Frequently Asked Questions on Investor Protection Measures

Appendix 1 Investor Protection Measures in respect of Investment, Insurance and Mandatory Provident Fund Products Frequently Asked Questions (“FAQs”) (A) Sale of investment products (I) Applicability of investor protection measures

1. For those customers who do not meet the definition of “private banking customer” (e.g. the amount of investment assets under the Authorized Institution’s (“AI’s”) management falling below the prescribed amount) or “retail banking customers” (e.g. the AI has no retail banking unit or retail branch network), are the investor protection measures specified in the Circular as “applicable to the retail banking customers only” applicable to those customers? No, measures that are specified as “applicable to retail banking customers only” are not applicable to AIs for customers that do not meet the definition of “retail banking customers” (such as “private banking customers”).
2. Is the Circular applicable to dealing with “large/sophisticated corporate customers” 1 ? In respect of investment products, in dealing with large/sophisticated corporate customers, AIs are exempted from adopting the investor protection measures set out in the Circular, except for section (A)(II.4) on “Assessment of customer’s concentration risk” (if suitability obligations triggered), section (A)(II.5) on “Controls over transactions with mismatch(es) or exception(s)” and section (A)(V) on “Product-specific guidance” of Annex 1 to the Circular. Nevertheless, AIs should continue to observe the relevant guidance set out by the HKMA and the Securities and Futures Commission (“SFC”) in their dealing with large/sophisticated corporate customers, such as the SFC’s

1 As defined in the HKMA’s circular dated 20 December 2012 on “Applicability of Enhanced Measures to Sale of Investment Products to Corporate Customers”.

Appendix 2 Code of Conduct2 . In particular, regarding streamlining product disclosure of an investment product for large/sophisticated corporate customers, AIs should refer to the answer to Question 8 of this set of FAQs and the relevant guidance set out by the HKMA and the SFC. (II) Physical segregation (applicable to retail banking customers only) 3. What kind of banking activities can be conducted in “Non-deposit-taking Area”? As set out in section (A)(I) of Annex 1 to the Circular, AIs are allowed to conduct sale and distribution of investment products in any areas of their bank branches, provided that such areas are proper facilities and are not used for deposit-taking (referred as “Non-deposit-taking Area”). Besides conducting sale and distribution of investment products, AIs may also conduct general banking or customer services (e.g. cards, lending, spot foreign exchange, remittance) other than deposit-taking activities (e.g. placement or renewal of deposits) in Non-deposit-taking Area. The above elaboration of general banking or customer services are just some examples, and are not meant to be exhaustive. Deposit-taking activities incidental to investment transaction(s) are allowed at Non-deposit-taking Area provided that the AI has obtained the consent to access and utilize the customer’s deposit information for investment and wealth management purposes (i.e. Deposit Consent) from the customer. 4. Where can pure trading services on precious metals (e.g. gold, SFC-authorized paper gold schemes) be conducted at a bank branch? There is no specific restriction on the location for provision of such services within a bank branch. (III)Audio-recording of sale process 5. Is it required to audio record face-to-face sale process of the following

2 Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (“SFC’s Code of Conduct”)

Appendix 3 transactions for retail banking customers? (i) solicitation or recommendation of non-complex investment products, exchange-traded derivatives, and standardised structured deposits not regulated by the Securities and Futures Ordinance involving mismatch(es) or exception(s), other than risk mismatch No, audio-recording is not required for such transactions without risk mismatch. (ii) transactions of complex products that are for hedging purpose Yes, audio-recording is required for such transactions unless the opt out of audio-recording arrangement applies. 6. What is the expected standard regarding audio-recording for investment transactions conducted through non-face-to-face channels? To ensure fair treatment to customers and accord investor protection, AIs’ attention is drawn to the following matters, including compliance with existing regulatory requirements such as record keeping and audio recording where applicable. Where the communication facility does not have record-keeping capability which allows AIs to record, retrieve and monitor communication with customers, AIs are reminded to put in place compensating measures and controls to ensure compliance with relevant regulatory requirements. For example, if the investment transaction concerned falls under the circumstances that require audio-recording or phone recording, AIs should put in place measures (such as use of office phone with audio-recording capability) to record the relevant conversations with customers or to record the relevant recap. For the avoidance of doubts, AIs should audio-record the relevant conversations with customers or the relevant recap for investment transactions (regardless of whether solicitations or recommendations are involved; and whether complex products are involved) conducted through video-conference. The recording should cover, where applicable, suitability assessment; product disclosure; and order placement and confirmation. The records should be retained according to applicable

