Engagement of Intermediaries and Sales Agents by Authorized Institutions

1 Our Ref: B1/15C & B9/67C 7 August 2015 The Chief Executive All Authorized Institutions Dear Sir/Madam, Engagement of Intermediaries and Sales Agents by Authorized Institutions (AIs)

1. As you are aware, there has been an increasing number of incidents or complaints by the public recently alleging that improper or even fraudulent practices have been adopted in the marketing of consumer finance or loans by persons or entities claiming to be “intermediaries” or “representatives” associated with banks. In some cases, the complainants claim that these intermediaries seemed to have in possession of some personal information of their bank loans. In view of these developments and having discussed with the Hong Kong Association of Banks (HKAB), I write to advise AIs of the following guidance and new measures in order to further enhance the protection of the interests of bank customers and to reduce the potential risks to the reputation of the banking industry arising from possible malpractices by external parties engaging in the marketing of financial products or services: (a) AIs should cease, as soon as practicable, the use of intermediaries for the purpose of sourcing retail consumer financial products or services, such as personal loans, tax loans and credit cards. This requirement, however, does not apply to the engagement of intermediaries in respect of collateralised lending such as mortgages, taxi, public light bus, machinery loans, hire purchase agreements as well as corporate business finance.1

Unlike intermediaries sourcing retail consumer loans, which are uncollateralised and in practice contribute only a very small part of new

1 Provided that AIs should ensure, as a minimum, all customers referred by their engaged intermediaries are sourced in a lawful and fair manner and any customer data passed to the intermediaries or obtained by them in their capacity as intermediaries are properly safeguarded in accordance with the Personal Data (Privacy) Ordinance and the relevant HKMA circulars on customer data protection.

2 lending business for AIs, the latter category of intermediaries have a well-established and effective mechanism for the referral of customers to AIs. (b) AIs that engage external parties as Sales Agents, whether through telemarketing or some other forms, should undertake a review on their system of controls to ensure that they are robust and effective in according a high degree of protection to the personal data of bank customers. Unlike intermediaries, Sales Agents are authorised agents or representatives of AIs and would in most cases have access to personal account information in order to perform their duties on behalf of the AIs. However, it is essential that there is in place an appropriately robust system that effectively controls and monitors the access, use and retention of such information by staff members of the Sales Agents. Given the recent increase in allegations about possible leakage or misuse of personal information of bank customers, a critical review by AIs on the use of Sales Agents as well as the sales and marketing staff of AIs will be timely and a report of the review should be completed, in phases, in four months’ time. 2. AIs should take note of the recent public concern about reported malpractices of intermediaries. While some of the cases are still being followed up and there is no evidence so far to substantiate the allegations, AIs should bear in mind that the risk of potential malpractices, including potential data leakage, cannot be ruled out. The risk would be higher in particular where AIs engage institutions in soliciting businesses. In order to further enhance the protection of bank customers, the HKMA has decided to require AIs to take the actions as stated in paragraph 1(a) above. The HKMA further reminds AIs to stay vigilant and adhere strictly to all relevant guidance 2 , and promptly report any suspected fraud cases to the enforcement agencies for appropriate follow-up and investigation work. 3. Furthermore, as mentioned in paragraph 1(b), as a pre-emptive move to address potential risks, AIs are required to commission a critical review regarding the control measures that have been put in place to ensure that customer data passed to these Sales Agents or obtained by them during the product selling process are properly safeguarded in accordance with the Personal Data (Privacy) Ordinance

2 These include but are not limited to the Personal Data (Privacy) Ordinance, Module SA-2 of the HKMA Supervisory Policy Manual (SPM) on Outsourcing, Module IC-4 of the HKMA SPM on Complaint Handling Procedures, Code of Practice on Person-to-Person Marketing Calls, HKMA Circular dated 20 August 2014 on Engagement of External Business Referral Service Providers, and the relevant HKMA circulars on customer data protection.

3 and the relevant HKMA circulars on customer data protection. Under the overarching objectives of bank consumer protection and treating customers fairly, the reviews are expected to cover, among others, AIs’ control measures and due diligence in the selection of Sales Agents, ongoing monitoring of conduct and product selling processes including data security controls, and complaint handling mechanisms. AIs are reminded that they remain accountable to customers for any misconduct on the part of the Sales Agents that they engage. 4. The reviews on AIs’ engagement of Sales Agents should be completed as soon as possible. Given that the recently publicized cases covered allegations mostly related to telemarketing agents, as a matter of priority, the reviews in relation to AIs’ engagement of telemarketing agents are required to be completed and results submitted to the HKMA no later than one month from the date of this circular (i.e. 7 September). As for other types of Sales Agents, the review results are required to be submitted to the HKMA no later than two months from the date of this circular (i.e. 7 October). In the third stage, it is also necessary to extend the scope of the reviews to cover the sales and marketing staff of AIs, and the results are required to be submitted to the HKMA no later than four months from the date of this circular (i.e. 7 December). Where the reviews are not conducted by the internal auditors, each of the above reviews is required to be reviewed and endorsed by the internal auditors by 7 December 2015. Please submit the independent review results to your usual contacts at the Banking Conduct Department. 5. Where the reviews on AIs’ controls over Sales Agents and sales/marketing staff reveal any necessary areas for improvement, AIs should implement appropriate measures promptly to strengthen the controls. 6. If there are any questions about this circular, please contact Ms Yvonne Chan at 2878-1452 or Mr Larry Leung at 2878-1004. Yours faithfully, Arthur K.H. Yuen Deputy Chief Executive