Investor Protection Measures in respect of Investment, Insurance and Mandatory Provident Fund Products

Annex 1 1 (A) Sale of investment products (I) Physical segregation (applicable to retail banking customers1 only) Principle

1. To prevent any possible confusion of a retail banking customer in distinguishing between a deposit and an investment product, Authorized Institutions (“AIs”) should ensure clear physical segregation between deposit-taking activities and investment activities in retail bank branches. Supervisory requirements
2. Under the above principle, AIs are allowed to conduct sale and distribution of investment products in any areas of their bank branches, provided that such areas are proper facilities that are not used for deposit-taking (referred as “Non-deposit-taking Area” in this circular). AIs may conduct sale and distribution of investment products and general banking services other than placement or renewal of deposits in the same area. AIs should arrange the branch setup properly, including any signage as appropriate to alert customers of the types of services provided in a particular area, so as to prevent any possible confusion of a customer in distinguishing between deposit-taking activities and investment activities. 1 “Retail banking customers” in this circular refer to customers of retail banks or retail banking units of AIs (collectively “retail banks”). Retail banks normally have retail branch network. Retail banking customers include, apart from individuals, sole proprietors, partnerships, and small and medium enterprises (“SMEs”), where appropriate (e.g. these customers are categorised by an AI as retail banking customers). In dealing with other customers, including private banking customers and corporate customers (other than large/sophisticated corporate customers), AIs should refer to the definitions of “private banking customers” and “large/sophisticated corporate customers”, and adopt the enhanced investor protection measures applicable to private banking customers as set out in the relevant circulars issued by the Hong Kong Monetary Authority (“HKMA”), including the HKMA’s circular dated 20 January 2012 on “Applicability of Enhanced Measures to Sales of Investment Products to Private Banking Customers” (save for Recommendations 5, 15 and 18 of Annex to such circular which are superseded by this circular), the HKMA’s circular dated 12 June 2012 on “Selling of Investment Products to Private Banking Customers”, the HKMA’s circular dated 20 December 2012 on “Applicability of Enhanced Measures to Sale of Investment Products to Corporate Customers”, and any subsequent guidance issued by the HKMA from time to time. While virtual banks do not have local branches, they should adopt the investor protection measures where applicable. For example, while the “physical segregation” requirement is not applicable to virtual banks as they do not have a physical branch, other investor protection measures (such as the Deposit Consent requirement) will apply as applicable.

Annex 1 2 3. For the avoidance of doubt, structured deposits are regarded as investment products and thus the selling activities and transactions should be carried out in Non-deposit-taking Area (unless exemption applies for Standardised Non-SFO-regulated Structured Deposit, see paragraph 4 in section (A)(V.1) of Annex 1). 4. Besides, there should be complete information separation between a retail banking customer’s deposit accounts and his/her investment accounts to prohibit an AI’s making use of deposit-related information to target and channel retail banking customers into investment activities, unless the AI has obtained the consent of the customer to access and utilise such deposit information for investment and wealth management purposes (i.e. “Deposit Consent”) 2 . 5. Deposit-taking activities incidental to investment transaction(s), irrespective of whether an investment transaction is concluded at the end of discussion with a customer, are allowed at Non-deposit-taking Area and could be handled by staff in Non-deposit-taking Area, provided that AIs have obtained Deposit Consent from the customer. AIs should ensure that this flexibility is not being abused. 6. For flexibility in staff arrangement, staff in Non-deposit-taking Area is allowed to be deployed to deposit-taking area to handle deposit-taking activities, and staff in deposit-taking area is allowed to be deployed to Non-deposit-taking Area to handle investment transactions. Nevertheless, AIs should have adequate controls to prevent any abuse of this arrangement. For example, it will not be acceptable for a teller to sell investment products to customers when the teller is handling deposit-taking transactions. Further, AIs should continue to comply with applicable registration/licensing requirement (e.g. only relevant individuals can carry out regulated activities under the Securities and Futures Ordinance (“SFO”)). 7. For the avoidance of doubt, while the “physical segregation” requirement is not applicable to general phone banking and online banking, the Deposit Consent requirement is applicable to general phone banking and online banking. 2 For the avoidance of doubt, AIs that have obtained Deposit Consent from customers before are not required to seek such consent from those customers again.

Annex 1 3 (A) Sale of investment products (II) Selling process II.1 Audio-recording of face-to-face sale process (applicable to retail banking customers only) Principle

1. The purpose of audio-recording is to maintain a proper record of the sale process to ensure adequate disclosure and suitability of investment recommendations or transactions. Supervisory requirements
2. Audio-recording of the face-to-face sale process is required for retail banking customers in the course of: (i) distribution of (i.e. irrespective of whether solicitation or recommendation is involved) / advice on complex investment products 1 ; or (ii) solicitation or recommendation of non-complex investment products (e.g. stocks, non-complex bonds, SFC-authorized non-derivative funds), exchange-traded derivatives, or standardised structured deposits not regulated by the SFO1 , involving risk mismatch.
3. The audio record should cover: (i) suitability assessment; (ii) disclosure and explanation of product nature, features and risks; and (iii) order placement and confirmation (if an investment transaction is concluded). AIs may record only the sale recap. Nevertheless, sale recap should be fair and balanced, and the audio-recording process should not be taken as an opportunity for AIs to make disclaimers or waive an AI’s responsibilities. AIs should also put in place robust policies, procedures and controls to prevent any possible undue influence or misrepresentation by sales staff before the start of audio-recording. The audio records should be retained for seven years, or any longer period that the 1 “Complex investment products” refer to complex products other than (i) exchange-traded derivatives; and (ii) standardised structured deposits not regulated by the SFO (“Standardised Non-SFO-regulated Structured Deposits”). For definition of complex products and Standardised Non-SFO-regulated Structured Deposits, AIs should refer to guidance issued by the Securities and Futures Commission (“SFC”) and the HKMA.

