Guidance on selling of investment products and handling of client securities

Our Ref.: B1/15C
G16/1C
23 February 2017
The Chief Executive
All Authorized Institutions
Dear Sir / Madam,
Guidance on selling of investment products and handling of client securities I am writing to provide practical guidance with respect to Authorized Institutions’ (AIs’) selling of investment products and handling of client securities, drawing reference to our supervisory observations as well as recent discussions with the industry on the interpretation and practical issues when implementing certain regulatory requirements. The guidance set out in the Annex seeks to clarify the Hong Kong Monetary Authority’s (HKMA’s) risk-based supervisory approach and the policy intention of the relevant regulatory standards. AIs should consider their own circumstances, and exercise adequate management supervision and professional judgement to ensure that proper internal controls are established and implemented effectively, having regard to this guidance. If you have any questions on this circular, please contact Ms Ada Au on 2878-8814 or Ms Florence To on 2878-1582. Yours faithfully, Carmen Chu Executive Director (Banking Conduct) c.c. SFC (Attn: Ms Julia Leung, Executive Director (Intermediaries))

Annex

1. Pre-trade disclosure
   1.1 Some AIs sought clarification on the level of details expected when providing risk
   disclosure to customers in each transaction. In particular, the AIs enquired whether streamlined disclosure could be adopted for customers having made frequent transactions on the same product or product category. Regulatory standards
   1.2 Intermediaries should help each customer make informed decisions by, among others,
   giving the customer proper explanations of the nature and extent of risks the investment products bear1 . The objective of risk disclosure is to assure the customer understands the investment product before entering into a transaction. In this regard, an AI may adopt a risk-based approach having regard to the circumstances, such as the customer’s trading pattern, level of sophistication and investment experience, and product complexity and risk in providing risk disclosure to customers.
   1.3 If an AI adopts streamlined risk disclosure for repeated transactions, in determining the
   adequacy and validity of previous disclosure made by the AI to the customer, the relevant circumstances for consideration should be extended to also include other facts and evidence suggesting customer having sufficient understanding of the product (or the contrary). It is therefore important that AIs maintain proper record of relevant risk disclosure and are able to demonstrate that proper risk disclosure has been given to the customer in previous transactions.
   1.4 AIs should be cautious about streamlining risk disclosure on the basis of the “same
   product category”, as products of the same product category may be quite different in structure, risks, terms and conditions, etc. and in such cases, streamlined risk disclosure may not be able to ensure adequate risk disclosure. An example is plain vanilla bonds as compared with complex bonds.
2. Assessment of customer’s concentration risk
   2.1 Some AIs enquired whether it is acceptable to conduct pre-trade concentration assessment
   on the transaction level only, instead of on a cumulative basis.
   2.2 It is observed in our supervisory work that an AI only took into account stock, but not
   equity-linked product (such as stock accumulator) on the same stock, in assessing concentration risk. Under this approach, customers may have excessive concentration in a single stock, especially if the stock is of high risk. Regulatory standards 1 Question 6 of the SFC’s FAQs on Compliance with Suitability Obligations updated on 23 December 2016

