Feedback from recent reviews of the selling of investment products

Our Ref: B1/15C
G16/1C
8 April 2016
The Chief Executive
All Authorized Institutions
Dear Sir / Madam,
Feedback from recent reviews of the selling of investment products I am writing to share some key observations and practices that we have identified in the course of our supervisory work in relation to Authorized Institutions’ (AIs’) selling of investment products. Our recent supervisory experience revealed that whilst AIs in general had put in place policies and procedures to govern business conduct in the selling of investment products, some issues and good practices identified warrant further attention by AIs. Details are set out in the Annex. In respect of the control weaknesses mentioned, the AIs concerned have been required to undertake remedial actions. Cases of potential breaches of regulatory requirements are subject to further inquiry and follow-up. Senior management of AIs have the responsibility to ensure that adequate systems and controls are in place. Meanwhile, all relevant functions of the institution, from the board to frontline staff, should understand their respective roles and contribute accordingly to effective implementation. AIs should review from time to time how their policies, procedures and controls measure up against the prevailing regulatory standards, and promptly implement enhancement measures and strengthen staff training where necessary, referring to the practical examples as set out in the Annex. AIs are also encouraged to adopt the good practices where appropriate. The HKMA will continue to monitor AIs’ selling practices in respect of investment products and to follow up with individual AIs and provide feedback to the industry as appropriate. If you have any questions on this circular, please contact Ms Anita Chan at 2878-1538 or Ms Florence To at 2878-1582. Yours faithfully, Carmen Chu Executive Director (Banking Conduct) Encl. c.c. SFC (Attn: Mr James Shipton, Executive Director (Intermediaries))

Annex

• 1 -
  Key Observations and Practices Noted in Recent Reviews

1. Product due diligence (PDD)
   1.1 The product risk rating methodology of some AIs did not appear to have given
   due consideration to some key features and risks of certain investment products, and there were instances of assigning product risk rating without proper justification. For examples:
   (a) assigned considerably lower risk ratings to high-yield bond funds as compared with those of high-yield bonds; (b) merely made reference to the trading spreads in assigning product risk ratings for unrated bonds; (c) an AI assigned a product risk rating of “moderate risk” (“2” out of 4 product risk levels) to a fund which was rated “7”, the highest risk rating, by the product issuer, without conducting further due diligence work or verification with the product issuer to justify why its own product risk rating was significantly lower.
   1.2 A number of AIs did not consider some relevant factors during the on-going
   PDD review, even though these factors were taken into account in the initial PDD and might change over time. Examples include factors related to product issuers, such as their experience, reputation and financial soundness.
   1.3 Sole reliance was sometimes placed on fund issuers for classifying whether a
   fund is a derivative product for the purpose of the SFC’s Code of Conduct1 , without seeking clarification from the fund issuers on apparently contradictory information in the product documents. Regulatory standards AIs should develop a thorough understanding of the investment products they solicit or recommend to customers; adopt a reasonable mechanism for assessing and assigning product risk rating; and maintain adequate documentation of the PDD work undertaken. All relevant factors that may affect customers in making informed investment decision, such as the experience, reputation and financial soundness of the 1 Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (SFC)

Annex

• 2 -
  product issuer, should be taken into account in both initial PDD and on-going PDD reviews. AIs should also take prompt actions to ensure compliance with the guidance issued by the HKMA from time to time concerning specific investment products. For instance, in respect of high-yield bond funds, assigning lower product risk ratings to such funds than those of high-yield bonds should be properly justified, as stated in the HKMA’s circular “Product Risk Rating of High Yield Bonds and Related Products” of 9 August 2013. In determining whether a fund is a derivative product, AIs should, where appropriate, seek written explanations from the product issuer of the rationale for the classification2 . Any inconsistent information noted should be resolved properly.

