Regtech Adoption Practice Guide Eighth Issue: Sales Practices and Suitability

Regtech Adoption Practice Guide Issue #8: Sales Practices and Suitability October 2022 Disclaimer Regtech Adoption Practice Guide is a publication published by the Hong Kong Monetary Authority (HKMA). It should be noted that the sole purpose of this publication is to provide Authorized Institutions (banks) with information on the latest regulatory technology (Regtech) developments. The industry practices and views described in this adoption practice guide are collected by KPMG. The HKMA does not endorse any use cases, solutions and/or implementation guidance described in this adoption practice guide. If a bank intends to adopt a particular solution or implementation, it should undertake its own due diligence to ensure that the technology or approach is suitable for its circumstances.

Regtech Adoption Practice Guide | Sales Practices and Suitability | 3 Contents 1 Introduction 1.1 Background 1.2 Purpose 2 Sales practices and suitability 2.1 Key challenges 2.2 How can sales suitability Regtech solutions help 2.3 Virtual customer risk profiling 2.4 Product due diligence automation 2.5 Digital sales advisory 2.6 Management supervision 3 Implementation guidance 3.1 Regtech implementation framework 4 Regtech use cases 4.1 Use Case #1 Product due diligence workflow and database 4.2 Use Case #2 Sales suitability supervision 5 Conclusion A Appendix A.1 Acknowledgements A.2 Relevant regulatory requirements and/or guidance 4 4 5 6 6 9 10 11 12 12 14 14 17 17 18 21 22

4 | Regtech Adoption Practice Guide | Sales Practices and Suitability 1.1 Background The value of Regtech in banking is coming to the fore in Hong Kong, offering clear benefits to banks, customers, and regulators. In November 2020, the HKMA released a two-year roadmap to promote Regtech adoption in Hong Kong, as laid out in a White Paper titled “Transforming Risk Management and Compliance: Harnessing the Power of Regtech”.1 The White Paper identified 16 recommendations across five core areas to accelerate the further adoption of Regtech in Hong Kong. The White Paper acknowledges that since 2019, the HKMA has published a series of “Regtech Watch” newsletters, introducing banks to Regtech use cases on the adoption of innovative technology to enhance risk management and regulatory compliance. The banks interviewed for the White Paper cited these newsletters as a valuable source of information and guidance, especially the actual or potential Regtech use cases that have been rolled out or are being explored in Hong Kong or globally. 01 Introduction The White Paper identified 26 specific application areas of Regtech that can benefit banks. There are significant opportunities and a strong desire from the industry for the HKMA to develop and issue “Regtech Adoption Practice Guides” around these application areas. As a successor, this Regtech Adoption Practice Guide (Guide) series builds on the “Regtech Watch” newsletters to include common industry challenges, guidance on implementation, and examples of what others have done successfully to overcome adoption barriers. The Guides are meant to supplement other ongoing HKMA initiatives such as the Banking Made Easy initiative, the Fintech Supervisory Sandbox, and the Fintech Supervisory Chatroom. Ultimately, the Guides should enhance the sharing of experience related to Regtech implementation in the industry, which will help to further drive Regtech adoption in Hong Kong. 1 Transforming Risk Management and Compliance: Harnessing the Power of Regtech, HKMA (November 2020), https://www.hkma.gov.hk/media/eng/doc/key-information/press￾release/2020/20201102e3a1.pdf