2.3 Intermediaries should ensure the suitability of an investment solicitation or
recommendation for a customer is reasonable in all the circumstances2 . When assessing the suitability of a product to a customer, intermediaries should give due consideration to all relevant circumstances specific to the customer, including concentration risk. They are expected to assess concentration risk based on available information about the customer (e.g. investment portfolio held with the intermediary and information about the customer’s financial situation).
2.4 As part of the suitability assessment, intermediaries should consider the overall effect of
their recommended investment products on their customers’ portfolios. For example, for a customer with low or medium risk profile, a proportion of high risk products in his portfolio may not be unsuitable so long as this is commensurate with the risk return profile of the portfolio and the intermediaries are able to satisfy themselves that any investment products recommended are likely to meet the investment objectives and other personal circumstances of the customers.3 In this regard, AIs should use cumulative basis and take into account existing holding of investment products in the customer’s portfolio for suitability assessment.
2.5 AIs may adopt a risk-based approach in assessing concentration risk, taking into
consideration all relevant factors such as the risk profile and nature of a product and customer’s risk tolerance level and financial situation. For example, when assessing the suitability of an equity-linked product for a customer, an AI should consider whether the underlying stock(s) carries substantial risk and, if so, the AI should take into account the customer’s holding of the stock(s) as well as investment products that have the stock(s) as underlying asset(s) in the assessment of the customer’s concentration risk.
2.6 It is observed that some AIs perform post-trade portfolio review. AIs that adopt such
internal control arrangements should develop proper approaches and mechanisms that are suitable to the size, nature and complexity of their businesses. Nevertheless, post-trade portfolio review cannot be taken as a replacement to pre-trade concentration assessment, as the latter is part of the assessment to ensure suitability of an investment solicitation or recommendation, or “suitability obligations” required of AIs.
3. “Portfolio-based” suitability assessment for private banking customers
3.1 In relation to the selling of pre-designed discretionary portfolio management (DPM)
mandates to private banking customers, the HKMA found internal control issues in some AIs in the following areas:
 ensuring that the portfolios are managed in a way that is consistent with the investment strategy and objective of the DPM mandates as agreed with the customers;  ensuring the suitability of the solicitation or recommendation of the DPM mandates for the customers; and 2 Paragraph 5.2 of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (the SFC’s Code of Conduct) 3 Question 5 of the SFC’s FAQs on Compliance with Suitability Obligations updated on 23 December 2016

 putting in place adequate controls, monitoring and compliance review of the operation of the DPM mandates.
3.2 Some private banks sought clarification on whether discretionary portfolio managers
need to alert the customer and provide the customer with the rationale of recommendation before execution of each and every risk-mismatched transaction. Regulatory standards
3.3 AIs should establish adequate processes and controls to govern the operations of
advisory and discretionary accounts. If private banks adopt a “portfolio-based” approach in conducting suitability assessment, they should ensure compliance with applicable regulatory requirements, including but not limited to: the HKMA’s circular of 12 June 2012 on “Selling of Investment Products to Private Banking Customers”, the Securities and Futures Commission’s (SFC’s) circular of 17 July 2012 on “Compliance with Suitability Obligations”, and the SFC’s circular of 23 December 2016 on “Frequently Asked Questions on Triggering of Suitability Obligations”.
3.4 A private banking customer may have different investment objectives for different
accounts maintained with different AIs or with the same AI. Under the “portfolio-based” approach of suitability assessment, an AI could agree with a private banking customer an investment mandate for a specific account, taking a holistic view of all the accounts and overall circumstances of the customer. Once a mandate for an account is agreed, the AI should manage the portfolio of the account in accordance with the mandate. For any transaction subsequently effected in accordance with the mandate, it would not be necessary for the AI to record the rationale for each transaction or to provide the customer with the rationale for that transaction.
3.5 AIs should ensure suitability of the mandate for the customer. In establishing a
pre-designed DPM mandate with a particular overall risk profile for the relevant portfolio, the AI could have the discretion to invest in products with a lower or higher risk profile so long as the overall risk profile and investment strategy/objective of the portfolio as well as customers’ investment objective are maintained.
3.6 AIs should perform proper assessment, monitoring and review on the operation as well
as outcome of the portfolio management to ensure DPM mandates and customer accounts are managed in a way consistent with the investment strategy and objective of the mandates and personal circumstances of the customers.
4. Alternative investment products
4.1 Some AIs enquired whether it is mandatory for AIs to recommend alternative investment
products to customers, as there may not be comparable alternatives in some scenarios.
4.2 In the course of the HKMA’s supervision, in respect of certain transactions with
mismatch(es), some AIs represented that they had taken into account available alternatives and recommended suitable investment products to customers, but that the customers insisted to purchase other products which resulted in mismatch(es). However, those AIs did not document such suitable alternatives considered or recommended to