2. Know-Your-Customer (KYC) process and customer risk profiling
   2.1 When assessing whether a customer should be treated as having derivative
   knowledge, some AIs merely requested the customer to make declaration without raising any follow-up enquiries as needed.
   2.2 For regular review of customer risk profiling via written confirmation, some AIs
   used negative confirmation or only recapped the customer’s current risk profile rating without providing a full set of previously completed questionnaires to the customer for review.
   2.3 Some AIs constantly had a relatively high proportion of customers (including
   vulnerable customers) assigned high or medium-to-high risk tolerance levels. However, no assessment was performed to identify any pitfall in the risk profiling mechanism and practices and ensure continued appropriateness. Good practices Some AIs adopted good practice of reviewing regularly the risk profiling mechanism and result statistics to assess the continued appropriateness of the risk profiling mechanism. In case of high proportion of customers assessed to have high or medium-to-high risk tolerance levels, review was carried out by an independent unit to ascertain whether there could be any undue influence by sales staff in the risk profiling process. Examples of reviews include sample checks of documentation and 2 SFC’s circular “Guidance to Licensed Corporations and Registered Institutions In relation to Derivative Products under the Code of Conduct” of 23 April 2012

Annex

• 3 -
  audio records of the risk profiling process, and mystery shopping to test check the risk profiling practices. Regulatory standards AIs are expected to take all reasonable steps to obtain relevant information from customers about their personal circumstances. In assessing whether a customer has knowledge of derivatives, AIs should make appropriate enquiries of or gather relevant information about the customer during the KYC process and make their own assessment instead of relying merely on the customer’s declaration3 . AIs should adopt adequate systems and controls to conduct a reasonable assessment of customer’s risk tolerance. While the HKMA in principle has no objection for AIs to conduct regular reviews of customer risk profile via written confirmation, AIs should ensure their practices are reasonable and fair to customers. Proper practices include providing the whole set of the current customer risk profiling questionnaire (with the customer’s answer to each question) to the customer for review, and seeking the customer to positively confirm whether there is any change to the customer risk profile. Should there be any material change to the questionnaire or the customer’s risk profile, a proper customer risk profiling assessment should be done instead.

3. Suitability assessment and selling practices
   3.1 Some AIs assessed customers’ concentration risk in one dimension only, e.g.
   same investment amount threshold irrespective of product type, product risk rating, issuer, or customer’s risk tolerance level etc. On the other hand, a number of AIs relied solely on customers’ declaration that the intended investment would not result in concentration issue. They did not make further enquiry with the customer even when there seemed possible concern about concentration risk as suggested by other information available to the AI.
   3.2 Some deficiencies of a few AIs in selling foreign exchange (FX) accumulators
   to corporate customers for hedging were noted. These few AIs did not have adequate policies, procedures and controls for assessing customers’ hedging need, but simply adopted the credit limit granted for accumulator transactions as the amount for hedging purpose, and did not assess the customers’ concentration risk. The AIs did not collect and assess some important information such as 3 SFC’s FAQ dated 3 June 2011

Annex

• 4 -
  the customer’s hedging need, anticipated cash outflow, other exposure to the currency to be hedged, and the appropriate tenor and maximum exposure of the customer to the accumulator contracts for hedging purpose.
  3.3 Some AIs contemplated to discharge the suitability obligation by merely
  considering product tenor together with other relevant factors in deriving a product risk rating, and then simply matching such product risk rating with a customer’s risk tolerance level. They did not have proper controls and procedures to ensure other relevant factors are taken into account when conducting suitability assessment.
  3.4 A number of AIs did not properly consider customer’s investment horizon in
  suitability assessment for investment funds. For example, a few AIs set out in their policy and procedures that assessment of customer’s investment horizon is not required in the context of investment funds, as investment funds have daily liquidity and there is daily dealing, although the AIs required staff to consider customer’s investment horizon in the suitability assessment for the selling of other investment products. It was also noted in some cases that the AIs could not provide proper rationale for solicitation/recommendation of some funds whose target markets were investors having a long-term investment horizon to some customers having short investment horizon.
  3.5 Some sales staff of an AI solicited/recommended customers into highly frequent
  trading of investment funds which could hardly be justified. In a number of accounts, subscriptions, redemptions and switches of funds were highly frequent with only short holding periods of one to six months, of which many involved switching between different currency classes of the same funds. The sales staff concerned did not assess the customers’ investment objective, investment horizon, and the transaction costs, as well as the investment objective of the funds, during the solicitation/recommendation. The AI needed to enhance its selling practices and strengthen its controls for handling these frequently switched transactions in order to ensure the sales staff conduct proper suitability assessment and avoid conflicts of interest with customers (when they cannot be avoided, the AI should ensure that customers are fairly treated).
  3.6 Some sales staff treated transactions which involved
  recommendation/solicitation as “execution-only”/“unsolicited” transactions, and did not perform suitability assessment as required. For example, an AI

