Management Accountability at Registered Institutions Annex 1: Frequently Asked Questions

Management Accountability at Registered Institutions Frequently asked questions Q1: In respect of management of Registered Institutions (RIs), what is the expectation of the Hong Kong Monetary Authority (HKMA) in identifying individuals as principally responsible for businesses that constitute regulated activities (RAs)? A1: Section 72B of the Banking Ordinance (BO) requires authorized institutions (AIs) to notify the HKMA of the appointments of managers (or “section 72B managers”) for the businesses and functions listed in the Fourteenth Schedule to the BO. It is however not a current practice to inform the HKMA of the businesses overseen by individual alternate chief executives (ACEs) or directors approved under section 71 1 , while chief executives (CEs) are clearly responsible for overall management of an AI, including its operations in conducting RAs as an RI. To better identify lines of responsibility and accountability within the institutions, RIs are expected to identify at least one individual as principally responsible for the overall management of the whole business of the RI (generally the CE) as well as managing each of the businesses or functions listed in paragraphs 2 to 8 of the Fourteenth Schedule to the BO, to the extent that these individuals are involved in the management of the business constituting any RA for which the RI is registered2 . In terms of seniority, such individuals are expected to be (i) CEs, including ACEs; (ii) directors approved under section 71 of the BO; or (iii) section 72B managers. Q2: Where directors are referred to in this guidance, do they cover non-executive directors (NEDs) and independent non-executive directors (INEDs)? A2: The HKMA does not expect NEDs and INEDs to be responsible for day-to-day management of RAs or other businesses, so they should not be regarded as “management” for the purposes of this guidance. However, the board of an AI (including an RI) has the ultimate responsibility for the operations and the financial soundness of the AI, including businesses that constitute RAs. 1 All references to “directors” in the guidance apply to locally-incorporated RIs only. 2 Where the RI regards an individual business as relatively small-scale within its overall business, it is acceptable to group more than one business under one such individual.

• 2 - Q3: Are all CEs, ACEs, directors and section 72B managers of RIs required to seek approval to become Executive Officers (EOs)? A3: While these persons are often also EOs, the HKMA does not require CEs, ACEs, directors or section 72B managers to be all approved as EOs. This recognises the wide scope of businesses conducted by RIs, and that CEs, ACEs, directors and section 72B managers are often responsible for general banking businesses in addition to the conduct of RAs, and may not be responsible for direct supervision of RAs on a day-to-day basis. However, we remind RIs that, following the general principles set out in Supervisory Policy Manual (SPM) module SB-13 , it is already a requirement that any CEs, ACEs or directors who are directly responsible for supervising the conduct of RAs should be appointed as EOs in respect of the RA(s) they oversee4 and the HKMA may require individuals to become EOs if appropriate. RIs should also ensure that at least one of the EOs for a given RA should be a CE, ACE, director or section 72B manager. In addition, RIs should ensure that all EOs are not more than one rank below the CE, ACE, director or section 72B manager, if they do not themselves fall into these categories, so as to ensure that he or she has sufficient authority to conduct or oversee the relevant RA. Some flexibility may be allowed on exceptional basis subject to adequate justifications, where the HKMA will take into account the size of the RI, the significance of the RA in relation to the overall business of the institution, the management structure as well as the reporting line of the EOs. We also take this opportunity to remind that under Part IX of the Securities and Futures Ordinance (SFO), a person involved in the management of the business constituting any RA in RIs is “regulated person” 5 , regardless of whether or not he or she is registered as Relevant Individual (including EO), and is subject to the disciplinary powers under SFO. 3 SPM module SB-1 “Supervision of regulated activities of SFC-registered authorized institutions” 4 Please refer to paragraph 3.1.13 of the SPM module SB-1. 5 Section 196(8)(c) of the SFO defines “regulated person” as including “a person involved in the management of the business constituting any regulated activity for which a registered institution is or was (as the case may be) registered.”