customers and thus were not able to support their representation.
Regulatory standards
4.3 When providing advice to a customer, intermediaries should ensure that the advice and
recommendations are based on thorough analysis and take into account available alternatives4 . Regulators do not mandate intermediaries to “recommend” alternative products to their customers for all transactions, as there may not be comparable alternatives in some scenarios. The focus is on the suitability of a recommendation and whether any available alternatives have been taken into consideration. AIs should properly document the alternative investment products considered, if any, as records to demonstrate that they have acted with due skill, care and diligence, and in the best interests of the customers 5 . Applying this principle, where transactions with mismatch(es) are carried out upon customer’s request and the relevant sales staff have taken into account available alternatives and recommended suitable investment products to the customers, AIs should ensure that their sales staff follow proper procedures to document the suitable alternatives considered or recommended to the customers.
4.4 For avoidance of doubt, in view of the complex structure and significant investment risks
of accumulators and decumulators, the HKMA has specifically required AIs to provide customers with reasonable alternative investment products with lower risks and / or less complex structure for addressing their investment needs6 .
5. Supervision of transactions with mismatch(es) or exception(s)
5.1 When dealing with retail customers, AIs are required to arrange supervisor’s review and
approval as appropriate for transactions with mismatch(es) or exception(s) in accordance with enhanced regulatory measures7 . The objective is for the supervisor to review the appropriateness of such recommended transaction given higher risks to customer interests in cases of mismatch(es) or exception(s). Regulatory standards and good practices
5.2 In view of differences in the nature of the clientele and the mode of operations of private
banking business as compared to retail banking business, the HKMA has allowed some flexibility for private banks in the adoption of enhanced regulatory measures8 . Within this framework, while pre-trade supervisor approval for transactions with mismatches or exceptions is a good practice adopted by some private banks, there could be alternative 4 Paragraph 3.4 of the SFC’s Code of Conduct 5 HKMA’s circular “Issues and good practices in relation to the sale of investment products” of 30 July 2014 6 HKMA’s circular “Selling of accumulators” of 22 December 2010 7 HKMA’s circular “Implementation of Recommendations in the HKMA’s Report on Issues Concerning the Distribution of Structured Products Connected to Lehman Brothers” of 25 March 2009 8 HKMA’s circular “Applicability of enhanced measures to sales of investment products to private banking customers” of 20 January 2012

control mechanism. Private banks are expected to exercise professional judgement to put in place and effectively implement adequate controls and appropriate level of supervision in respect of transactions with mismatch(es) or exception(s).
5.3 AIs should be mindful that as a general principle applicable to all types of clientele, their
controls and supervision should reflect the severity and number of mismatch(es) or exception(s) .
6. Staff training
6.1 Frontline staff and control functions of some AIs may not have consistent understanding
of certain regulatory standards in relation to selling of investment products. Regulatory standards
6.2 Relevant staff (including customer-facing staff, compliance, internal control and internal
audit functions) should have adequate understanding of the applicable regulatory standards governing the selling of investment products. AIs should ensure adequate and appropriate staff training to keep abreast of new regulatory standards, and subsequent updates and clarification, as well as relevant internal policies and processes.
7. Regular review of controls in relation to handling of client securities
7.1 A registered institution (RI) for a prolonged period had not reviewed its controls and
effectiveness in implementing regulatory requirements in relation to handling of client securities. The RI did not require any independent functional unit(s) (such as Compliance Department) to perform risk assessment and compliance review in this area. As a result, the RI failed to identify deficiencies in handling of client securities and ensuring compliance with the Securities and Futures (Client Securities) Rules. Regulatory standards
7.2 RIs and their associated entities10 should establish and maintain proper controls in
relation to handling of client securities and ensure compliance with all applicable legal and regulatory requirements. They should assign designated functional unit(s) to regularly review and monitor their compliance with the Securities and Futures (Client Securities) Rules and their implementation of established policies and procedures in respect of handling of client securities. This should include, among other things, segregation and safe custody of client securities maintained by the RI and associated entities as well as appointed external custodian(s), and regular reconciliation of internal records on client securities with statements or records issued by the Central Clearing And Settlement System (i.e. CCASS) and other custodians. The designated functional unit(s) should report to the senior management as soon as it is / they are aware of any non-compliance.11 RIs should also notify the HKMA and the SFC as required. Senior management should promptly take follow-up action to rectify the situation. 9 HKMA’s circular “Issues and good practices in relation to the sale of investment products” of 30 July 2014 10 “Associated entity” has the meaning set out in Schedule 1 to the Securities and Futures Ordinance (SFO) 11 Paragraphs 1 and 17 of the SFC’s Suggested Control Techniques and Procedures for Enhancing a Firm’s Ability to Comply with the Securities and Futures (Client Securities) Rules and the Securities and Futures (Client Money) Rules