Annex

• 5 -
  disallowed sales staff to recommend mismatched products to customers, but permitted them to sell mismatched products under the “unsolicited” trade model without considering suitability to the customers. Despite a high proportion of “unsolicited” transactions in unlisted investment products (including structured products), the AI’s regular compliance reviews did not check for any possible abuse of such internal policy by reviewing whether these transactions were indeed initiated by customers.
  3.7 An AI asked certain customers who had frequent transactions in investment
  products to sign a document to give consent for the AI to solicit/recommend investment products without assessing suitability. The sales staff, on the basis of such document, solicited/recommended some transactions that did not appear to match the circumstances of the customers. The AI did not understand that the document signed by the customers could not exempt it from the obligations to act with due skill, care and diligence and in the best interests of customers, and ensure suitability of investment solicitation/recommendation.
  3.8 A number of AIs disclosed the highest uniform rate of monetary benefits that
  they might receive from the type of products instead of from that particular transaction.
  3.9 Some AIs did not maintain documentation about the assessment on whether a
  customer is a vulnerable customer (“VC”). Some AIs did not maintain the VC status in their systems to facilitate sales staff to carry out the selling process. Good practices Prudent approach was noted for dealing with VCs, first-time investors and mismatched transactions on the Internet banking platform. These customers were advised to approach staff at bank branches, so that proper investor protection steps (such as risk disclosure and suitability assessment) could be taken. Regulatory standards Intermediaries should ensure the suitability of an investment recommendation or solicitation for a customer is reasonable in all the circumstances4 . They should at all times exercise their professional judgement to assess diligently whether the

4 Paragraph 5.2 of the SFC’s Code of Conduct

Annex

• 6 -
  characteristics and risk exposures of each solicited/recommended investment product (including transaction costs, effect of gearing and foreign currency risks, where appropriate) are suitable for the customer and are in the best interests of the customer, taking into account all the personal circumstances (including the customer’s financial situation, investment experience, investment objectives, investment horizon, risk tolerance, etc) 5 . The HKMA does not require “mechanical matching” when AIs review each relevant factor. On the other hand, mere mechanical matching of the AI’s assigned product risk rating with the customer’s risk tolerance level as assessed by the AI may not be sufficient when providing investment advice or recommendation. Investment advice or recommendation should be based on thorough analysis of the prevailing circumstances, the product specifications and risk profile including concentration risk of the customer, and take into account available investment alternatives. For this purpose, it is important that AIs and product providers maintain two-way ongoing dialogue/communication to help ensure that the AIs are kept up-to-date on the product’s specifications and risk profile as well as the intended target market that may have been identified by the product providers. . In respect of recommendations or solicitations involving investment funds, in determining whether a fund is suitable for a customer, it should be noted that tenor mismatch may be relevant where the fund has specific tenor (e.g. guaranteed and structured funds where the issuers have provided capital guarantees and/or promised payouts to investors). Even for funds without a specific tenor, customer’s investment horizon should also be one of the relevant factors that should be considered in the suitability assessment. In this connection, AIs should duly consider, among other factors, relevant information from the product provider in the sales-related materials and through the ongoing dialogue/communication mentioned above. Assessing the right level of concentration is a necessary part of the suitability assessment. AIs should put in place reasonable methodology and threshold(s) for assessment of customer’s concentration risk. AIs may take into account relevant factors like product type and nature, product risk rating, the customer’s objectives and risk tolerance level etc. and consider setting a lower threshold for higher risk products and using cumulative basis instead of per transaction basis in calculating the concentration level. For more guidance, please refer to the HKMA’s circular “Selling of Investment Products” of 5 January 2012. 5 Question 4 of the SFC's FAQ on Suitability Obligations

