provide a hotbed for frauds on client accounts:
 establish controls over generation and dispatch of client statements and contract notes and ensure client statements and contract notes are centrally handled and delivered to clients promptly and directly, free from the risk of tampering or interception by unauthorized staff, and take risk mitigation measures for undelivered client statements and contract notes;

1 Please see our Circulars titled “Circular to All Licensed Corporations on Information Technology Management” issued on 16 March 2010, “Circular to All Licensed Corporations Licensed for Dealing in Securities – Continuous and Close Supervision of Firm’s Operations” issued on 8 March 2006 and “Circular to All Securities Dealers - Segregation of Duties” issued on 22 July 2002.

2
Tel: (852) 2231 1222 Fax: (852) 2523 4598 Website: www.sfc.hk  establish controls to ensure records of client address in the central database are accurate, up-to-date and secured;  implement proper safeguard to prevent unauthorized use of blank client statements and contract notes to minimize the risk of falsification of trading documents;  impose proper controls over “hold mail” arrangements to ensure the requests for “hold mail” are supported by written client authorisation and timely delivery of the hold mails to the clients concerned;  confirm stock holding and cash balances directly with clients on a sample basis by independent staff who are not usually involved in maintaining client asset records;  when conducting a client circularization exercise, verify stock holding and cash balances in the client statements against the firm’s internal records and reconcile the internal records with the external custodian statements;  regularly check client telephone orders against telephone recordings and conduct further enquiry if no tape record or other audit trails of client order could be found on orders purportedly placed by clients;  verify unusual or suspicious instructions/ transactions against telephone recordings or with the client directly;  conduct diligent enquiry and review and seek proper written client authorisation when handling receipt/ issuance of third party cheques and transfers of client assets between client accounts or to third party accounts;  remind clients to contact the firm’s complaint officer or senior management instead of their account executives should any complaint or dispute on any transaction in their accounts arise, follow up client complaints promptly by an independent staff and immediately report irregularities or suspicions to senior management; and  enforce physical access controls and information system security controls to prevent and detect unauthorized access to/ alterations of computer databases and circumvention of computer controls (such as log-in and amendment histories). Should you have any queries regarding the contents of this circular, please contact Ms Madonna Yip at 2231 1618. Intermediaries Supervision Department Securities and Futures Commission End SFO/IS/001/2013