---

Annex

1. Pre-trade disclosure
   1.1 Some AIs sought clarification on the level of details expected when providing risk
   disclosure to customers in each transaction. In particular, the AIs enquired whether streamlined disclosure could be adopted for customers having made frequent transactions on the same product or product category. Regulatory standards
   1.2 Intermediaries should help each customer make informed decisions by, among others,
   giving the customer proper explanations of the nature and extent of risks the investment products bear1 . The objective of risk disclosure is to assure the customer understands the investment product before entering into a transaction. In this regard, an AI may adopt a risk-based approach having regard to the circumstances, such as the customer’s trading pattern, level of sophistication and investment experience, and product complexity and risk in providing risk disclosure to customers.
   1.3 If an AI adopts streamlined risk disclosure for repeated transactions, in determining the
   adequacy and validity of previous disclosure made by the AI to the customer, the relevant circumstances for consideration should be extended to also include other facts and evidence suggesting customer having sufficient understanding of the product (or the contrary). It is therefore important that AIs maintain proper record of relevant risk disclosure and are able to demonstrate that proper risk disclosure has been given to the customer in previous transactions.
   1.4 AIs should be cautious about streamlining risk disclosure on the basis of the “same
   product category”, as products of the same product category may be quite different in structure, risks, terms and conditions, etc. and in such cases, streamlined risk disclosure may not be able to ensure adequate risk disclosure. An example is plain vanilla bonds as compared with complex bonds.
2. Assessment of customer’s concentration risk
   2.1 Some AIs enquired whether it is acceptable to conduct pre-trade concentration assessment
   on the transaction level only, instead of on a cumulative basis.
   2.2 It is observed in our supervisory work that an AI only took into account stock, but not
   equity-linked product (such as stock accumulator) on the same stock, in assessing concentration risk. Under this approach, customers may have excessive concentration in a single stock, especially if the stock is of high risk. Regulatory standards 1 Question 6 of the SFC’s FAQs on Compliance with Suitability Obligations updated on 23 December 2016

2.3 Intermediaries should ensure the suitability of an investment solicitation or
recommendation for a customer is reasonable in all the circumstances2 . When assessing the suitability of a product to a customer, intermediaries should give due consideration to all relevant circumstances specific to the customer, including concentration risk. They are expected to assess concentration risk based on available information about the customer (e.g. investment portfolio held with the intermediary and information about the customer’s financial situation).
2.4 As part of the suitability assessment, intermediaries should consider the overall effect of
their recommended investment products on their customers’ portfolios. For example, for a customer with low or medium risk profile, a proportion of high risk products in his portfolio may not be unsuitable so long as this is commensurate with the risk return profile of the portfolio and the intermediaries are able to satisfy themselves that any investment products recommended are likely to meet the investment objectives and other personal circumstances of the customers.3 In this regard, AIs should use cumulative basis and take into account existing holding of investment products in the customer’s portfolio for suitability assessment.
2.5 AIs may adopt a risk-based approach in assessing concentration risk, taking into
consideration all relevant factors such as the risk profile and nature of a product and customer’s risk tolerance level and financial situation. For example, when assessing the suitability of an equity-linked product for a customer, an AI should consider whether the underlying stock(s) carries substantial risk and, if so, the AI should take into account the customer’s holding of the stock(s) as well as investment products that have the stock(s) as underlying asset(s) in the assessment of the customer’s concentration risk.
2.6 It is observed that some AIs perform post-trade portfolio review. AIs that adopt such
internal control arrangements should develop proper approaches and mechanisms that are suitable to the size, nature and complexity of their businesses. Nevertheless, post-trade portfolio review cannot be taken as a replacement to pre-trade concentration assessment, as the latter is part of the assessment to ensure suitability of an investment solicitation or recommendation, or “suitability obligations” required of AIs.
3. “Portfolio-based” suitability assessment for private banking customers
3.1 In relation to the selling of pre-designed discretionary portfolio management (DPM)
mandates to private banking customers, the HKMA found internal control issues in some AIs in the following areas:
 ensuring that the portfolios are managed in a way that is consistent with the investment strategy and objective of the DPM mandates as agreed with the customers;  ensuring the suitability of the solicitation or recommendation of the DPM mandates for the customers; and 2 Paragraph 5.2 of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (the SFC’s Code of Conduct) 3 Question 5 of the SFC’s FAQs on Compliance with Suitability Obligations updated on 23 December 2016