Annex

• 7 -
  In respect of FX accumulators, as reiterated in our previous circulars6 , in order to ensure compliance with applicable regulatory requirements, AIs should implement proper policy, procedures and controls, provide proper staff training, and maintain proper record in respect of assessing the hedging need of customers; the amount needed to be hedged; whether the product is a proper hedging tool; and whether the maximum exposure in the FX accumulator contracts is appropriate. In performing these assessments, AIs should understand and have due regard to the customer’s circumstances, such as the amount and timing of customer’s anticipated cash-flows and other exposure in respect of the relevant currencies. For AIs which adopt “unsolicited” transactions model, they should have proper policy, procedures and controls to ensure that such model will not be abused to circumvent their internal policy and/or regulatory requirements. These include clear guidance to relevant staff, effective review mechanism to test check compliance, appropriate MIS reports for senior management and relevant control units to help identify possible abuse by sales staff, and proper follow-up actions to address issues identified. AIs should exercise professional judgement and take into account the customer’s circumstances in identifying VCs. Proper documentation should be maintained for the assessment done. AIs should regularly update customer profiles, including their VC status as appropriate. The VC status should be readily accessible to sales staff. AIs should disclose the monetary benefits that are receivable by it and/or any of its associates as a percentage ceiling of the investment amount or the dollar equivalent on that particular transaction7 .

4. Monitoring and review
   4.1 Some AIs’ compliance reviews only covered a very small fixed number of
   investment transactions which was not commensurate with their business volume. Their review frequency of high risk transactions was also inadequate.
   4.2 Reporting errors (e.g. omission and misclassification) and late submission of
   information to the HKMA were noted, indicating the need for enhancement of monitoring and MIS for drawing management attention to risk areas. 6 “Selling of Accumulators” of 22 December 2010 and “Foreign Exchange Accumulators and Non-leveraged Renminbi-Linked Deposits” of 7 March 2014 7 Paragraph 8.3 of the SFC’s Code of Conduct

Annex

• 8 -
  Regulatory standards
  AIs should put in place adequate monitoring and review mechanism to ensure compliance with applicable laws and regulations. There should be appropriate systems and controls to ensure the accuracy, completeness and timeliness of the MIS reports for senior management, as well as the information for submission to regulators. As part of the business monitoring, AIs are expected to monitor the business volume and trends, and uncover the reasons for any material variances. For new business line/unit or new product to be launched, AIs should consider any related reporting obligation(s). In case of material reporting error, the AI should identify the root cause and ensure all related errors are revealed and rectified. In respect of compliance reviews, AIs should adopt a risk-based approach in determining the scope, focus, sample size, and frequency. AIs should also ensure that any deficiencies identified are rectified within a reasonable timeframe.

5. Staff training
   5.1 The HKMA encourages registered institutions which operate as private banks or
   have dedicated private banking units (collectively “private banks”) to adopt the Enhanced Competency Framework for Private Wealth Management Practitioners (“PWM ECF”). The HKMA’s survey results revealed that while private banks in general have adopted the PWM ECF to enhance the initial competence of their Relevant Practitioners, some private banks did not take steps to support and monitor their Relevant Practitioners (in particular those who are not Certified Private Wealth Professionals (“CPWP”)) to complete 10 hours of private wealth management-related on-going professional training (“OPT”) in each calendar year as advocated under the PWM ECF. On the other hand, some private banks have taken concrete measures in this aspect, and some good practices are highlighted below:
   (a) updating internal policies and procedures to require all Relevant Practitioners (including non-CPWPs) to fulfil 10-hour OPT in each calendar year; (b) arranging relevant in-house courses; (c) providing sponsorship to staff who have completed relevant courses held by external professional training institutes;

