Engagement of Intermediaries by Authorized Institutions

Our Ref.: B1/15C B9/67C 30 November 2016 The Chief Executive All Authorized Institutions Dear Sir/Madam, Engagement of Intermediaries by Authorized Institutions (AIs) Following our circular of 7 August 2015, I am writing to provide further guidance on AIs’ engagement of intermediaries having regard to the progress and recent developments. It is noted that AIs had already ceased the use of intermediaries for the purpose of sourcing retail consumer financial products or services, such as personal loans, tax loans and credit cards. In addition, all retail banks have provided customer hotlines to facilitate the public in verifying the identity of callers as genuinely from banks or not1 . The Hong Kong Monetary Authority (HKMA) has also set up a dedicated page on the website of the HKMA and launched a public education campaign to remind the public to stay alert of bogus phone calls purportedly from banks2 . All these measures have helped enhance protection of the interests of bank customers and reduce the potential risks to the reputation of the banking industry arising from possible malpractices by fraudulent lending intermediaries. In particular, retail banks’ hotlines have been widely and effectively used by the public to verify callers’ identity, with around 2,400 to 3,400 of such enquiries received by banks’ hotlines each month. It is however noted that around one-third of the enquiries involved suspected bogus calls3 , suggesting that the risk of bank customers falling prey to fraudsters impersonating bank staff remains high. Besides, we note there are still cases reported to the Police where members of the public were induced by intermediaries, through fraudulent practices, to engage them for arranging loans with

1 List of banks’ hotlines can be found on the websites of the Hong Kong Monetary Authority, the Hong Kong Association of Banks and individual retail banks. 2 It includes broadcasting of an Announcement of Public Interest on TV and radios, print advertisement and education drama. Relevant materials are accessible on the HKMA website (http://www.hkma.gov.hk/eng/other-information/bogus-phone-calls.shtml). 3 Approximately another one-third of the enquiries were confirmed to be genuine calls from banks. The remainder could not be verified due to insufficient information provided by the enquirers.

• 2 - financial institutions. In light of the developments, and having discussed with the banking industry, we have set out several measures to further enhance customer protection as well as address potential reputation risks to AIs in the loan application processes for retail customers and small and medium-sized enterprises (SMEs). The new measures require AIs to proceed with a loan application referred by a third party only if it is appointed by the AI concerned, and that the prospective borrowers are not charged any loan-related fees by that third party in general. AIs are also expected to join efforts in educating the public about responsible borrowing. Details of the measures can be found in Annex 1. AIs should implement these measures as soon as practicable and no later than 31 March 20174 . A phased approach for full implementation is acceptable where it can be justified, and AIs are also reminded to enhance staff capacity and training as appropriate. I would also like to take this opportunity to remind AIs to ensure compliance with the Personal Data (Privacy) Ordinance and relevant codes of practice or guidance issued by the Office of the Privacy Commissioner for Personal Data when handling customers’ personal data, for example, when using personal data collected and disclosed by the appointed third parties. AIs are also reminded to follow the requirements as set out in the Code of Banking Practice including, for example, that AIs should endeavour to ensure that the prospective borrower understands the principal terms and conditions of any borrowing arrangement, in particular those related to the rate of interest, terms of repayment, and consequences of default. Feedback from recent reviews by AIs on customer data protection As was also required in our circular of 7 August 2015, all AIs have undertaken reviews regarding their systems of control on sales agents and sales/marketing staff in relation to customer data protection. I would like to share some key observations and practices that we have noted in the reviews. Our supervisory experience revealed that whilst AIs in general had put in place policies and procedures to protect customer information, some issues and good practices identified warrant further attention by AIs. Details are set out in Annex 2. In respect of the control weaknesses mentioned, the AIs concerned have been required to undertake remedial and follow-up actions. AIs should review from time to time their policies and procedures, and promptly implement necessary enhancement measures and strengthen staff training where necessary, referring to the practical examples as set out in Annex 2. If you have any questions relating to this circular, please contact Mr Dennis Lau at 2878-8288 or Ms Joey Chan at 2878-1216.

4 For avoidance of doubt, these measures are also applicable to AIs’ subsidiaries except for those which have obtained money lenders licences under the Money Lenders Ordinance.

• 3 - Yours faithfully, Carmen Chu Executive Director (Banking Conduct) Encl. c.c. Ms Doris Ma, Secretary, The Hong Kong Association of Banks Mr Pui-Chong Lund, Association Secretary, The DTC Association