Enhancing Customer Empowerment in Anti-Fraud-and-Scam Protection through Money Safe and Disabling Internet Banking

55th Floor, Two International Finance Centre, 香 港 中 環 金 融 街 8 號 國 際 金 融 中 心 2 期 55 樓 8 Finance Street, Central, Hong Kong 網 址：www.hkma.gov.hk Website: www.hkma.gov.hk Our Ref. : B1/15C B9/67C 3 December 2024 The Chief Executive All Authorized Institutions Dear Sir/Madam, Enhancing Customer Empowerment in Anti-Fraud-and-Scam Protection through “Money Safe” Protection and Option of Disabling Internet Banking Platforms In view of the surge in fraud and scam cases in recent years with customer losses typically involving payments from customers’ bank accounts, the Hong Kong Monetary Authority (HKMA) considers that customers should be empowered to better protect their funds in bank accounts. Following consultation with the banking industry, the HKMA sets out in this circular the arrangements for introducing an extra layer of security to customers’ funds in bank accounts, namely “Money Safe” (MS). MS enables customers to protect a portion of their bank deposits from any fund outflows. Customers may choose to release MS protection for transactions after Authorized Institutions (AIs) have undertaken verification process with the customers. AIs should provide MS protection to retail banking individual customers and the requirements are set out in Annex. AIs should also consider offering MS or similar protection to other individual customers (e.g. private banking customers), based on the needs of such customers. In addition, there are from time to time fraud and scam cases involving customers being manipulated to set up Internet banking platforms (i.e. Internet banking and mobile banking) for their bank accounts which are then misused and result in customer losses. As a measure that complements MS in empowering customers to reduce such risk, AIs should provide customers the option of disabling the setting

• 2 -
  up of Internet banking platforms for their accounts, the choice of which can only be changed through verification process with the customers similar to that for releasing MS protection. By definition, this measure does not apply to digital banks. In the meantime, the HKMA is also exploring with the industry to further empower customers to deactivate online registration of third-party payees and online increase of fund transfer limit at Internet banking platforms. All retail banks (including digital banks) are expected to introduce MS protection to retail banking individual customers as soon as practicable preferably by 30 September 2025 and in any case no later than 31 December 2025. AIs are encouraged to consider launching MS in phases and implementing measures similar to MS to support customers to protect their funds before full implementation of MS. All retail banks (excluding digital banks) are expected to introduce the option of disabling the setting up of Internet banking platforms for customer accounts as soon as practicable preferably by 30 June 2025, and individual banks with genuine difficulties in meeting the timeline may discuss with us. Should you have any questions regarding this circular, please send them to consumerprotection@hkma.iclnet.hk. Yours faithfully, c.c.: The Chairman, The Hong Kong Association of Banks The Chairman, The DTC Association The Chairman, Private Wealth Management Association Secretary for Financial Services and the Treasury (Attn: Mr Justin To)

---

Annex
Requirements on “Money Safe” Protection
“Money Safe” (MS) enables customers to segregate a portion of their deposits maintained at Authorized Institutions (AIs) and protect it from fund outflows. Once the customers segregate an amount to be protected under MS, customers may release the MS protected funds for transactions (e.g. fund transfers, withdrawal, etc.) after the AIs concerned have undertaken verification process with the customers. Coverage

1. AIs should provide MS to retail banking individual customers. AIs should
   also consider offering MS or similar protection to other individual customers (e.g. private banking customers), based on the needs of such customers.
2. MS protection applies to deposit accounts which should, at a minimum,
   include current accounts, savings accounts and time deposit accounts in Hong Kong Dollar and major non-local currencies 1 .

Protection and Use by Customers
3. Use of MS should be voluntary at the discretion of customers. Customers
should determine the amount of funds to be protected under MS, subject to any minimum threshold that individual AIs may determine having regard to their operation needs. Where a minimum threshold is set by AIs, the AIs should ensure that the intended protection to customers under MS would not be undermined by the level of the threshold. For reference, most AIs regard HK$10,000 or its equivalent as an appropriate level to be considered if a minimum threshold is to be adopted.
4. In order to facilitate customers to make use of MS to protect themselves, AIs
should provide convenient channels for customers to get access to MS, including segregating deposits for MS protection and increasing amount of deposits segregated for MS protection. The channels should include at least,

1
Reference may be made to the non-local currencies specified in the HKMA Return of Foreign Currency Position – Form MA(BS)6, i.e. USD, GBP, JPY, EUR, CNY, CAD, CHF, AUD, SGD and NZD.