Annex

• 9 -
  (d) keeping OPT records properly, and issuing regular progress reports for the management to review and monitor relevant staff’s fulfilment of sufficient OPT hours; highlighting and/or escalating outstanding cases at appropriate points of time before year-end to relevant parties for follow-up. Good practices Some AIs arranged staff to participate in relevant industry competitions/awards which fostered technical and compliance knowledge, ethical standards and best practices. These initiatives help provide additional means to promote staff competence and ethics apart from structured training. Regulatory standards In the Supervisory Policy Manual (“SPM”) module CG-6 “Competence and Ethical Behaviour”, the HKMA emphasizes the responsibility of an AI’s Board of Directors and senior management in ensuring staff competence and ethical behaviour, including monitoring and reviewing the knowledge, skills and performance of individual staff members; providing relevant and timely training to ensure continuing competence of staff members; and addressing any identified failings or gaps in a timely fashion. In line with the SPM CG-6, private banks are reminded that they are expected to take concrete measures to support and to monitor all Relevant Practitioners to complete not less than 10 hours of private wealth management-related OPT in each calendar year. AIs are expected to provide adequate, suitable and timely training and guidance on an on-going basis to their staff on relevant matters, such as updates of regulatory requirements and standards; issues identified from various sources; changes in internal policies, procedures and practices; and market and product developments.

---

Annex

• 1 -
  Key Observations and Practices Noted in Recent Reviews

1. Product due diligence (PDD)
   1.1 The product risk rating methodology of some AIs did not appear to have given
   due consideration to some key features and risks of certain investment products, and there were instances of assigning product risk rating without proper justification. For examples:
   (a) assigned considerably lower risk ratings to high-yield bond funds as compared with those of high-yield bonds; (b) merely made reference to the trading spreads in assigning product risk ratings for unrated bonds; (c) an AI assigned a product risk rating of “moderate risk” (“2” out of 4 product risk levels) to a fund which was rated “7”, the highest risk rating, by the product issuer, without conducting further due diligence work or verification with the product issuer to justify why its own product risk rating was significantly lower.
   1.2 A number of AIs did not consider some relevant factors during the on-going
   PDD review, even though these factors were taken into account in the initial PDD and might change over time. Examples include factors related to product issuers, such as their experience, reputation and financial soundness.
   1.3 Sole reliance was sometimes placed on fund issuers for classifying whether a
   fund is a derivative product for the purpose of the SFC’s Code of Conduct 1 , without seeking clarification from the fund issuers on apparently contradictory information in the product documents. Regulatory standards AIs should develop a thorough understanding of the investment products they solicit or recommend to customers; adopt a reasonable mechanism for assessing and assigning product risk rating; and maintain adequate documentation of the PDD work undertaken. All relevant factors that may affect customers in making informed investment decision, such as the experience, reputation and financial soundness of the

1 Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (SFC)

Annex

• 2 -
  product issuer, should be taken into account in both initial PDD and on-going PDD reviews. AIs should also take prompt actions to ensure compliance with the guidance issued by the HKMA from time to time concerning specific investment products. For instance, in respect of high-yield bond funds, assigning lower product risk ratings to such funds than those of high-yield bonds should be properly justified, as stated in the HKMA’s circular “Product Risk Rating of High Yield Bonds and Related Products” of 9 August 2013. In determining whether a fund is a derivative product, AIs should, where appropriate, seek written explanations from the product issuer of the rationale for the classification 2 . Any inconsistent information noted should be resolved properly.

2. Know-Your-Customer (KYC) process and customer risk profiling
   2.1 When assessing whether a customer should be treated as having derivative
   knowledge, some AIs merely requested the customer to make declaration without raising any follow-up enquiries as needed.
   2.2 For regular review of customer risk profiling via written confirmation, some AIs
   used negative confirmation or only recapped the customer’s current risk profile rating without providing a full set of previously completed questionnaires to the customer for review.
   2.3 Some AIs constantly had a relatively high proportion of customers (including
   vulnerable customers) assigned high or medium-to-high risk tolerance levels. However, no assessment was performed to identify any pitfall in the risk profiling mechanism and practices and ensure continued appropriateness. Good practices Some AIs adopted good practice of reviewing regularly the risk profiling mechanism and result statistics to assess the continued appropriateness of the risk profiling mechanism. In case of high proportion of customers assessed to have high or medium-to-high risk tolerance levels, review was carried out by an independent unit to ascertain whether there could be any undue influence by sales staff in the risk profiling process. Examples of reviews include sample checks of documentation and

2
SFC’s circular “Guidance to Licensed Corporations and Registered Institutions In relation to Derivative Products under the Code of Conduct” of 23 April 2012