Appendix 4 requirements. AIs are also reminded to comply with other applicable regulatory requirements, including but not limited to the SFC’s Code of Conduct, in particular paragraph 3.9 about order recording and various provisions about information disclosure and suitability obligation, and the SFC’s circular dated 4 May 2018 on “Receiving client orders through instant messaging”, where applicable. AIs are expected to design their own operational arrangements appropriate for their specific circumstances. For example, AIs may consider whether a particular mode of communication would be appropriate for certain customers such as vulnerable customers. Opt-out arrangement (applicable to retail banking customers only) 7. Can AIs regard the full disclosure and due selling process for comparable products made in the first or previous transaction through online channel as fulfilling one of the conditions for the opt-out of the audio-recording requirement set out in Section (A)(II.1) of Annex 1 to the Circular? AIs may opt out of the audio-recording arrangement provided that, among others, the AI made a full disclosure of the key facts and risks of the product and conducted due selling process (including audio-recording) at the time of the first or previous transactions of that comparable product. Online transaction records without any audio-recording (such as having only written record of the required disclosure) of comparable product cannot fulfill the conditions for opting out of the audio-recording requirement. (IV)Product disclosure 8. Can AIs exercise flexibility in streamlining product disclosure of an investment product for sophisticated investors or experienced investors, though not fully meet the criteria set out in section (A)(II.2) of Annex 1 to the Circular?

Appendix 5 The objective of product disclosure (e.g. disclosure of product nature, features and risks) is to enable the customer to understand the investment product before entering into a transaction. The principle is that AIs may adopt a risk-based approach, having regard to the circumstances, such as the customer’s trading pattern, level of sophistication and investment experience, as well as the product’s complexity and risk, in providing product disclosure to customers. For retail banking customers, AIs should follow the supervisory requirements as set out in section (A)(II.2) of Annex 1 to the Circular. For customers who are not retail banking customers (“non-retail banking customers”), AIs may streamline product disclosure (regardless of whether it is a first transaction or subsequent transactions of comparable products), provided that the AI assures itself that the customer understands the investment product before entering into a transaction. In practice, an AI, having regard to a non-retail banking customer’s level of financial sophistication e.g. investment knowledge or investment experience with the AI or other financial institutions, can streamline product disclosure of an investment product to the customer provided that the AI assures itself and maintains a record (either written or audio) to evidence that the customer understands the product and does not need a full product disclosure in the circumstances. (V) Assessment of customer’s concentration risk 9. Section (A)(II.4) of Annex 1 to the Circular set out principles and requirements on assessment of customer’s concentration risk. Any practical guidance for assessing concentration risk? In formulating the methodology and threshold(s) for assessing concentration risk and determining the positions of a customer’s financial assets and investment holdings to be used in concentration risk assessment, AIs should ensure they are reasonable. Under this principle, there may be different ways to assess the concentration risk. While not ruling out other reasonable methodologies, AIs could

Appendix 6 focus on the risk level of the products and the customer’s circumstances in assessing concentration risk. Besides, AIs should take into account the basis of parameters in assessing the concentration risk of a customer, and ensure that any concentration threshold(s) is reasonable. In general, it would be reasonable that the same basis is adopted for both denominator (i.e. customer’s financial assets) and numerator (i.e. customer’s holdings in the product on a cumulative basis) when assessing the concentration risk of a customer. AIs can accept a customer’s declaration on the amount/details of his/her financial assets as well as investment holdings outside of the AI for the purpose of assessing concentration risk. In any circumstances, if the customer’s declaration is inconsistent with the AI’s available information, e.g. customer’s declared financial assets or concentration level, the AI should take appropriate step(s) to address the inconsistency, e.g. seek clarification from the customer. For leveraged transactions, unless otherwise specified3 , AIs should use the maximum exposure (not merely the margin required) of the leveraged transactions in assessing the concentration risk. (VI)Controls over transactions with mismatch(es) or exception(s) 10.Can AIs solicit or recommend investment products to a customer if such products are assessed to be suitable for the customer despite mismatch(es) or exception(s) involved? AIs may distribute, solicit or recommend investment products to a customer as long as it fulfils the suitability obligations where applicable (such as for complex products or transactions involving solicitation or recommendation), despite that the transaction may involve mismatch(es) or exception(s). For example, as set out in the SFC’s FAQs on Compliance with Suitability