 putting in place adequate controls, monitoring and compliance review of the operation of the DPM mandates.
3.2 Some private banks sought clarification on whether discretionary portfolio managers
need to alert the customer and provide the customer with the rationale of recommendation before execution of each and every risk-mismatched transaction. Regulatory standards
3.3 AIs should establish adequate processes and controls to govern the operations of
advisory and discretionary accounts. If private banks adopt a “portfolio-based” approach in conducting suitability assessment, they should ensure compliance with applicable regulatory requirements, including but not limited to: the HKMA’s circular of 12 June 2012 on “Selling of Investment Products to Private Banking Customers”, the Securities and Futures Commission’s (SFC’s) circular of 17 July 2012 on “Compliance with Suitability Obligations”, and the SFC’s circular of 23 December 2016 on “Frequently Asked Questions on Triggering of Suitability Obligations”.
3.4 A private banking customer may have different investment objectives for different
accounts maintained with different AIs or with the same AI. Under the “portfolio-based” approach of suitability assessment, an AI could agree with a private banking customer an investment mandate for a specific account, taking a holistic view of all the accounts and overall circumstances of the customer. Once a mandate for an account is agreed, the AI should manage the portfolio of the account in accordance with the mandate. For any transaction subsequently effected in accordance with the mandate, it would not be necessary for the AI to record the rationale for each transaction or to provide the customer with the rationale for that transaction.
3.5 AIs should ensure suitability of the mandate for the customer. In establishing a
pre-designed DPM mandate with a particular overall risk profile for the relevant portfolio, the AI could have the discretion to invest in products with a lower or higher risk profile so long as the overall risk profile and investment strategy/objective of the portfolio as well as customers’ investment objective are maintained.
3.6 AIs should perform proper assessment, monitoring and review on the operation as well
as outcome of the portfolio management to ensure DPM mandates and customer accounts are managed in a way consistent with the investment strategy and objective of the mandates and personal circumstances of the customers.
4. Alternative investment products
4.1 Some AIs enquired whether it is mandatory for AIs to recommend alternative investment
products to customers, as there may not be comparable alternatives in some scenarios.
4.2 In the course of the HKMA’s supervision, in respect of certain transactions with
mismatch(es), some AIs represented that they had taken into account available alternatives and recommended suitable investment products to customers, but that the customers insisted to purchase other products which resulted in mismatch(es). However, those AIs did not document such suitable alternatives considered or recommended to