Annex

• 3 -
  audio records of the risk profiling process, and mystery shopping to test check the risk profiling practices. Regulatory standards AIs are expected to take all reasonable steps to obtain relevant information from customers about their personal circumstances. In assessing whether a customer has knowledge of derivatives, AIs should make appropriate enquiries of or gather relevant information about the customer during the KYC process and make their own assessment instead of relying merely on the customer’s declaration 3 . AIs should adopt adequate systems and controls to conduct a reasonable assessment of customer’s risk tolerance. While the HKMA in principle has no objection for AIs to conduct regular reviews of customer risk profile via written confirmation, AIs should ensure their practices are reasonable and fair to customers. Proper practices include providing the whole set of the current customer risk profiling questionnaire (with the customer’s answer to each question) to the customer for review, and seeking the customer to positively confirm whether there is any change to the customer risk profile. Should there be any material change to the questionnaire or the customer’s risk profile, a proper customer risk profiling assessment should be done instead.

3. Suitability assessment and selling practices
   3.1 Some AIs assessed customers’ concentration risk in one dimension only, e.g.
   same investment amount threshold irrespective of product type, product risk rating, issuer, or customer’s risk tolerance level etc. On the other hand, a number of AIs relied solely on customers’ declaration that the intended investment would not result in concentration issue. They did not make further enquiry with the customer even when there seemed possible concern about concentration risk as suggested by other information available to the AI.
   3.2 Some deficiencies of a few AIs in selling foreign exchange (FX) accumulators
   to corporate customers for hedging were noted. These few AIs did not have adequate policies, procedures and controls for assessing customers’ hedging need, but simply adopted the credit limit granted for accumulator transactions as the amount for hedging purpose, and did not assess the customers’ concentration risk. The AIs did not collect and assess some important information such as

3
SFC’s FAQ dated 3 June 2011

Annex

• 4 -
  the customer’s hedging need, anticipated cash outflow, other exposure to the currency to be hedged, and the appropriate tenor and maximum exposure of the customer to the accumulator contracts for hedging purpose.
  3.3 Some AIs contemplated to discharge the suitability obligation by merely
  considering product tenor together with other relevant factors in deriving a product risk rating, and then simply matching such product risk rating with a customer’s risk tolerance level. They did not have proper controls and procedures to ensure other relevant factors are taken into account when conducting suitability assessment.
  3.4 A number of AIs did not properly consider customer’s investment horizon in
  suitability assessment for investment funds. For example, a few AIs set out in their policy and procedures that assessment of customer’s investment horizon is not required in the context of investment funds, as investment funds have daily liquidity and there is daily dealing, although the AIs required staff to consider customer’s investment horizon in the suitability assessment for the selling of other investment products. It was also noted in some cases that the AIs could not provide proper rationale for solicitation/recommendation of some funds whose target markets were investors having a long-term investment horizon to some customers having short investment horizon.
  3.5 Some sales staff of an AI solicited/recommended customers into highly frequent
  trading of investment funds which could hardly be justified. In a number of accounts, subscriptions, redemptions and switches of funds were highly frequent with only short holding periods of one to six months, of which many involved switching between different currency classes of the same funds. The sales staff concerned did not assess the customers’ investment objective, investment horizon, and the transaction costs, as well as the investment objective of the funds, during the solicitation/recommendation. The AI needed to enhance its selling practices and strengthen its controls for handling these frequently switched transactions in order to ensure the sales staff conduct proper suitability assessment and avoid conflicts of interest with customers (when they cannot be avoided, the AI should ensure that customers are fairly treated).
  3.6 Some sales staff treated transactions which involved
  recommendation/solicitation as “execution-only”/“unsolicited” transactions, and did not perform suitability assessment as required. For example, an AI