Annex 1 4 AI deems necessary and appropriate (e.g. having regard to the opt-out arrangement set out below). Opt-out arrangement 4. The audio-recording requirement applies to both vulnerable customers (“VCs”) and non-VCs. A non-VC who has invested in a comparable product through the AI is allowed to opt out of the arrangement on a one-off basis for comparable products 2 , provided that: (i) the AI made a full disclosure of the key facts and risks of the product and conducted due selling process (including audio-recording) at the time of the first or previous transaction of that product3 ; and (ii) the AI obtained Opt-out Form with the customer’s written confirmation to opt out as described below. 5. In the Opt-out Form, AIs should set out important product information including key nature, features, structure, risks and payout structure of the investment product and the customer’s choice to opt out in plain language and an easily readable font. AIs should ensure the accuracy and completeness of the information in the Opt-out Form and work with the product issuer as appropriate to produce the Opt-out Form. 6. The process of obtaining a customer’s confirmation for opt-out arrangement is not required to be audio-recorded. 7. AIs should have proper controls and provide adequate training to prevent its staff from inducing non-VCs to opt out of the audio-recording arrangement. 8. For the avoidance of doubt, the existing requirements on the audio-recording of sale process conducted by telephone remain unchanged. Besides, AIs are reminded of their obligations to comply with the record keeping requirements (e.g. documentation of investment rationale under the SFC’s Frequently Asked 2 “Comparable products” for the purpose of this guidance is defined as investment products with the same key nature, features, structure and payout structure. Please refer to “comparable products” mentioned in section (A)(II.2) of Annex 1 for more details. 3 For the avoidance of doubt, an AI cannot rely on a customer’s self-declaration or a customer’s transaction records from another AI to determine that the customer has invested in a comparable product.

Annex 1 5 Questions (“FAQs”) 4 and maintenance of order records under the paragraph 3.9 of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (“SFC’s Code of Conduct”)). 4 FAQs on Compliance with Suitability Obligations.

Annex 1 6 (A) Sale of investment products (II) Selling process II.2 Risk disclosure for subsequent transactions of comparable products Principle

1. The objective of risk disclosure is to enable the customer to understand the investment product before entering into a transaction. AIs may adopt a risk-based approach, having regard to the circumstances, such as the customer’s trading pattern, level of sophistication and investment experience, as well as the product’s complexity and risk, in providing risk disclosure to customers. Supervisory requirements
2. An AI can streamline risk disclosure for subsequent transactions of an investment product comparable to the investment product for which risk disclosure has already been conducted previously by the AI, provided that the AI assures itself and maintains a record (either written or audio) to evidence that the customer understands the product.
3. “Comparable products” refer to investment products with the same key nature, features, structure and payout structure. For example, for equity-linked instruments (“ELI”) or currency-linked instruments (“CLI”), this would mean ELI or CLI with same key nature, features, structure and payout structure even if they are linked to different stock or currency (as the case may be). So long as the aforesaid conditions are satisfied, AIs may only need to disclose and explain any specific risks or different terms of the product (if any) to the customer, instead of repeating the full set of risk disclosure. AIs should maintain a proper record of relevant risk disclosure and be able to demonstrate that proper risk disclosure has been conducted to the customer in the first or previous transactions of a comparable product.
4. For example, two equity-linked deposits (“ELDs”) with the same key nature, features, structure and payout structure but linked to different single stock can be regarded as comparable products. For subsequent transactions of a comparable ELD, after the AI has assessed and maintained a record that the customer understands such ELD, the AI may not need to explain again the

Annex 1 7 generic terms such as “what is an equity-linked product”, the scenario analysis and the generic key risks if the customer agrees. The AI could focus on disclosing and explaining the differences such as the underlying assets, and the risk specifically related to the underlying assets. 5. AIs should exercise professional judgement to determine whether the investment products are comparable, and have in place adequate controls to prevent any abuse of this arrangement. For example, bonds within a broad category of “complex bonds” may not be comparable, as such broad-brush category may comprise a wide range of complex bonds with different nature, features, structure and payout structure. 6. For the avoidance of doubt, AIs should continue to comply with the requirement to provide customers with up-to-date product offering documents or information including up-to-date prospectuses, offering circulars and other up-to-date documents relevant to the transaction1 . II.3 On-going disclosure of a higher risk rating of investment products (for retail banking customers)

1. Where the continuous review by an AI of the risk ratings of the investment products it sells results in a higher risk rating being attributed to a product, the AI should disclose such increase in risk rating to customers to whom it recommended and sold the product. AIs should notify customers directly of the higher risk rating in writing, say through a monthly statement or a separate letter.
2. AIs will have no further obligation to make the disclosure to a customer who has closed his/her account or has the relevant investment product transferred to another AI’s account. 1 SFC’s FAQs on Compliance with Suitability Obligations.