customers and thus were not able to support their representation.
Regulatory standards
4.3 When providing advice to a customer, intermediaries should ensure that the advice and
recommendations are based on thorough analysis and take into account available alternatives4 . Regulators do not mandate intermediaries to “recommend” alternative products to their customers for all transactions, as there may not be comparable alternatives in some scenarios. The focus is on the suitability of a recommendation and whether any available alternatives have been taken into consideration. AIs should properly document the alternative investment products considered, if any, as records to demonstrate that they have acted with due skill, care and diligence, and in the best interests of the customers 5 . Applying this principle, where transactions with mismatch(es) are carried out upon customer’s request and the relevant sales staff have taken into account available alternatives and recommended suitable investment products to the customers, AIs should ensure that their sales staff follow proper procedures to document the suitable alternatives considered or recommended to the customers.
4.4 For avoidance of doubt, in view of the complex structure and significant investment risks
of accumulators and decumulators, the HKMA has specifically required AIs to provide customers with reasonable alternative investment products with lower risks and / or less complex structure for addressing their investment needs6 .
5. Supervision of transactions with mismatch(es) or exception(s)
5.1 When dealing with retail customers, AIs are required to arrange supervisor’s review and
approval as appropriate for transactions with mismatch(es) or exception(s) in accordance with enhanced regulatory measures7 . The objective is for the supervisor to review the appropriateness of such recommended transaction given higher risks to customer interests in cases of mismatch(es) or exception(s). Regulatory standards and good practices
5.2 In view of differences in the nature of the clientele and the mode of operations of private
banking business as compared to retail banking business, the HKMA has allowed some flexibility for private banks in the adoption of enhanced regulatory measures8 . Within this framework, while pre-trade supervisor approval for transactions with mismatches or exceptions is a good practice adopted by some private banks, there could be alternative 4 Paragraph 3.4 of the SFC’s Code of Conduct 5 HKMA’s circular “Issues and good practices in relation to the sale of investment products” of 30 July 2014 6 HKMA’s circular “Selling of accumulators” of 22 December 2010 7 HKMA’s circular “Implementation of Recommendations in the HKMA’s Report on Issues Concerning the Distribution of Structured Products Connected to Lehman Brothers” of 25 March 2009 8 HKMA’s circular “Applicability of enhanced measures to sales of investment products to private banking customers” of 20 January 2012

control mechanism. Private banks are expected to exercise professional judgement to put in place and effectively implement adequate controls and appropriate level of supervision in respect of transactions with mismatch(es) or exception(s).
5.3 AIs should be mindful that as a general principle applicable to all types of clientele, their
controls and supervision should reflect the severity and number of mismatch(es) or exception(s) .
6. Staff training
6.1 Frontline staff and control functions of some AIs may not have consistent understanding
of certain regulatory standards in relation to selling of investment products. Regulatory standards
6.2 Relevant staff (including customer-facing staff, compliance, internal control and internal
audit functions) should have adequate understanding of the applicable regulatory standards governing the selling of investment products. AIs should ensure adequate and appropriate staff training to keep abreast of new regulatory standards, and subsequent updates and clarification, as well as relevant internal policies and processes.
7. Regular review of controls in relation to handling of client securities
7.1 A registered institution (RI) for a prolonged period had not reviewed its controls and
effectiveness in implementing regulatory requirements in relation to handling of client securities. The RI did not require any independent functional unit(s) (such as Compliance Department) to perform risk assessment and compliance review in this area. As a result, the RI failed to identify deficiencies in handling of client securities and ensuring compliance with the Securities and Futures (Client Securities) Rules. Regulatory standards
7.2 RIs and their associated entities10 should establish and maintain proper controls in
relation to handling of client securities and ensure compliance with all applicable legal and regulatory requirements. They should assign designated functional unit(s) to regularly review and monitor their compliance with the Securities and Futures (Client Securities) Rules and their implementation of established policies and procedures in respect of handling of client securities. This should include, among other things, segregation and safe custody of client securities maintained by the RI and associated entities as well as appointed external custodian(s), and regular reconciliation of internal records on client securities with statements or records issued by the Central Clearing And Settlement System (i.e. CCASS) and other custodians. The designated functional unit(s) should report to the senior management as soon as it is / they are aware of any non-compliance.11 RIs should also notify the HKMA and the SFC as required. Senior management should promptly take follow-up action to rectify the situation. 9 HKMA’s circular “Issues and good practices in relation to the sale of investment products” of 30 July 2014 10 “Associated entity” has the meaning set out in Schedule 1 to the Securities and Futures Ordinance (SFO) 11 Paragraphs 1 and 17 of the SFC’s Suggested Control Techniques and Procedures for Enhancing a Firm’s Ability to Comply with the Securities and Futures (Client Securities) Rules and the Securities and Futures (Client Money) Rules