• 2 -
  but not limited to, bank branches and Internet banking platforms 2 unless not applicable.

5. Once customers segregate an amount to be protected under MS, AIs should
   not process fund outflows from the MS protected funds via any channels through any types of transactions, for example, withdrawals, fund transfers, direct debit authorization and standing instruction related transactions, loan and card repayment, bank fees and charges, etc, before completing the release of protection process as specified below.
6. AIs should effect MS protection on deposits as soon as practicable, and in
   any case not later than 3 working days, upon receiving customers’ instructions on the use of MS. AIs should also strive towards shortening the time for effecting MS protection to 1 working day or even the same day going forward.
7. Where time deposits under MS protection become matured, it is natural that
   the customers expect the matured amount continues to be protected by MS. In this respect, AIs should take steps to continue to segregate the matured amount as under MS protection, unless the customers take actions to release the MS protection. Some examples for achieving continued MS protection include automatic extension of MS protection to renewal of time deposits, actively seeking customers’ instruction to apply MS protection to funds released from matured time deposits, etc.
8. AIs may determine their own approaches to operate MS protection, for
   example, creating separate bank accounts for customers, or setting aside the segregated amount in existing accounts of customers, or earmarking the available balance of customer accounts that is not subject to MS protection, etc. For the avoidance of doubt, MS protected funds should continue to be eligible for interest and other relevant benefits that the customers are entitled to if they do not use MS. Release of Protection
9. Customers may choose to release any segregated amount of deposits from
   MS protection. Upon release of MS protection, fund outflows from the MS protected amount will no longer be disallowed. It is thus important that AIs should undertake a stringent anti-fraud-and-scam focused verification process that is directed to support customers to identify suspicious

2
Internet banking platforms refer to banks’ platforms which deliver financial services over the Internet to customers’ devices, including personal computers and mobile devices.

• 3 -
  circumstances before an MS protection is released. The verification process should include, among others, face-to-face communication 3 between bank staff and the customers with appropriate probing into the circumstances of the release through channels which can effectively achieve the purpose. Taking into account the current situation of frauds and scams, physical presence of the customers at bank branches is the most appropriate channel for releasing MS protection. 10.AIs should have proper procedures for handling any suspicious cases identified during the verification process, for example, alerting the customers or seeking appropriate advice and assistance from the Police. 11.AIs should handle customer requests for release of MS protection without undue delay, and in any case not later than 3 working days. 12.For the avoidance of doubt, any reduction in the amount under MS protection and early uplift of time deposits under MS protection should be handled following the process specified under this section on “Release of Protection”. 13.Where handling of release of MS at bank branches is not practicable (e.g. for digital banks which do not have any physical branch), AIs should adopt similarly effective measures to achieve the intended purpose (e.g. other forms of visual communication between bank staff and the customers supplemented by additional verification measures to address any risk of visual communication without physical presence) as an interim measure, with a view to setting up face-to-face verification channels at a later stage. Customer Communications and Notification 14.In view of the nature of MS, it is important for customers to have a clear understanding of the protection, in particular that fund outflows from the MS protected funds will not be processed before completion of the stringent process for release of MS protection, which is designed for protecting the customers. Hence, when customers use MS, AIs should ensure that the features, operations and release process and channels of MS should be fully and clearly explained to the customers. AIs should specifically remind customers to maintain sufficient funds for meeting daily and other ad hoc needs.

3
For the avoidance of doubt, face-to-face communication requires physical presence.

• 4 -
  15.When customers request to release MS protection, in addition to meeting the requirements under the section on “Release of Protection” above, AIs should also ensure that the implications of a release of MS protection is adequately and clearly explained to the customers. 16.AIs should provide proper notifications to facilitate customers to have adequate knowledge of the status of MS protection. AIs should, at a minimum, provide written notifications 4 to customers through effective means when (i) an MS application is effective, (ii) an MS release request is received, and (iii) an MS release request is effective. To enhance customer experience, AIs are also encouraged to inform customers of the funds under MS protection periodically. Customer Awareness 17.Customers play a fundamental role in staying vigilant and taking precautions against frauds and scams. AIs should take proactive measures to raise customer awareness and understanding of MS protection, particularly for vulnerable segments like elderly and students, with a view to encouraging customers to use MS to protect themselves. 18.The industry should also organise collaborative promotion programme to increase public awareness of MS protection.

4
Written notifications can be provided in a non-paper based format or in hard copy printed form.