Annex 1 8 (A) Sale of investment products (II) Selling process II.4 Assessment of customer’s concentration risk

1. As mentioned in the HKMA’s circular of 5 January 2012 “Selling of Investment Products”, AIs should make reference to the SFC’s Code of Conduct and the relevant SFC’s FAQs 1 , and take into consideration all relevant factors including the customer’s concentration risk, in performing suitability assessment. AIs should put in place reasonable methodology and threshold(s) for assessing such risk. While there may not be a single threshold that suits each and every circumstance, it is advisable to adopt a prudent approach. AIs may take into account relevant factors like product type and nature, product risk rating, and customer’s risk tolerance level and consider setting lower thresholds for higher risk products and lower customer’s risk tolerance level, and using cumulative basis instead of per transaction basis in calculating the concentration level.
2. The aforesaid relevant factors for assessing the customer’s concentration risk are examples. AIs should consider the factors relevant to a particular circumstance in assessing a customer’s concentration risk.
3. AIs could take into account a customer’s details of financial assets 2 in assessing the customer’s concentration risk. For example, AIs could base on information about the details of financial assets obtained in the know-your-customer process and periodic risk profiling review, or customer’s declaration for assessing the customer’s concentration risk. However, if the customer’s declaration is inconsistent with the AI’s available information, the AI should take appropriate step(s) to address the inconsistency, e.g. seek clarification from the customer. Besides, it is not acceptable for AIs to estimate or guess a customer’s details of financial assets without any evidence or based on sources other than those provided by the customer, such as media reports. AIs should remind the customer to advise the AI of any material changes, such as in the amount of financial assets. 1 FAQs on Compliance with Suitability Obligations. 2 Financial assets comprise investment products, deposits and certificates of deposits. Real estate properties are excluded from financial assets for the purpose of this guidance.

Annex 1 9 (A) Sale of investment products (II) Selling process II.5 Controls over transactions with mismatch(es) or exception(s)

1. AIs should ensure suitability of a transaction if it involves complex product or solicitation or recommendation. In assessing suitability, AIs should consider the overall effect of the investment products on their customers’ portfolios. For example, a transaction with mismatch(es) or exception(s) may not be unsuitable so long as it is commensurate with the risk return profile of the portfolio and other personal circumstances of the customer.
2. AIs should take extra care in handling transactions, involving complex product or solicitation or recommendation, with mismatch(es) or exception(s). In cases of sale of investment products to customers where there is a mismatch or exception, for example, a mismatch between the product risk rating and the customer’s risk profile, the bank staff should ensure the following: (i) alert the customer of the mismatch(es) or exception(s); (ii) document the reason for the transaction (e.g. justification of why the transaction is suitable for the customer); and (iii) obtain the customer’s acknowledgement for the transaction with mismatch(es) or exception(s). For the avoidance of doubt, merely customer’s acknowledgement for the transaction with mismatch(es) or exception(s) shall not discharge AIs’ suitability obligation where applicable. Unless the transaction with mismatch(es) or exception(s) involving complex product is assessed to be suitable to the customer, AIs should not distribute the product to the customer irrespective of whether the AI has obtained an acknowledgement from the customer.
3. For retail banking customers, there should also be an appropriate level of supervision to review and approve as appropriate a transaction with mismatch(es) or exception(s) before execution. An example could be conducting pre-trade approval by a supervisor of the frontline staff, or an officer from the second line of defence (such as operation or risk control). If AIs execute customers’ orders by batches or at day-end, the pre-trade approval can be conducted before the batch processing or day-end processing, instead of during the selling process, thereby shortening the selling process for the

Annex 1 10 customer. Further, the sale process for certain transactions with risk mismatch(es) should be audio-recorded (subject to the opt-out of audio recording arrangement) (please refer to section (A)(II.1) of Annex 1). For the avoidance of doubt, the control measures in this paragraph are not required for customers other than retail banking customers. 4. Senior management of AIs have the responsibility to ensure that adequate controls are in place and exercise adequate management oversight. An example of acceptable control measure is to review over statistics about investment transactions with mismatch(es) or exception(s) by dedicated members of the senior management team, and to take appropriate and prompt actions to address any issues or irregularities identified. Good practices 5. There could be more stringent controls over transaction(s) having serious or multiple mismatch(es) or exception(s). The level of controls and supervision could reflect the seriousness of mismatch(es) or exception(s) involved in the transaction(s).

Annex 1 11 (A) Sale of investment products (II) Selling process II.6 Pre-investment Cooling-off Period (“PICOP”) (applicable to retail banking customers only) Principle

1. PICOP is to provide additional protection to retail banking customers with less sophistication in respect of certain complex products. PICOP will allow the customer more time to consider the appropriateness of the investment and consult third parties if necessary. Supervisory requirements Key features of PICOP
2. Under the PICOP arrangements, after an AI has ensured that a relevant product is suitable for a customer and adequately disclosed material relevant information to the customer, the AI should allow the customer at least 2 calendar days (of which the last day should be a business day)1 to understand the product, consider the appropriateness of the investment and, if necessary, consult family members or third parties. The price(s) and terms of the transaction will be fixed on the day when the customer gives instruction to the AI to confirm placement of a purchase / subscription order upon the end of PICOP. The AI must put in place an arrangement for the customer to give specific confirmation of order placement on the execution day1 , supported by proper audit trail. Under no circumstances should the AI allow the customer to confirm the order instruction before the execution day1 . Application of PICOP
3. The scope and operational arrangements of PICOP as well as the expected controls are set out below. 1 Taking T as the sales day, execution day should be a business day on T+2 at the earliest. For example, if an AI performs suitability assessment and product disclosure (based on the indicative terms) for a customer on Wednesday (i.e. the sales day), the earliest execution day for this product would be Friday (assuming it is a business day). However, if the sales day is Friday, the earliest execution day would be next Monday (assuming it is a business day).