Annex

• 5 -
  disallowed sales staff to recommend mismatched products to customers, but permitted them to sell mismatched products under the “unsolicited” trade model without considering suitability to the customers. Despite a high proportion of “unsolicited” transactions in unlisted investment products (including structured products), the AI’s regular compliance reviews did not check for any possible abuse of such internal policy by reviewing whether these transactions were indeed initiated by customers.
  3.7 An AI asked certain customers who had frequent transactions in investment
  products to sign a document to give consent for the AI to solicit/recommend investment products without assessing suitability. The sales staff, on the basis of such document, solicited/recommended some transactions that did not appear to match the circumstances of the customers. The AI did not understand that the document signed by the customers could not exempt it from the obligations to act with due skill, care and diligence and in the best interests of customers, and ensure suitability of investment solicitation/recommendation.
  3.8 A number of AIs disclosed the highest uniform rate of monetary benefits that
  they might receive from the type of products instead of from that particular transaction.
  3.9 Some AIs did not maintain documentation about the assessment on whether a
  customer is a vulnerable customer (“VC”). Some AIs did not maintain the VC status in their systems to facilitate sales staff to carry out the selling process. Good practices Prudent approach was noted for dealing with VCs, first-time investors and mismatched transactions on the Internet banking platform. These customers were advised to approach staff at bank branches, so that proper investor protection steps (such as risk disclosure and suitability assessment) could be taken. Regulatory standards Intermediaries should ensure the suitability of an investment recommendation or solicitation for a customer is reasonable in all the circumstances 4 . They should at all times exercise their professional judgement to assess diligently whether the

4 Paragraph 5.2 of the SFC’s Code of Conduct

Annex

• 6 -
  characteristics and risk exposures of each solicited/recommended investment product (including transaction costs, effect of gearing and foreign currency risks, where appropriate) are suitable for the customer and are in the best interests of the customer, taking into account all the personal circumstances (including the customer’s financial situation, investment experience, investment objectives, investment horizon, risk tolerance, etc) 5 . The HKMA does not require “mechanical matching” when AIs review each relevant factor. On the other hand, mere mechanical matching of the AI’s assigned product risk rating with the customer’s risk tolerance level as assessed by the AI may not be sufficient when providing investment advice or recommendation. Investment advice or recommendation should be based on thorough analysis of the prevailing circumstances, the product specifications and risk profile including concentration risk of the customer, and take into account available investment alternatives. For this purpose, it is important that AIs and product providers maintain two-way ongoing dialogue/communication to help ensure that the AIs are kept up-to-date on the product’s specifications and risk profile as well as the intended target market that may have been identified by the product providers. . In respect of recommendations or solicitations involving investment funds, in determining whether a fund is suitable for a customer, it should be noted that tenor mismatch may be relevant where the fund has specific tenor (e.g. guaranteed and structured funds where the issuers have provided capital guarantees and/or promised payouts to investors). Even for funds without a specific tenor, customer’s investment horizon should also be one of the relevant factors that should be considered in the suitability assessment. In this connection, AIs should duly consider, among other factors, relevant information from the product provider in the sales-related materials and through the ongoing dialogue/communication mentioned above. Assessing the right level of concentration is a necessary part of the suitability assessment. AIs should put in place reasonable methodology and threshold(s) for assessment of customer’s concentration risk. AIs may take into account relevant factors like product type and nature, product risk rating, the customer’s objectives and risk tolerance level etc. and consider setting a lower threshold for higher risk products and using cumulative basis instead of per transaction basis in calculating the concentration level. For more guidance, please refer to the HKMA’s circular “Selling of Investment Products” of 5 January 2012.

5 Question 4 of the SFC's FAQ on Suitability Obligations

Annex

• 7 -
  In respect of FX accumulators, as reiterated in our previous circulars 6 , in order to ensure compliance with applicable regulatory requirements, AIs should implement proper policy, procedures and controls, provide proper staff training, and maintain proper record in respect of assessing the hedging need of customers; the amount needed to be hedged; whether the product is a proper hedging tool; and whether the maximum exposure in the FX accumulator contracts is appropriate. In performing these assessments, AIs should understand and have due regard to the customer’s circumstances, such as the amount and timing of customer’s anticipated cash-flows and other exposure in respect of the relevant currencies. For AIs which adopt “unsolicited” transactions model, they should have proper policy, procedures and controls to ensure that such model will not be abused to circumvent their internal policy and/or regulatory requirements. These include clear guidance to relevant staff, effective review mechanism to test check compliance, appropriate MIS reports for senior management and relevant control units to help identify possible abuse by sales staff, and proper follow-up actions to address issues identified. AIs should exercise professional judgement and take into account the customer’s circumstances in identifying VCs. Proper documentation should be maintained for the assessment done. AIs should regularly update customer profiles, including their VC status as appropriate. The VC status should be readily accessible to sales staff. AIs should disclose the monetary benefits that are receivable by it and/or any of its associates as a percentage ceiling of the investment amount or the dollar equivalent on that particular transaction 7 .