Regtech Adoption Practice Guide | Sales Practices and Suitability | 5 This eighth Guide of the series focuses on sales practices and suitability and related Regtech solutions. Sales conduct, especially sales suitability, remains a primary focus of regulators in Hong Kong, given the investor protection agenda. In recent years, the HKMA has issued further guidance with respect to Authorized Institutions’ selling of investment products, emphasising pre-trade disclosures, risk and suitability assessment, and controls and monitoring. To further enhance investor protection, the Securities and Futures Commission (SFC) issued a Circular in 2019 setting out guidance on the regulatory requirements for the sale of complex products. Emerging asset classes have also garnered regulatory scrutiny, with the HKMA and SFC publishing a joint circular addressing the regulatory requirements for virtual assets. Sales suitability has been a constant and unfaltering regulatory focus and will continue to be an area of attention with the advent of new activities and market development. 1.2 Purpose The purpose of this Guide is to provide an overview of Regtech solutions in relation to sales suitability, outline the common challenges observed during implementation, and share experience on how banks have addressed the challenges to successfully adopting Regtech solutions in their organisations. This Guide follows the outline below: 1 Explain how Regtech solutions can be used to support sales practices and suitability • Outline the key challenges that banks in Hong Kong are facing in sales suitability • Illustrate the benefits of leveraging Regtech solutions for sales suitability • Describe the key considerations when adopting Regtech solutions for sales suitability 2 Provide practical implementation guidance to banks on the adoption of Regtech solutions for sales practices and suitability • Offer an implementation framework for adopting and embracing Regtech solutions for sales suitability • Describe the key implementation components and considerations for sales suitability 3 Share use cases on the adoption of Regtech solutions for sales practices and suitability • Describe the challenges faced by banks regarding sales suitability and how the Regtech solution can help address these challenges • Provide insights on the key success factors of successful Regtech implementation from the perspectives of the bank and the Regtech solution provider

6 | Regtech Adoption Practice Guide | Sales Practices and Suitability 2.1 Key challenges Culture, conduct and investor protection have been top of mind for regulators in recent years, with guidance proportionate to the risks involved issued to protect customers. Treating customers fairly lies at the heart of investor protection. As a result, sales suitability and related risks, such as mis-selling, misconduct, and the broader issue of conflicts of interest, have been a key regulatory focus in Hong Kong. The HKMA and the SFC have also collaborated 02 Sales practices and suitability on suitability-related examinations and investigations, heightening regulatory scrutiny. A conventional sales suitability framework consists of four pillars: customer risk profiling (CRP), product due diligence (PDD), sales and advisory, and management supervision. Against the backdrop of increased product complexity and rising sales volumes, the traditional sales suitability framework and process have drawbacks which calls for more innovative solutions. Below we lay out some of these challenges and issues with the current approaches.

Regtech Adoption Practice Guide | Sales Practices and Suitability | 7

1. Customer risk profiling Figure 1: Key components of sales suitability Figure 2: Manual customer risk profiling workflow Manual CRP processes that are ubiquitous today include in-person customer onboarding, manual filling of Customer Risk Profiling Questionnaires (CRPQs), verbal clarifications, manual checking for information consistency, and paper￾based risk profiling calculations and acknowledgement, all of which are resource and time-consuming and have the following drawbacks: • Due to the large amount of manual work coupled with resource limitations, CRPQ results may not be renewed on a timely basis, which is particularly challenging when there is a continuously expanding customer base. • Conflicts of interest may result in relationship managers (RMs) exerting undue influence on customers to achieve ‘favourable’ CRPQ results to access more products and earn more fees. With a lack of a digital audit trail, monitoring and identifying these influences or other errors are challenging. • Contradictory responses within the CRPQs and inconsistencies with other Anti-Money Laundering (AML) or Know Your Customer (KYC) documents may be overlooked as a consequence of human error.

8 | Regtech Adoption Practice Guide | Sales Practices and Suitability 2. Product due diligence Figure 3: Manual product due diligence workflow Figure 4: Manual sales and advisory workflow Traditional PDD process faces various challenges: • Superficial due diligence, stemming from insufficient depth of research and data collection, may hinder subsequent product classification and risk ratings. • Extracting relevant and accurate product information has become increasingly difficult due to the growing sophistication of investment products as well as the detailed regulatory requirements on various product types. Inadequate quantitative or qualitative product assessments may hamper the accuracy of risk ratings. • The rationale for product risk ratings may not be properly documented, and banks may fail to demonstrate they have adequately discharged their duties regarding PDD. Most banks struggle to collate product information, leading to limited documentation being available for their products. • Manual PDD process is laborious and time-consuming and thus may not be conducive to prompt and effective response to the market. The sales and advisory process consists of initiation, formulation of recommendations, and execution. The traditional process has the following disadvantages: • Traditionally, the sales process takes place either in person or via phone call. In both cases, communication and recommendation may not be appropriately recorded in call memos. This impedes the effectiveness of process monitoring and review. • Due to the lack of digital tracking, RMs may circumvent existing controls and manipulate the trade process, classifying solicited trades as execution-only trades. • RMs may not have real-time information to support effective suitability assessments, such as the concentration status of the customer’s portfolio or up-to-date portfolio risk ratings to facilitate portfolio￾based suitability. • With conventional suitability checklists, RMs may be under time pressure in ensuring that all pre-trade procedures are properly followed, especially when time-sensitive transactions are involved. 3. Sales and advisory