Annex 1 12 Scope of products covered 4. The following products will fall within the scope of PICOP: (i) all derivative products (excluding investment funds) that are not listed on an exchange in Hong Kong; and (ii) debentures that are not listed on an exchange in Hong Kong and have one or more of the following features: (a) extendable; (b) with loss-absorption features 2 ; (c) exchangeable or convertible where the right is exercisable by the holder of the subject debenture; and / or (d) exchangeable or convertible (other than (b) and (c)). Types of customers covered 5. PICOP is applicable to retail banking customers other than sole proprietors, partnerships and SMEs. Applicability of PICOP to particular dealings with customers 6. In determining whether PICOP is applicable to a particular dealing with a retail banking customer, the AI should consider the customer’s investment experience in the type of product 3 , age and asset concentration as follows:  For an elderly customer,  if he/she does not have investment experience for the type of product in question, PICOP should be mandatory, but the customer will be allowed to opt out if the customer’s asset concentration is below 20%. 2 Follows the definition of debt instruments with loss-absorption features referred in item (i) under the section of “Applicability” in the HKMA’s circular dated 30 October 2018 on “Sale and Distribution of Debt Instruments with Loss-absorption Features and Related Products”; and the HKMA’s circular dated 8 July 2019 on “Frequently Asked Questions on Sale and Distribution of Debt Instruments with Loss-absorption Features and Related Products”. 3 Product types include but not limited to currency-linked products, interest-rate linked products, equity-linked products, credit-linked products, derivatives traded over-the-counter, extendable debenture, debt instruments with loss-absorption features, exchangeable or convertible debenture where the right is exercisable by the holder of the subject debenture, and other exchangeable or convertible debenture, as well as any other product types specified by the HKMA from time to time.

Annex 1 13  For a non-elderly customer,  if (1) he/she does not have investment experience in the type of product in question and (2) the customer’s asset concentration is 20% or above, PICOP should be mandatory. 7. The above applicability of PICOP to retail banking customers is summarised in the following table: Applicability Elderly customers Non-elderly customers No investment experience in the relevant type of product Have investment experience in the relevant type of product No investment experience in the relevant type of product Have investment experience in the relevant type of product Asset concentration ≥ 20% Mandatory PICOP PICOP not necessary Mandatory PICOP PICOP not Asset concentration necessary < 20% Customer can opt out PICOP not necessary 8. For the purpose of PICOP, “asset concentration” is defined as the percentage of the customer’s amount of financial assets 4 to be invested in the relevant transaction, calculated using the nominal amount of the relevant transaction. For the purpose of ascertaining asset concentration, the AI may rely on self-declaration by the customer. 9. In determining whether a customer has investment experience in a particular type of product, an AI may take into account his/her investment transaction(s) executed through the AI or rely on the customer’s declaration that he/she has investment experience in the type of product in question (even if such investment transaction(s) were executed through other financial institutions). 10. PICOP applies to investment transactions conducted in an offline environment, irrespective of whether there is solicitation or recommendation, as well as those transactions with solicitation or recommendation conducted online. For the avoidance of doubt, PICOP does not apply to online transactions without 4 Financial assets comprise investment products, deposits and certificates of deposits. Real estate properties are excluded from financial assets for the purpose of this guidance. AIs may take into account the customer’s financial assets held with other financial institutions.

Annex 1 14 solicitation or recommendation. Controls to be adopted by AIs 11. AIs should put in place adequate control procedures and measures to ensure that the PICOP requirements in this circular are properly implemented and explained to relevant customers where PICOP is applicable. AIs should provide sufficient training to all relevant staff before the implementation of the PICOP arrangements and thereafter on an ongoing basis. Adequate records and supporting documents on the actual operations of PICOP should be maintained. In addition, regular reviews by an independent unit (e.g. the compliance function) on the compliance with the PICOP requirements should be performed. 12. AIs are reminded to incorporate the applicable PICOP arrangements, as appropriate, into Important Facts Statement for CLI and interest rate-linked instruments issued by AIs 5 . 5 Please refer to the HKMA’s circular dated 18 April 2011 on “Important Facts Statement (IFS) for Currency-Linked Instruments and Interest Rate-Linked Instruments issued by Authorized Institutions” for details of IFS requirements.

Annex 1 15 (A) Sale of investment products (II) Selling process II.7 Companion requirement for VCs (applicable to retail banking customers only)

1. For a VC, AIs should allow such VC to choose whether he/she would like to (i) bring along a companion to witness the sale process; and/or (ii) has a second front-line staff member to handle the sale (“Companion Requirement”). The VC can choose to have either, neither or both safeguard(s). The procedure of obtaining a VC’s choice regarding Companion Requirement can be conducted on a one-off basis for all product types or each product type categorised under the VC Assessment. AIs should adopt the choices of the VCs and maintain proper audit trails of the choices.
2. The role of the second front-line staff member is to witness the investment sale process to ensure that due selling process is being followed. The second front-line staff member is not required to repeat or recap the risk disclosure or suitability assessment, if the first front-line staff member has duly conducted the selling process. It is recommended that the second front-line staff member is a staff licensed or registered with relevant regulatory authorities, where applicable.
3. The Companion Requirement does not apply to online investment transactions, as it is not practicable in most cases.

Annex 1 16 (A) Sale of investment products (III) Know your customer III.1 Customer risk profiling (for retail banking customers)

1. AIs should put in place appropriate structure and procedures for the separation of the assessment of a customer’s risk profile and the sale process.
2. The HKMA expects that the assessment of a customer’s risk profile should be carried out by non-sales staff. However, in situations where this is not practicable, an independent review must be performed on the assessment of a customer’s risk profile conducted by sales staff. The independent review should satisfy the following criteria:  100% check on those assessments with customers graded above the medium risk category;  100% check on those assessments involving VCs graded above the lowest risk category;  Sample check (at least 20%) on those assessments of all other customers graded above the lowest risk category;  The independent review should cover all sales staff who have performed assessment of customers’ risk profile; and  In case exceptions are noted with the assessments performed by a sales staff, the AI should perform a more comprehensive review on the assessments performed by that staff.
3. The independent non-sales staff performing the customer risk profiling does not have to be a relevant individual, provided that the staff will not be involved in any activities that will fall within the definition of the various types of regulated activities and on the basis that: (i) the staff will only perform the customer risk profiling process, i.e. ask the customer to provide information for completion of a standardised questionnaire, record the answers (e.g. inputting into system) and inform the customer of the resultant risk rating assigned by the system as well as the corresponding allocation among different asset classes (but not specific products); and

Annex 1 17 (ii) the staff will not induce the customer to deal in securities and will not talk about specific investment products with the customer. On the same basis, the staff responsible for conducting the independent review for cases where the risk profiling is done by sales staff would not be required to be registered as a relevant individual. 4. Customers should be provided with a copy of the risk profile and asked to confirm his/her agreement that the risk profile is accurate. The assessment process should be audio recorded and the audio records should be retained for seven years.

