Fintech Supervisory Sandbox (FSS)

Our Ref.: B1/15C B9/29C 6 September 2016 The Chief Executive All Authorized Institutions Dear Sir/Madam, Fintech Supervisory Sandbox (FSS) I am writing to advise you that the HKMA is launching today a Fintech Supervisory Sandbox (FSS) to facilitate the pilot trials of Fintech and other technology initiatives of authorized institutions (AIs) before they are launched on a fuller scale. Amidst global Fintech development, the HKMA has observed that more Fintech and innovative technologies (including mobile payment services, biometric authentication, blockchain, robotics and augmented reality) are being implemented or explored by the banking industry. We see the need for a supervisory arrangement with greater flexibility to enable AIs to conduct more timely live tests of these initiatives before their formal launch. This will enable AIs to gather real-life data and user feedback on their new Fintech products or services more easily in a controlled environment, so that they can make refinements to them as appropriate. The FSS is intended for this purpose, and the HKMA will adopt the following principles in operating the FSS: (a) The FSS is available to Fintech as well as other technology initiatives intended to be launched in Hong Kong by AIs; (b) Within the FSS, an AI is allowed to conduct a pilot trial of its initiatives involving actual banking services and a limited number of participating customers (such as staff members or focus groups of selected customers) without the need to achieve full compliance with the HKMA’s usual supervisory requirements during the trial period. This is however predicated on the understanding that the management of the AI will ensure that:

 Boundary - There are clear definitions about the scope and phases (if any) of the trial (such as the size and types of customers involved, technologies and types of banking services covered), the timing and the termination arrangements;  Customer protection measures – Adequate measures are in place to protect the interests of customers during the trial. These measures should in general include a proper process for selecting customers who understand the associated risks and voluntarily join the trial, enhanced complaint handling procedures, a mechanism for timely and fair compensation of customers’ financial losses caused by any failures of the trial, and appropriate arrangements for customers to withdraw from the trial;  Risk management controls – Reasonable compensating controls are implemented to mitigate the risks arising from less than full compliance with supervisory requirements, and to address the risks (including cyber attacks and system disruptions) posed by the trial run to the AI’s production systems and customers who do not join the trial; and  Readiness and monitoring - The systems and processes involved are ready for the trial (such as after going through reasonable testing and other rollout preparation). In addition, the trial is subject to close monitoring so that the AI can promptly identify and handle any significant problems or incidents that may arise (including matters about public and customer communications). (c) The FSS should not be used by AIs as a means to bypass applicable supervisory requirements. The HKMA does not intend to stipulate an exhaustive list of the supervisory requirements that may potentially be relaxed within the FSS. Examples of these requirements include security-related requirements for electronic banking services, and the timing of independent assessment prior to launching new technology services. AIs intending to access the FSS are advised to get in touch with the HKMA early. We will stand ready to discuss with AIs individually on the appropriate supervisory flexibility that can be made available to them within the FSS. As the FSS is a new supervisory arrangement, the HKMA will refine the arrangement over time in the light of implementation experience and industry development.

Should you have any questions about this circular, please feel free to contact Ms Teresa Chu at 2878 1563 or Mr Tsz-Wai Chiu at 2878 1389. Yours faithfully, Arthur Yuen Deputy Chief Executive