Regtech Adoption Practice Guide | Sales Practices and Suitability | 9 4. Management supervision Figure 5: Manual management supervision workflow The effectiveness of management supervision depends on the effectiveness of management information (MI) collection, sample selection and testing, and follow-up on non-compliant issues. The manual workflow faces the following problems: • Without a digital management information workflow, there is a lack of data granularity as the reports usually only cover aggregated data. • Manually processed data are often hard to visualise or break down into customisable scales and formats. • Due to the time-consuming nature of the task and common resource constraints, traditional inspections often rely on a small sample of documents and audio reviews. Not to mention, such testing usually only happens post-trade. • Follow-up, remediation and disciplinary actions that come ex-post may result in a delay between the occurrence of non-compliance and the proper management response. 2.2 How can sales suitability Regtech solutions help? With the proliferation of technology, Regtech solutions are not only highly effective in addressing the abovementioned shortcomings and challenges encountered by traditional sales suitability processes but also in improving the overall customer experience. While there are many reasons to adopt Regtech solutions, there are three main benefits for the sales journey across the four pillars of the conventional sales suitability framework.

1. Improve efficiency Regulatory compliance and effective risk management are critical in light of increasing regulatory attention following the global financial crisis. In this challenging environment, meeting regulatory requirements while managing costs can be a daunting task. Regtech, though not a panacea, has gained traction with both banks and regulators worldwide as a powerful and cost-effective tool. In terms of sales suitability, Regtech￾enabled CRP and PDD systems can substantially free up resources as less human effort is required for customer and product onboarding. Robo-advisory can minimise the workload of RMs by conducting automatic suitability assessments. Regtech-enabled real-time management information on sales suitability allows for timely review and thus follow up. Moreover, digital record-keeping and audit trails can lower administration costs considerably.
2. Strengthen compliance The digitalisation of sales suitability processes automates repetitive workflows to free personnel from manual work so that they can focus on more value-added tasks. When employed with advanced data analytics, Regtech solutions can help to monitor and capture irregularities that may otherwise be omitted due to human error and negligence. For example, a Regtech solution with automated pre-trade controls and disclosure process can help to standardise the sales workflows, prevent undue influence exerted by relationship managers, and eliminate improper conduct that may result in mis-selling. Furthermore, automated real￾time management information generation can efficiently track irregularities and send instant alerts for potential non￾compliant incidents, allowing management to take timely actions.

10 | Regtech Adoption Practice Guide | Sales Practices and Suitability 3. Drive sales As banks in Hong Kong continue to explore different business opportunities, Regtech solutions may be helpful to address the challenges associated with growing sales volume, product complexity and client base. For instance, many banks are leveraging the Cross￾boundary Wealth Management Connect Scheme to tap into a larger customer base for their wealth management products and services. The growing connectivity between Hong Kong and the mainland markets will likely drive further growth in traffic and sales volume. Yet, such growth must be properly managed to ensure investor protection can be upheld and regulatory expectations can be met. By digitalising various suitability procedures, Regtech solutions can help to ensure proper and compliant product sales activities as the banks continue to pursue new growth opportunities. The solutions can also help to drive sales by selling the right products to the right customers in the shortest amount of time and enabling investment decisions to be made around the clock with minimal reliance on human effort. The following sections will focus on how banks can benefit from Regtech solutions across the four pillars of the conventional sales suitability framework. 2.3 Virtual customer risk profiling Regtech-enabled customer risk profiling solution can help to increase process efficiency and reduce the risks of human error and undue influence.