Annex 1 18 (A) Sale of investment products (III) Know your customer III.2 Holistic assessment for VCs Principle

1. VCs are customers who have lower ability to understand the risks and withstand the potential losses of an investment. AIs are expected to exercise extra care when dealing with VCs and provide VCs with additional protection in certain circumstances.
2. In determining whether a customer is a VC, AIs should consider holistically the circumstances of a customer to assess the degree of riskiness or vulnerability that a customer may not be able to understand the risk and withstand the potential losses of an investment (“VC Assessment”). Among the circumstances of a customer, the core considerations should be the level of financial sophistication (e.g. investment experience of the customer), the state of mind (e.g. the ability of the customer to make investment decision), and the level of wealth of the customer which provides an indication on whether the customer could withstand the potential losses of an investment. In most cases, merely assessing a single attribute of the customer (e.g. age) may not be sufficiently risk-based or holistic. Suggested framework for VC Assessment
3. A suggested framework for VC Assessment for retail banking customers is set out below. In view of the nature of the clientele and the mode of operations of other businesses, AIs may use other frameworks for VC Assessment for non-retail banking customers (such as private banking customers) following the above principle.
4. Step 1: Assess whether a customer (referring to the person who makes investment decisions) has attribute(s) suggesting that he/she may be a VC, such as (i) elderly; (ii) with low level of education; (iii) having low net worth coupled with low income; or (iv) with observable disabilities (e.g. incapacitated, visually impaired, hearing impaired, etc.) which may affect the customer’s ability to make investment decisions.

Annex 1 19 5. Step 2(a): For a customer with any attribute(s) of (i) to (iii), assess the customer’s investment experience in “complex investment product” 1 and “other investment product” 2 . In determining a customer’s investment experience, an AI may take into account his/her investment transaction(s) executed through the AI or rely on the customer’s declaration that he/she has investment experience in the type of product in question (even if such investment transaction(s) were executed through other financial institutions). While no time limit is prescribed for determining the investment experience of a customer, AIs should consider the particular circumstances of each case. For example, AIs should be mindful that if the transaction was conducted too long ago by an aged customer, AIs should be more cautious in considering whether the customer understands the risk involved. 6. Take into account the customer’s investment experience, AIs should classify the customer as a VC/non-VC for complex investment products and other investment products respectively with reference to the following table: A customer with any attribute(s) of (i) to (iii) Has investment experience in “complex investment product”? Yes No Has investment experience in “other investment product”? Yes “Non-VC for all investment products” “VC for complex investment products only” (i.e. Non-VC for other investment products) No “VC for all investment products” 7. Step 2(b): For a customer with attribute (iv), such attribute may be sufficient for AIs to classify the customer as a VC. 8. Step 3: AIs should explain to the customer (who has attribute(s) suggesting that he/she may be a VC) the purpose of the VC Assessment and the 1 “Complex investment products” refer to complex products other than (i) exchange-traded derivatives; and (ii) Standardised Non-SFO-regulated Structured Deposits. For definition of complex products and Standardised Non-SFO-regulated Structured Deposits, AIs should refer to guidance issued by the SFC and the HKMA. 2 “Other investment products” include exchange-traded derivatives, Standardised Non-SFO-regulated Structured Deposits and other investment products.

Annex 1 20 consequence of being classified as a VC or non-VC (i.e. AIs will exercise extra care when dealing with VCs. For example, VCs cannot opt out of audio-recording; and VCs can choose to have a companion or another staff member to witness the sale process). AIs should ask the customer (who has attribute(s) suggesting that he/she may be a VC) to confirm whether he/she agrees with the VC Assessment result. If the customer disagrees with the assessment result, the customer could provide information to substantiate his/her choice. AIs may follow the customer’s choice where appropriate. An illustrative flowchart is enclosed in the next page for reference. 9. AIs should maintain proper record(s) on the VC Assessment. AIs are expected to review the VC Assessment on a regular basis, and when the AI is aware of any material changes in the customer’s circumstances that warrant an update on the VC Assessment. For the avoidance of doubts, for non-retail banking customers, AIs may keep the VC Assessment and result as an internal process and an internal record. 10. For customers who are both a retail banking customer and a non-retail banking customer (such as a private banking customer) of an AI at the same time, the AI may conduct the VC Assessment at customer level.