3 For example, AIs may adopt the framework for assessing customers’ expected exposure to FX accumulators as set out in the HKMA’s circular dated 7 March 2014 on “Foreign Exchange Accumulators and Non-leveraged Renminbi-Linked Deposits”

Appendix 7 Obligations, for a client with low or medium risk profile, a proportion of high risk products in his portfolio may not be unsuitable so long as this is commensurate with the risk return profile of the portfolio, and the licensed or registered persons are able to satisfy itself that any investment products recommended are likely to meet the investment objectives and other personal circumstances of the client. Nevertheless, in cases of transactions involving mismatch(es) or exception(s), the bank staff should take extra care and the control steps set out in paragraphs 2 and 3 of section (A)(II.5) of Annex 1 to the Circular, among others, document the reason for the transaction. Such reason could be the AI’s justification of why the transaction is suitable for the customer. (VII) Holistic assessment for vulnerable customers (“VCs”) 11.Is it mandatory for AIs to adopt the holistic assessment for VCs? Can an AI choose to follow the existing VC assessment by setting a higher age threshold but not to consider the customer’s investment experience? To ensure reasonable assessment results, AIs should adopt holistic assessment for VCs. In determining whether a customer is a VC, AIs should consider holistically the circumstances of a customer (including investment experience). In most cases, merely assessing a single attribute of the customer (such as age) may not be sufficiently risk-based or holistic. The HKMA sets out a suggested framework for VC Assessment for retail banking customers in the Circular. In view of the nature of the clientele and the modes of operation of other businesses, AIs may use other frameworks for VC Assessment for non-retail banking customers (such as private banking customers), provided that the principle of holistic assessment for VCs is followed. 12.Are AIs required to perform VC Assessment and its regular review if customers conducting execution-only transactions only? VCs are customers who have lower ability to understand the risks and withstand the potential losses of an investment. AIs are expected to

Appendix 8 exercise extra care when dealing with VCs and provide VCs with additional protection in certain circumstances. Irrespective of the channel and mode of transactions preferred by the customers (e.g. use of online platforms only; conducting execution-only transactions only), AIs should conduct a holistic assessment to determine whether a customer is a VC. For the avoidance of doubts, AIs may enquire into a customer’s circumstances (e.g. level of education, financial situation, any observable disabilities, investment experience) for conducting VC Assessment by customer’s declaration or other reasonable approaches. AIs are also expected to review the VC Assessment on a regular basis, and when the AI is aware of any material changes in the customer’s circumstances that warrant an update to the VC Assessment.

13.How should AIs conduct VC Assessment where the customer has authorized other person(s) to operate the account? VC Assessment is also applicable to the person who makes investment decision. In considering the customer’s attribute(s) and circumstances in the VC Assessment, AIs should adopt a reasonable approach if authorized person(s) is involved, e.g. considering the investment experience of the authorized person(s) and the financial situation of the account holder. In view of the nature of the clientele and the mode of operations of businesses other than retail banking business, AIs may use their own frameworks for VC Assessment for non-retail banking customers (such as private banking customers) following the principle for VC Assessment as set out in the section (A)(III.2) of Annex 1 to the Circular. (B) Sale of insurance products and mandatory provident fund (“MPF”) products 14.Are the above FAQs applicable to sale of insurance products and MPF products? In complying with the investor protection measures applicable to the sale of insurance products and MPF products as stipulated in section (B) of Annex

Appendix 9 1 to the Circular, AIs should observe the following FAQs, and adopt the principles and requirements to the extent applicable:  FAQ 3: investment-linked assurance scheme (“ILAS”) products, annuity insurance products, and MPF registered schemes and constituent funds;  FAQ 9: ILAS products, including that AIs could focus on the risk level of the products and the customer’s circumstances in assessing the cumulative concentrations in the underlying investment choices. For the avoidance of doubt, AIs should also take into account the cumulative concentrations in ILAS products in the concentration risk assessment; and  FAQs 11 to 13: long term insurance products. 15.If an AI conducts VC Assessment every time when selling long term insurance products, is it still required to review the VC Assessment on a regular basis? AIs are expected to exercise extra care when dealing with VCs. In this connection, AIs should have a valid VC Assessment result of the customer when selling long term insurance products. This could be achieved by reviewing the VC Assessment on a regular basis and when an AI is aware of any material changes in the customer circumstances that warrant an update, or by conducting the VC Assessment every time before sale of long term insurance products.