1. Initial account opening A key challenge with profiling is to accurately interpret a client’s appetite and capacity through a selected number of questions. A digitalised CRP workflow has many benefits, including: • Contradiction checks can be embedded in the digital CRP workflow to increase result accuracy. For example, a customer who declares a safe investment objective may be asked to re-confirm the factual accuracy of such declaration when options that indicate a rather aggressive investment appetite are chosen.

Regtech Adoption Practice Guide | Sales Practices and Suitability | 11 • Self-declared net worth in the CRPQ can be automatically cross-checked against the entire application dossier, including the AML and KYC documents, to spot discrepancies. • Fully digital CRP process allows financial institutions to obtain more accurate risk profiles directly from customers, reducing potential undue influence from the relationship managers, and thus alleviating potential conduct risks and regulatory concerns. 2. Real-time monitoring Regtech solutions with advanced analytics and machine learning capabilities can synchronise various data sources, including account balances, transaction history and fund transfer records, to perform continuous real-time monitoring. Some examples include contradiction checks against the customers’ answers to their CRPQ and insight analysis on user data to discover trading patterns, holding periods or fund transfer frequency that reflect a customer’s actual investment preferences and risk profiles. This will also facilitate the assessment of sales suitability when conducting solicitation or recommendation at a later stage. 2.4 Product due diligence automation There has been industry feedback that since the roll-out of the suitability requirements on complex investment products, an increasing amount of resources, particularly human effort, are required to perform sufficient due diligence for accurate product classification and risk rating. For financial institutions, actively embracing innovative Regtech solutions for product due diligence can yield the following benefits:

1. More data source for product information Financial institutions may make use of the services of data source providers where all required data are collected and subsequently disseminated to product distributors for product disclosure. Relevant data feeds and documents can be automatically captured in accordance with the regulatory requirements and be directly incorporated into product distributors’ internal PDD platforms or disclosure applications. For instance, data points such as currency, credit rating, maturity, market volatility, and maximum drawdown can be captured from data sources. Such information can be further cross-checked against the data and documents provided by product managers to ensure accurate and compliant dissemination of pertinent information.
2. Auto-generation of product risk disclosures There is industry feedback that as distinct product information is required to be disclosed for different product types, there are challenges in ensuring full disclosures of product features that meet regulatory expectations when using the traditional manual process. The auto￾generated and auto-updated product risk disclosures, along with full-fledged data capture and generation technology, can facilitate banks’ provision of adequate and up-to￾date product information to investors and thus improve efficiency.
3. Simplified product classification Product due diligence is essential for an accurate product classification and product risk assessment. The traditional manual process requires substantial human effort and faces challenges such as inconsistency in classification. By leveraging established databases with embedded product classification rules provided by certain Regtech service providers, Regtech solutions can help to simplify the product classification process. Banks can make use of the readily available PDD information and apply their independent professional assessment to determine the product classification instead of doing such from scratch.
4. Real-time product risk rating (PRR) calculation PRR model can be embedded into the digital PDD solution, enabling fully automated real-time PRR calculations that can be re-run at any time. Some solutions even cover complex products which help to ensure that the most updated and accurate PRR results are taken into consideration in any sales processes.

12 | Regtech Adoption Practice Guide | Sales Practices and Suitability 2.5 Digital sales advisory

1. Robo-advisory Traditionally, suitability assessments usually require RMs to manually examine the product’s features, risks, and rating, as well as the customer’s investment objective, investment knowledge, and risk profile prior to or at the point of sale. Post-trade surveillance is then conducted to identify exceptions with a specific focus on detecting inappropriate practices conducted by RMs. Yet, such post-trade surveillance is resource-demanding and time￾consuming. While mature voice-to-text technology makes it easier to conduct post-trade surveillance, Robo-advisory operating under pre-set algorithms can help to tackle the issue at its core. By embedding the suitability assessment criteria in the underlying algorithms and logic under which Robo￾advisory functions, portfolios can be recommended to a customer on a suitability basis.
2. Accessibility to service One-to-one advisory services are mostly provided to premium banking customers due to the costs of hiring qualified RMs. Owing to the automated nature of Robo￾advisory, where system-generated recommendations can be employed to provide customised investment advice and address individual needs, portfolio investing is now more accessible to the general public. 2.6 Management supervision
3. Automated pre-trade and post-trade controls and monitoring Digitalised customer risk profiling and automated product due diligence workflows can help to enhance monitoring and internal control activities. The solution can help to identify irregularities and capture non-compliant incidents throughout the transaction process. Subsequently, automatic alerts may be sent to relevant personnel to ensure such matters are investigated and addressed in a timely manner. For example: • Pre-trade controls such as soft and hard blocks on suitability checkpoints can form an integral part of the digital workflow where potentially unsuitable transactions can be flagged and followed up before the trades take place. • The system can also deploy pre-trade controls and monitoring on a customer’s holdings, positions, and transaction history and send auto-generated reminders to warn the customer of excessive concentration in certain instruments or asset classes.