Annex 1 21 Flowchart of suggested framework for VC Assessment for retail banking customers Customer’s attribute(s) Assess whether a customer has any of the following attributes suggesting he/she may be a VC: (i) elderly; (ii) with low level of education; (iii) having low net worth coupled with low income; or (iv) with observable disabilities which may affect the customer’s ability to make investment decision No The customer has any one of (i) to (iii) The customer has (iv) Investment experience Assess whether the customer has investment experience in: (a) complex investment product; or (b) other investment product (as defined in the circular) Has investment experience in (b) only Has investment experience in (a) / (a) and (b) Non-VC Non-VC VC for complex investment products only VC Agree Disagree Follow the result as assessed AIs should:

• ask the customer to provide information to substantiate his/her choice; and
• may follow the customer’s choice where appropriate Customer’s agreement AIs should:
• explain to the customer the purpose of the VC Assessment;
• consequence of being classified as a VC or non-VC; and
• ask whether the customer agrees with the assessment result Neither (a) nor (b)

Annex 1 22 (A) Sale of investment products (IV) Controls and monitoring IV.1 Mystery shopper programme (applicable to retail banking customers only)

1. AIs should put in place appropriate mystery shopper programme to test sales procedures.

Annex 1 23 (A) Sale of investment products (V) Product-specific guidance V.1 Investment products not regulated by the SFO

1. As a general principle, in the selling of investment products not regulated by the SFO (“non-SFO-regulated investment products”), such as currency and interest rate linked deposits, AIs are expected to follow similar standards as those applicable to SFO-regulated investment products.
2. In particular, AIs must treat their customers fairly and take into account customers’ interests in offering their advice and financial products. Where advice is provided, the advice should be objective and should be based on the customer’s profile, considering the complexity of the product, the risks associated with it as well as the customer's financial objectives, knowledge, capabilities and experience. AIs should set out and explain clearly the key features, risks and terms of the products, fees, commissions or charges applicable, and make available the details of these to customers. Marketing materials must be clear, fair and present a balanced picture with adequate and prominent risk disclosure.
3. For non-SFO-regulated structured investment products, AIs are also expected to follow the relevant regulatory requirements issued by the SFC1 as well as those required by the HKMA, whereas AIs may apply the exemptions related to the relevant SFC’s requirements for Institutional Professional Investors and Corporate Professional Investors 2 . 1 Please refer to the relevant HKMA’s circulars for details, including but not limited to:

• 20 December 2012 on “Applicability of the Securities and Futures Commission (SFC)’s regulatory requirements to sale of structured products that are not regulated by the Securities and Futures Ordinance”;
• 5 January 2018 on “Enhanced disclosure requirements on sale of structured products not regulated by the Securities and Futures Ordinance (SFO)”;
• 25 May 2018 on “Circular on Disclosure Requirements Applicable to Non-SFO-regulated Structured Investment Products under Discretionary Accounts’; and
• 30 October 2018 on “Requirements Applicable to Online and Offline Distribution of Non-SFO-Regulated Structured Investment Products”. 2 “Institutional Professional Investors” refer to that defined in the SFC’s Code of Conduct. For the purpose of this circular, “Corporate Professional Investors” refer to those professional investors where AIs have complied with paragraphs 15.3A and 15.3B of the SFC’s Code of Conduct.

Annex 1 24 4. Having regard to the nature of Standardised Non-SFO-regulated Structured Deposit 3 , AIs should conduct suitability assessment (where applicable) and make proper disclosure of the key facts and risks inside the Non-deposit-taking Area at the time of the first transaction of a Standardised Non-SFO-regulated Structured Deposit with the AI concerned. For roll-over and repeated transaction of the same product, AIs may conduct such transaction in deposit-taking area. 5. Financial or other incentives (e.g. gifts) to invest in a product should not be used or presented in a way that is likely to divert or mislead investors’ focus from the proper consideration of the product. V.2 Investment products sold through private placement

1. Product issuers may distribute investment products through the “private placement” channel only if the distribution meets the prescribed exemptions under the Companies (Winding Up and Miscellaneous Provisions) Ordinance (“CWUMPO”) 4 . AIs must be satisfied that the use of the private placement channel for distributing investment products is appropriate and justified. In particular, AIs must be careful when dealing with schemes involving recurrent series of substantially similar products with minimal changes in product features and ensure that these schemes fully meet the prescribed exemptions for private placement. Investment products sold through private placement should be distributed only to professional investors, or to retail banking customers with a minimum investment in the product of not less than HK$500,000. V.3 Expand the list of major currencies for asset concentration assessment for foreign exchange (“FX”) accumulators
2. For the purpose of the HKMA’s circular entitled “Foreign Exchange Accumulators and Non-leveraged Renminbi-Linked Deposits” dated 7 March 20145 , Singapore Dollar is included into the list of major currencies. 3 For definition of Standardised Non-SFO-regulated Structured Deposits, AIs should refer to guidance issued by the HKMA. 4 Seventeenth Schedule to the CWUMPO. 5 AIs are allowed to use a flexible approach in the calculation of asset concentration for FX accumulators in major currency pairs.

Annex 1 25 (B) Sale of insurance products and mandatory provident fund (“MPF”) products (I) Physical segregation (applicable to retail banking customers only)

1. The streamlined measures set out in section (A)(I) of Annex 1 are applicable to AIs’ selling and marketing of investment-linked assurance scheme (“ILAS”) products and MPF registered schemes or constituent funds (as well as the customer’s selection of constituent funds) to retail banking customers.
2. The selling and marketing of annuity insurance products to retail banking customers should be conducted at Non-deposit-taking Area 1 . It is clarified that deposit-taking activities incidental to the annuity insurance transactions are allowed at Non-deposit-taking Area and could be handled by staff therein.
3. Along the existing requirements, the physical segregation requirements do not apply to the following list of general insurance and traditional long term insurance products: General insurance products  Accident; Sickness; Land vehicles; Fire and natural forces; Damage to property; Motor vehicle liability; General liability; Credit; Miscellaneous financial loss; and Legal expenses. Traditional long term insurance products  Life and annuity (subject to paragraph 2 above); Permanent health; and Retirement scheme management (except MPF products). For these traditional long term insurance products, AIs should include the Specimen Warning Statement2 . 1 Refer to the HKMA’s circular dated 6 June 2018 on “Selling of Annuity Insurance Products”. 2 Refer to footnote 7 of Annex to the HKMA’s circular dated 8 December 2014 on “Selling of Non-Linked Long Term Insurance (“NLTI”) Products”.

