Incident response and management procedures

HONG KONG MONETARY AUTHORITY 香港 金 融 管 理 局 Arthur K. H. Yuen pp Deputy Chief Executive Our Ref: B1/15C B9/29C 阮 國 恆 jp BY 4 22 June 2010 The Chief Executive All Authorized Institutions Dear Sir/Madam, Incident response and management nrocedures In the light of several significant incidents that have affected a number of authorized institutions (Als) recently, I am writing to remind Als of the need to have effective incident response and management capability and procedures to deal with significant incidents and to set out the relevant principles that Als should follow in any public communication in respect of such incidents. It is recognised that every incident is different and how best to deal with a particular case will depend on the circumstances of the case. It is nevertheless important for all Als to ensure that whenever any significant incident occurs, they take the actions set out below: Immediate incident response The Al concerned should immediately analyse the cause of the incident and as soon as practicable rectify or contain the problem. The top priority ° should be to safeguard the interests of customers who have been or may be affected by the incident. Customer notifications The AI concerned should also determine as quickly as possible after identifying an incident whether the situation is likely to affect other customers or the customers of other Als (for example where the incident relates to the use of shared Automatic Teller Machine (ATM) networks). The AI should proactively notify the customers affected or likely to be affected through the most effective means and advise them of the steps or precautionary measures that they need to take as well as whether the bank would reimburse any losses incurred by them and if so, how they can apply for compensation e.g. by calling enquiry hotlines. Where necessary, the Al 55th Floor, Two International Finance Centre, 香港 中 環 金 融 街 8號 國 際 金 融 中 心 2 期55 樓 8 Finance Street, Central, Hong Kong 電話: (852) 2878 1982 傳真: (852) 2878 8130 Tel: (852) 2878 1982 Fax: (852) 2878 8130 電郵: ayuen@hkma.gov.hk E-mail: ayuen@hkma.gov.hk 網 址: www.hkma.gov.hk Website: www.hkma.gov.hk 電訊 號 碼: 74776 XFUND HX Telex: 74776 XFUND HX

-2- should also notify other affected Als (so that they can in turn notify their affected customers) as soon as practicable. Public announcement In addition to notifying the customers individually, it is also important for the AI concerned to consider making a public announcement where the situation so warrants, such as in the following circumstances: (a) where the nature of the incident is serious, for example if the incident entails the disruption of any essential and critical banking service channel (e.g. branch services, e-banking, ATM services, etc.) or the disruption may last for a prolonged period of time; or (b) where a large number of customers have been or may be affected, especially when public announcement is one of the faster or more effective means to alert such customers of the incident than individual notifications. In notifying the customers and making a public announcement, the Al concerned should include the key facts of the incident and the steps that affected customers need to take in the circumstances in order to gain or regain access to the relevant banking services or to protect their interests. The above are only the broad principles that an AI should consider and there could be other relevant factors that the AI should also take into account. For example, the need to keep the public informed may need to be weighed against the relevant legal considerations, including where appropriate whether a public announcement may prejudice any ongoing criminal proceedings or any investigation. The important point is that the actions taken to keep the customers and, where appropriate, the public informed of a significant incident should form an integral part of the incident response and management capability of Als. If in doubt, Als should consult the Hong Kong Monetary Authority (HKMA). Reporting incident to the HKMA In addition, once an Al has become aware that a significant incident has occurred, the AI concerned should notify the HKMA immediately and provide it with whatever information is available at the time. For the avoidance of doubt, an AI should not wait until it has rectified the problem before reporting the incident to the HKMA. The HKMA may require the Al concerned to provide further information or updates. Depending on the nature and seriousness of the incident and on whether the incident has wider implications for the general public, the HKMA may make a separate public announcement as appropriate.

Handling of customers’ and media’s enquiry When handling a significant incident affecting a substantial number of customers, the Al concerned is likely to receive a large number of customer and media enquiries. It is therefore essential for the AI concerned to deploy swiftly adequate resources and communication channels (e.g. customer service hotlines and extended office hours of branch services) to handle such enquiries. In addition, a proper communication strategy should be formulated by the senior management to ensure that consistent and up￾to-date messages are conveyed to all relevant parties on a timely basis. The HKMA should be kept informed during the process and copies of public communication materials should be submitted to the HKMA for reference. Als should ensure that their staff members are at all times alert to the importance of detecting significant incidents and reporting such incidents to senior management. Als are expected to ensure that they have in place the appropriate incident response and management capability. The HKMA will continue to assess the adequacy and effectiveness of Als’ incident response and management capability and procedures through its ongoing supervisory efforts. Should you have any questions on the content of this letter, please feel free to contact Mr Nelson Chow at 2878 1470 or Mr George Chou at 2878 1599. Yours faithfully,