Complaints Watch Issue No. 24

4%  (56 cases, ▼35% yoy) 4.965 Complaints Watch is published half-yearly by the Enforcement Divisions of the Hong Kong Monetary Authority (“HKMA”). It highlights the latest complaint trends, emerging topical issues, and areas that Authorized Institutions (“AIs”) and members of the public should be alert to. By publishing Complaints Watch, the HKMA aims to promote proper standards of conduct and prudent business practices among AIs and to increase public awareness of information about products and services offered by AIs. Complaint Statistics Progress in HKMA handling of banking complaints

Jul – Dec 2023 General banking services Received during the period Completed during the period Conduct-related issues 1,401 149 1,418 145 Total 1,5501 1,563 Table 1 COMPLAINTS WATCH Issue No. 23 | 2 February 2024 1 The HKMA received 1,201 fraud-related banking complaints in 2023, compared with 555 cases for 2022. Types of banking complaints received in Jul – Dec 2023 Lending business/decisions Others Credit cards Provision of banking services Mis-selling Client agreement issues Service quality Remittance services or fund transfer disputes Chart 1 4% 5% 6% 7% 10% 11% 9% 26% 22% (77 cases, ▼24%) (96 cases, ▼27%) (108 cases, ▲44%) (158 cases, ▼46%) (175 cases, ▼37%) (138 cases, ▼3%) (400 cases, ▲16%) (343 cases, ▲3%) Fees and charges (55 cases, ▼47%) Note: Unless otherwise specified, amount and percentage changes are measured on a yoy basis. Hong Kong Monetary Authority Complaints Watch 1

E-communication with customers As technology advances, communication with bank customers has moved away from traditional paper-based notifications. While e-communication (such as email, short message service (SMS) or other push notifications) can bring benefits to both AIs and their customers in terms of speed and convenience, AIs also face challenges, including security of message delivery and adequate disclosure. From some recent complaint cases handled by the HKMA, we observe that notification emails sent by an AI bore identical and generic subject headings for all types of notification messages, including monthly account statements, transaction records and corporate action notices requiring customers’ special attention or action. Although the specific document was attached in the email body, customers did not instantly know what type of information was being provided to them from the email subject headings. As a result, some customers missed the important messages which required their immediate attention or response, e.g. the response deadline on corporate actions. In the spirit of treating customers fairly, it is important for AIs to provide clear and transparent disclosure and communicate effectively with customers. In this regard, AIs are advised to review their notification arrangements to ensure they adequately draw customers’ attention to important messages, while ensuring customers’ data privacy is adequately protected. Good industry practices observed include: • providing distinct email subject headings to differentiate various types of notifications; • sending reminders on important messages which require customers to respond before a due date; and • using secure channels to deliver important messages (such as sending push notifications via AIs’ applications). Customers should pay attention to AIs’ notifications as these are important sources of information enabling customers to check bank account operations, stay informed about important updates and take any necessary actions. Hong Kong Monetary Authority Complaints Watch 2

Reporting of conduct incidents Prompt self-reporting of material incidents by banks enables the relevant authorities to take appropriate follow-up actions to contain the harm caused by such incidents, thus contributing to public confidence in the use of financial services and trust in the banking system. While banks generally have policies and procedures for incident handling, from the self-reports to the HKMA we noted inadequate understanding by some banks of the reporting thresholds of other relevant regulatory or law enforcement authorities. Some relevant insights are shared below. Case 1 A bank identified possible fabrication of documents and suspected forgery of signatures in the referral bonus claim forms submitted by a few staff members. While the bank found the original and fabricated documents, in the bank’s interview the purported signers denied having signed the forms. The bank initially did not report the incident to the law enforcement authority considering that there was insufficient evidence to prove the signatures were forged and that no direct detriment was caused to the bank or its customers. Case 2 A bank offered an employee discounted corporate rates for services (which were transferable) provided by some external parties. A staff member booked the services at corporate rates multiple times within a few months and was suspected to have exploited this benefit for financial gain, in violation of the bank’s requirement. The bank initially did not report this suspected fraud to the law enforcement authority on the grounds that it was unable to ascertain and quantify the staff member’s financial gains. Case 3 Upon following up a customer complaint, a bank found that the customer and a few staff members had been harassed by an external party after a staff member’s unauthorised disclosure of their contact information. The bank initially did not report the incident to the Office of the Privacy Commissioner for Personal Data as the bank considered it not significant. Banks are reminded that after becoming aware of incidents with potentially significant impact on its business, customers or reputation, a bank should promptly report the incidents to the HKMA and, depending on the nature of the incidents, other relevant regulatory or law enforcement authorities. Examples include matters which may involve illegal activities, or staff misconduct that may adversely impact the bank’s reputation. In this connection, banks should ensure that their responsible teams understand the applicable reporting thresholds and follow the guidance of relevant regulatory authorities. The HKMA will further facilitate the banking industry to engage with relevant authorities and develop joint public-private initiatives to promote integrity in the banking sector and protect banks and their customers from actual or potential harm caused by financial crime, corruption, or compromise of personal data. We will announce further details in due course. 2 Paragraph 3.8.3 of module CG-3 “Code of Conduct” of the HKMA Supervisory Policy Manual Report Hong Kong Monetary Authority Complaints Watch 3

Robotic Process Automation (“RPA”) RPA allows our staff to configure computer software or a “robot” that sits on top of existing systems and interprets existing applications to perform tasks normally performed by a human, using rule-based processes. RPA can free up staff from excessive volumes of repetitive duties, such as complaint registration and data validation, and enable colleagues to perform more intellectually stimulating and meaningful work, fostering professional growth and development. Comments and feedback on Complaints Watch are welcome. Please email them to bankcomplaints@hkma.gov.hk. Tips for Banks’ Complaint Handling: Use of Data and Technology AIs are encouraged to adopt innovative technology to enhance the efficiency and effectiveness of their handling and resolution of customer complaints on banking products and services. The Enforcement Divisions of the HKMA have recently adopted new technological tools to support the automatic transcription and analysis of audio recordings in the course of complaint handling and investigation. We would like to share our positive experience. With the integration of the above technologies in our complaint handling and investigation, the average complaint handling time in 2023 has been improved by 8%. We are now better able to achieve 100% performance rate in meeting our pledges to respond to complainants in time. Looking ahead, the HKMA will make further use of Suptech tools, including data analytics, to develop a more advanced, efficient and robust system to process and keep track on complaints/ enquiries that we receive and handle. Through this experience sharing, we also encourage AIs to make greater use of data and technology to optimise resources in regulatory compliance and complaint handling. Speech to Text (“StT”) StT utilizes artificial intelligence and machine learning algorithms to convert spoken words into written text accurately and efficiently. By using automatic speech recognition technology, it transcribes audio recordings into textual form, capturing word, phrase and sentence with remarkable precision. It also incorporates natural language processing and advanced data analysis techniques to identify patterns, sentiments and key themes present in the content, which can facilitate the detection of mis-selling or misconduct behaviours. Hong Kong Monetary Authority Complaints Watch 4