Annex 1 26 (II) Audio-recording 4. All existing regulatory requirements in respect of audio-recording for the sale of annuity insurance products1 and ILAS products3 by AIs remain applicable, but only to retail banking customers. 5. Along the existing requirements, AIs may record only the sale recap for sale of annuity insurance products and ILAS products. The sale recap should be fair and balanced, and the audio-recording process should not be taken as an opportunity for AIs to make disclaimers or waive an AI’s responsibilities. AIs should also put in place robust policies, procedures and controls to prevent any possible undue influence or misrepresentation by sales staff before the start of audio-recording. 6. For MPF products, AIs should follow the audio-recording requirements set out in the HKMA’s circular dated 18 September 2012 on “Sale and marketing of Mandatory Provident Fund (“MPF”) schemes”. (III) On-going disclosure of a higher product risk rating (for retail banking customers4 ) 7. Where the continuous review by an AI of the risk ratings of the underlying investment choices of ILAS products results in a higher risk rating, the AI should adopt the measures mentioned in section (A)(II.3) of Annex 1. (IV) Assessment of customer’s concentration risk 8. In performing suitability assessment for ILAS products, AIs should adopt the principles of assessment of customer’s concentration risk set out in section (A)(II.4) of Annex 1, and take into account, among other relevant factors, the 3 Refer to the HKMA’s circular dated 14 March 2011 on “Enhanced Regulatory Requirements on Selling of Investment-Linked Assurance Scheme (ILAS) Products”. 4 For the avoidance of doubt, in respect of on-going disclosure of a higher product risk rating and customer risk profiling, AIs should adopt the enhanced investor protection measures as set out in the relevant HKMA’s circulars dated 20 January 2012 on “Applicability of Enhanced Measures to Sales of Investment Products to Private Banking Customers” and dated 20 December 2012 on “Applicability of Enhanced Measures to Sale of Investment Products to Corporate Customers” in dealing with non-retail customers.

Annex 1 27 cumulative concentrations in ILAS products and in the underlying investment choices having regard to the customer’s total investments. AIs are reminded that in measuring the amount of ILAS policy for calculating asset concentration, the total amount of premium payable by the customer within the premium contribution period and other relevant factors such as how long the customer intends to hold the policy should be taken into consideration. (V) Controls over transactions with mismatch(es) or exception(s) 9. The controls over transactions with mismatch(es) or exception(s) set out in section (A)(II.5) of Annex 1 are applicable for AI’s sale of long term insurance products (including a new policy, top-up to an existing policy and a new rider to an existing policy, as well as switching of an underlying investment choice of an existing ILAS policy), while the audio-recording of sale process is only applicable to annuity insurance products (subject to the opt-out of audio-recording arrangement)1 and ILAS products. 10. For MPF products, AIs should follow the relevant requirements set out in the Guidelines on Conduct Requirements for Registered Intermediaries issued by the Mandatory Provident Fund Schemes Authority and the HKMA’s circular dated 18 September 2012 on “Sale and marketing of Mandatory Provident Fund (“MPF”) schemes” in handling MPF transactions with mismatch. (VI) Companion requirement for VCs (applicable to retail banking customers only) 11. The Companion Requirement set out in section (A)(II.7) of Annex 1 is applicable to AIs’ sale of long term insurance products to VCs (including a new policy, top-up to an existing policy and a new rider to an existing policy, as well as switching of an underlying investment choice of an existing ILAS policy). In addition, when selling long term insurance products to elderly customers, regardless of whether the customers are classified as a VC, AIs should alert the customers to the tenor and the premium contribution period of the product.

Annex 1 28 (VII) Customer risk profiling (for retail banking customers4 ) 12. The measures mentioned in section (A)(III.1) of Annex 1 are applicable to AIs’ sale of ILAS products. As for the retention period, the audio-records of the customer risk profile assessment process for ILAS should be adequately maintained and readily accessible as and when necessary to demonstrate that the assessment has been duly conducted. (VIII) Holistic assessment for VCs 13. VCs are customers who have lower ability to understand the risks and withstand the potential losses of an insurance transaction. AIs are expected to exercise extra care when dealing with VCs and provide VCs with additional protection in certain circumstances in selling long term insurance products. This includes not only a new policy, but also top-up or a new rider to an existing policy, as well as switching of an underlying investment choice of an existing ILAS policy. 14. In respect of the VC Assessment for the sale of long term insurance products, AIs should adopt the principles and requirements as set out in section (A)(III.2) of Annex 1, save for the details of the suggested framework which are elaborated in the following paragraphs in the context of long term insurance products. Suggested framework for VC Assessment for long term insurance products 15. A suggested framework for VC Assessment for retail banking customers is set out below. In view of the nature of the clientele and the mode of operations of other businesses, AIs may use other frameworks for VC Assessment for non-retail banking customers (such as private banking customers) following the same principles. 16. Step 1: Assess whether a customer (referring to the person who makes insurance decisions) has attribute(s) suggesting that he/she may be a VC, such as (i) elderly; (ii) with low level of education; (iii) having low net worth coupled with low income; or (iv) with observable disabilities (e.g. incapacitated, visually impaired, hearing impaired, etc.) which may affect the customer’s ability to make insurance decisions.