• 3 - Q4: How to determine whether an individual should be identified as principally responsible for a particular business or function? A4: To identify an individual as principally responsible for the overall management of the whole business of the RI as well as managing each of the businesses or functions listed in paragraphs 2 to 8 of the Fourteenth Schedule to the BO, to the extent that these individuals are involved in the management of the business constituting any RA for which the RI is registered, RIs are expected to take into account the individual’s seniority and authority within the RI6 . We expect such individuals to be CEs, ACEs, directors, or section 72B managers. Generally, the CE of an RI is principally responsible for the overall management of the whole business of the RI. For the remaining businesses or functions, a CE, ACE, director or section 72B manager of the RI should be identified as principally responsible 7 . For example, if an ACE is principally responsible for private banking under paragraph 2(b) of the Fourteenth Schedule to the BO, he or she should be identified as principally responsible for private banking to the extent that the private banking business constitutes one or more RAs, even though he or she may not be required to be appointed as a section 72B manager according to the requirements in SPM module CG-2. Another example is that a section 72B manager for institutional banking under paragraph 2(e) of the Fourteenth Schedule need not be identified as principally responsible for that function if the institutional banking business does not constitute any RAs. In exceptional cases where any RA conducted by an RI does not fall under the business areas managed by section 72B managers appointed for the areas listed in subparagraphs (a) to (f) of paragraph 2 of the Fourteenth Schedule to the BO, the business of such RA should be regarded as material to the RI and therefore covered by at least one section 72B manager. With regard to the functions listed in paragraphs 3 to 8 of the Fourteenth Schedule to the BO, it is considered that the roles of these functions, including but not limited to compliance, risk management and internal audit, are of no less importance than the 6 Reference can be made to the attributes set out in paragraph 2.3.3 of SPM module CG-2 “Systems of control for the appointment of managers”. 7 For the purpose of appointment of section 72B managers, if an individual is principally responsible for the conduct of a particular business or activity of an authorized institution but is also its director, CE or ACE, that individual does not fall within the definition of a manager (Footnote 4 of SPM module CG-2). Notwithstanding this, an RI should identify that person as principally responsible for a business or function listed in the Fourteenth Schedule to the BO for the purpose of this guidance.

• 4 - front office roles with respect to RA business. For example, if more than one CE, ACE, director or section 72B manager are jointly responsible for a compliance function and one of them principally covers matters relating to RA business while the others cover those relating to non-RA business, the former (but not the latter) should be identified as principally responsible for the compliance function in relation to RAs. However, if the responsibilities of an individual overseeing such a function cover both RA and non-RA businesses, he/she should be captured for the purpose of this guidance. Q5: Is an ACE (in his/her capacity as acting CE) required to be identified as principally responsible for the overall management of the whole business of the RI? A5: No, so far as the ACE only acts for the CE who is precluded by illness or absence from carrying out his or her function on a temporary basis. Please also see Question 10 below. Q6: Are RIs required to identify a CE, ACE, director or section 72B manager as principally responsible for each key business line listed in paragraph 2 of the Fourteenth Schedule to the BO? A6: As illustrated in the example in the answer to Question 4 above, if a key business line of the RI does not constitute any RA business, it is not necessary for the RI to identify a CE, ACE, director or section 72B manager as principally responsible for that business line. However, this does not affect the requirement to notify the HKMA of the appointment of a manager under section 72B of the BO. Q7: Can an RI identify more than one individual as principally responsible for a particular business or function? A7: Yes. An RI may identify more than one CE, ACE, director or section 72B manager for a particular function if more than one individual is jointly principally responsible for that business or function.