4. Monitoring and review
   4.1 Some AIs’ compliance reviews only covered a very small fixed number of
   investment transactions which was not commensurate with their business volume. Their review frequency of high risk transactions was also inadequate.
   4.2 Reporting errors (e.g. omission and misclassification) and late submission of
   information to the HKMA were noted, indicating the need for enhancement of monitoring and MIS for drawing management attention to risk areas.

6
“Selling of Accumulators” of 22 December 2010 and “Foreign Exchange Accumulators and Non-leveraged Renminbi-Linked Deposits” of 7 March 2014 7 Paragraph 8.3 of the SFC’s Code of Conduct

Annex

• 8 -
  Regulatory standards
  AIs should put in place adequate monitoring and review mechanism to ensure compliance with applicable laws and regulations. There should be appropriate systems and controls to ensure the accuracy, completeness and timeliness of the MIS reports for senior management, as well as the information for submission to regulators. As part of the business monitoring, AIs are expected to monitor the business volume and trends, and uncover the reasons for any material variances. For new business line/unit or new product to be launched, AIs should consider any related reporting obligation(s). In case of material reporting error, the AI should identify the root cause and ensure all related errors are revealed and rectified. In respect of compliance reviews, AIs should adopt a risk-based approach in determining the scope, focus, sample size, and frequency. AIs should also ensure that any deficiencies identified are rectified within a reasonable timeframe.

5. Staff training
   5.1 The HKMA encourages registered institutions which operate as private banks or
   have dedicated private banking units (collectively “private banks”) to adopt the Enhanced Competency Framework for Private Wealth Management Practitioners (“PWM ECF”). The HKMA’s survey results revealed that while private banks in general have adopted the PWM ECF to enhance the initial competence of their Relevant Practitioners, some private banks did not take steps to support and monitor their Relevant Practitioners (in particular those who are not Certified Private Wealth Professionals (“CPWP”)) to complete 10 hours of private wealth management-related on-going professional training (“OPT”) in each calendar year as advocated under the PWM ECF. On the other hand, some private banks have taken concrete measures in this aspect, and some good practices are highlighted below:
   (a) updating internal policies and procedures to require all Relevant Practitioners (including non-CPWPs) to fulfil 10-hour OPT in each calendar year; (b) arranging relevant in-house courses; (c) providing sponsorship to staff who have completed relevant courses held by external professional training institutes;

Annex

• 9 -
  (d) keeping OPT records properly, and issuing regular progress reports for the management to review and monitor relevant staff’s fulfilment of sufficient OPT hours; highlighting and/or escalating outstanding cases at appropriate points of time before year-end to relevant parties for follow-up. Good practices Some AIs arranged staff to participate in relevant industry competitions/awards which fostered technical and compliance knowledge, ethical standards and best practices. These initiatives help provide additional means to promote staff competence and ethics apart from structured training. Regulatory standards In the Supervisory Policy Manual (“SPM”) module CG-6 “Competence and Ethical Behaviour”, the HKMA emphasizes the responsibility of an AI’s Board of Directors and senior management in ensuring staff competence and ethical behaviour, including monitoring and reviewing the knowledge, skills and performance of individual staff members; providing relevant and timely training to ensure continuing competence of staff members; and addressing any identified failings or gaps in a timely fashion. In line with the SPM CG-6, private banks are reminded that they are expected to take concrete measures to support and to monitor all Relevant Practitioners to complete not less than 10 hours of private wealth management-related OPT in each calendar year. AIs are expected to provide adequate, suitable and timely training and guidance on an on-going basis to their staff on relevant matters, such as updates of regulatory requirements and standards; issues identified from various sources; changes in internal policies, procedures and practices; and market and product developments.