Annex 1 29 17. Step 2(a): In respect of non-investment-linked long term insurance (“NLTI”) products, for a customer with any attribute(s) of (i) to (iii), assess the customer’s insurance experience in (a) annuity insurance product5 ; and (b) other NLTI product. In determining a customer’s insurance experience, an AI may take into account his/her insurance transaction(s) conducted with the AI or rely on the customer’s declaration that he/she has insurance experience in the type of product in question (even if such insurance transaction(s) were conducted with other financial institutions). While no time limit is prescribed for determining the insurance experience of a customer, AIs should consider the particular circumstances of each case. For example, AIs should be mindful that if the transaction was conducted too long ago by an aged customer, AIs should be more cautious in considering whether the customer understands the risk involved. 18. Take into account the customer’s insurance experience, AIs should classify the customer as VC/non-VC for annuity insurance products5 and other NLTI products respectively with reference to the following table: A customer with any attribute(s) of (i) to (iii) Has experience in annuity insurance product? Yes No Has experience in other NLTI product? Yes “Non-VC for all NLTI products” “VC for annuity insurance products only” (i.e. Non-VC for other NLTI products) No “VC for all NLTI products” 19. Step 2(b): For a customer with attribute (iv), such attribute may be sufficient for AIs to classify the customer as a VC. 20. Step 3: AIs should explain to the customer (who has attribute(s) suggesting that he/she may be a VC) the purpose of the VC Assessment and the consequence of being classified as a VC or non-VC (i.e. AIs will exercise extra care when dealing with VCs. For example, VCs cannot opt out of audio-recording for annuity insurance products; and VCs can choose to have a companion or another staff member to witness the sale process). AIs should ask the 5 For the purpose of insurance experience and whether a customer is a “VC for annuity insurance products”, “annuity insurance product” includes other NLTI products that may annuitise the cash value of the policy.

Annex 1 30 customer (who has attribute(s) suggesting that he/she may be a VC) to confirm whether he/she agrees with the VC Assessment result. If the customer disagrees with the assessment result, the customer could provide information to substantiate his/her choice. AIs may follow the customer’s choice where appropriate. An illustrative flowchart is enclosed in the next page for reference. 21. As far as step 2(a) in paragraph 17 above is concerned, in respect of ILAS products, AIs should assess a customer’s experience in both (a) ILAS product; and (b) underlying investment choice (according to the suggested assessment framework stipulated in section (A)(III.2) of Annex 1). For a customer with any attribute(s) of (i) to (iii) in paragraph 16 above, if he/she does not have experience in both ILAS product and the product type to which the underlying investment choice belongs, AIs should classify the customer as a VC.

Annex 1 31 Flowchart of suggested framework for VC Assessment for retail banking customers (for NLTI products) Customer’s attribute(s) Assess whether a customer has any of the following attributes suggesting he/she may be a VC: (i) elderly; (ii) with low level of education; (iii) having low net worth coupled with low income; or (iv) with observable disabilities which may affect the customer’s ability to make insurance decision No The customer has any one of (i) to (iii) The customer has (iv) NLTI product experience Assess whether the customer has experience in: (a) annuity insurance product5 ; or (b) other NLTI product Has experience in (b) only Has experience in (a) / (a) and (b) Non-VC Non-VC for all NLTI products VC for annuity insurance products5 only VC for all NLTI products Agree Disagree Follow the result as assessed AIs should:

• ask the customer to provide information to substantiate his/her choice; and
• may follow the customer’s choice where appropriate Customer’s agreement AIs should:
• explain to the customer the purpose of the VC Assessment;
• consequence of being classified as a VC or non-VC; and
• ask whether the customer agrees with the assessment result Neither (a) nor (b)

Annex 1 32 (IX) Mystery shopper programme (applicable to retail banking customers only) 22. AIs’ “mystery shopper” programmes should cover their sale of long term insurance products for retail banking customers.

Annex 2 1 Previous guidance superseded

1. The following circulars are superseded by this circular on the relevant implementation dates as stated in the circular:  The HKMA’s circular dated 11 December 2008 “Selling of investment products to retail customers” and the letter with the same title issued by the HKMA to retail banks on 23 October 2008  The HKMA’s circular dated 25 March 2009 on “Implementation of recommendations in the HKMA’s Report on Issues Concerning the Distribution of Structured Products Connected to Lehman Brothers”  The HKMA’s circular dated 13 July 2009 on “Selling of Investment Products”  The HKMA’s circular dated 20 May 2010 on “Implementation of Pre-Investment Cooling-off Period for Retail Customers”  The HKMA’s circular dated 6 April 2011 on “Streamlined sales process for investment products”  Recommendations 5, 15 and 18 of Annex to the HKMA’s circular dated 20 January 2012 on “Applicability of Enhanced Measures to Sales of Investment Products to Private Banking Customers”  The HKMA’s circular dated 19 November 2012 on “Selling of Fixed Income Products”  Paragraphs 4.1, 6.2, 6.5 and 6.6 of Annex to the HKMA’s circular dated 14 March 2011 on “Enhanced Regulatory Requirements on Selling of Investment-Linked Assurance Scheme (ILAS) Products”  The section of “Sale and marketing activities and constituent funds selection in branches” in the HKMA’s circular dated 18 September 2012 on “Sale and marketing of Mandatory Provident Fund (“MPF”) schemes”  The expected standard set out in the “Asset concentration” section of the HKMA’s circular dated 22 April 2013 on “Selling of investment-linked assurance scheme (ILAS) products”

Annex 2 2  Paragraphs 3.10 and 4.1 of Annex to the HKMA’s circular dated 8 December 2014 on “Selling of Non-Linked Long Term Insurance (“NLTI”) Products”  Examples of VC mentioned in the HKMA’s circulars dated 3 March 2006 on “Retail Wealth Management (RWM) Business”, 14 March 2011 on “Enhanced Regulatory Requirements on Selling of Investment-Linked Assurance Scheme (ILAS) Products”, 8 December 2014 on “Selling of Non-linked Long Term Insurance (“NLTI”) Products” and 6 June 2018 on “Selling of Annuity Insurance Products”