• 5 - Q8: Can an individual be identified as principally responsible for more than one business or function? A8: Yes, if the individual is principally responsible for more than one business or function. Q9: Does an individual identified as principally responsible for a function have to be an employee of an RI? Can an RI identify an independent third party to which a function of the RI is outsourced as principally responsible for that function? A9: It is not necessary for a person to be an employee of the RI as long as that person has sufficient authority within the RI and holds accountability for the function for which he or she is identified as principally responsible. For example, he or she can be an employee of the RI’s parent bank or group company, which supports a particular function, such as information technology or internal audit, of the RI. In cases where certain services or functions of an RI have been outsourced to an independent third party, the management of the RI should retain the ultimate accountability of the outsourced function. In this regard, we expect a member of the RI’s management, rather than an independent third party, should be identified as principally responsible for that outsourced function. Q10: Is an RI required to identify someone who is principally responsible for a business or function on a temporary basis only (e.g. to provide cover for a member of management who is precluded by illness or absence from carrying out his or her functions or to fill a position temporarily pending a permanent appointee)? A10: No, provided that the appointment is expected to last for no more than a few months and is not expected to be permanent. However, if a temporary appointment becomes permanent, the RI should notify the HKMA and the Securities and Futures Commission (SFC) of the change within 14 days.

• 6 - Q11: Are persons identified as principally responsible for the overall management of the whole business of the RI as well as the businesses or functions listed in paragraphs 2 to 8 of the Fourteenth Schedule to the BO required to fulfil any fit and proper requirement? A11: We expect such persons to be CEs, ACEs or directors approved under section 71 of the BO or section 72B managers. Section 71 requires approval given by the HKMA, which should be satisfied that the person seeking such approval is fit and proper 8 , while an RI is required to put in place adequate systems of control to ensure that each section 72B manager should be a fit and proper person9 . As such, the fit and proper requirement is already covered by sections 71 and 72B of the BO and relevant SPM modules. Q12: How should RIs inform the HKMA on the relevant information about the individual businesses or functions for which management of RIs are responsible? A12: Relevant information on individual CEs, ACEs, directors and section 72B managers principally responsible for RA business should be submitted to the HKMA and the SFC using the forms at the Appendix. In addition, an organisation chart should be provided depicting the RI’s management and governance structure relevant to its RA business and showing the CE, ACEs, directors and section 72B managers identified for the purpose of this guidance and the RAs and individual businesses or functions for which they are responsible, as well as their respective reporting lines and the job titles of the persons reporting directly to them. The forms and organisation chart should indicate clearly the lines of responsibility and accountability for the conduct of RA business as well as the overall management of the whole business of the RI. Q13: Should RIs or the individuals concerned be responsible for the submission of information? A13: RIs, rather than the individuals concerned, should be responsible for submitting the relevant information to the HKMA and the SFC. RIs should ensure the accuracy and completeness of the information submitted and that each CE, ACE, director or 8 The relevant requirements are set out in the SPM module CG-1 “Corporate governance of locally-incorporated authorized institutions”. 9 The relevant requirements are set out in the SPM module CG-2 “Systems of control for the appointment of managers”.

• 7 - section 72B manager has acknowledged his or her responsibility for the particular business(es) or function(s) for which he or she is identified. Q14: When will the information submission take effect? A14: To allow sufficient time for preparatory work, RIs are expected to report the required information including organisation charts starting from 16 March 2018. The submission should be made to the HKMA and the SFC on or before 16 April 2018. Updates should be submitted to the HKMA and the SFC using the forms at the Appendix within 14 days of the change taking effect whenever there are any new appointments or cessation of appointments of individuals principally responsible for the relevant businesses or functions, changes in the personal particulars of the individuals, changes in the RAs or the businesses or functions for which the individuals are principally responsible, or changes in respective reporting lines. An updated organisation chart should be submitted along with the change except if it only involves a change of an individual’s personal particulars. Submissions should be made to the HKMA at RI_management_info@hkma.iclnet.hk and the SFC at mpra@sfc.iclnet.hk. In the event of an RI having any implementation issues, they may approach their usual supervisory contacts at the Banking Conduct Department of the HKMA. Q15: Are AIs applying for registration as an RI or existing RIs applying for addition of RA(s) required to provide the information set out in Question 12? A15: Starting from 16 April 2018, such applicants should submit to the HKMA the same information set out in Question 12 in support of their applications. Upon approval of the applications, the ongoing notification requirement outlined in Question 14 above should be followed.