Regtech Adoption Practice Guide | Sales Practices and Suitability | 13 2. Enhanced management information Digitalisation empowers management supervision by providing real-time management information such as suitability exception monitoring and analysis of risk indicators and trends. Capturing available data on CRP, PDD and sales advisory allows the generation of management information reports with customisable scale, granularity, and format on a real-time basis. By leveraging advanced data analytics to capture and analyse a customer’s transaction records, the system can be used to form a view on transaction-based profiling versus CRP based on customer’s circumstances. For instance, a customer with a CRP rating of 5 who consistently purchases fixed income products with a PRR rating of 3 or less on an execution-only basis may suggest that the actual CRP is more risk adverse than the assigned one. By scrutinising the discrepancies between the predicted CRP and the CRP on record, the RMs can help better converge on a more accurate CRP. Data can also form the basis for thematic analysis. For example, if similar discrepancies are detected for multiple customers, management may need to re-assess the current CRP procedures to identify whether there are any pitfalls in the profiling mechanism. Furthermore, data analytics can provide management with visibility into specific risk indicators throughout the end￾to-end sales process and allow management to take a proactive and preventive risk control approach, rather than a retrospective one. 3. Efficient compliance reviews With comprehensive digital data, enhanced management information and data analysis on key risk indicators, the compliance function can conduct targeted reviews to address issues of key concern. The fully digitalised sales process, as well as the internal control and monitoring system, can also enhance the efficiency of record-keeping procedures and provide a detailed audit trail at considerably lower administration costs when compared to the traditional manual process.

14 | Regtech Adoption Practice Guide | Sales Practices and Suitability 3.1 Regtech implementation framework Regtech solutions, while delivering a multitude of benefits when successfully implemented, entail a digital transformation that requires proper planning and execution. In the planning phase, various functions should collaborate to determine how Regtech can be best employed to improve customer experience, rather than complicating the customer journey. As a precondition for successful Regtech implementation, it is crucial that banks understand their current capabilities and strategic priorities. Banks also need to gain a clear understanding of the solutions to structure a smooth transition plan.

1. Strategic and budget considerations Banks should assess their scale, target clientele, and complexity of business to determine their strategic priorities. It is crucial to review the existing technologies and systems within the bank to understand the functionality and interdependence across the sales suitability processes as well as the three lines of defence. 03 Implementation guidance Banks with global businesses should consider whether local or global adoption should be implemented. Internal discussions involving all key stakeholders should be held prior to the Regtech roll-out to ensure the project has all necessary financial and strategic support.
2. Identify key strategic priorities A successful transition plan that brings maximum benefits and strategic advantage to a bank involves a number of decision points which should be considered prior to execution. Depending on the scale, target clientele, business complexity and strategic focus, banks may adopt distinct agendas when implementing Regtech solutions. For example: • Banks that focus on retail customers may find it optimal to first focus on Robo-advisory as this can cater to individual investment needs and offer customised advice. • Banks that primarily deal with professional investors with demand for complex products may prioritise the development of a more efficient PDD process over other initiatives. In any case, it is vital for banks to identify their key strategic priorities to navigate the implementation of Regtech solutions.

Regtech Adoption Practice Guide | Sales Practices and Suitability | 15 3. Perform maturity analysis Evaluating the current state of maturity helps banks to form a solid understanding of their current capabilities, key risks, and predominant areas to innovate. Stage 1: Manual process Manual controls and processes dominate the sales journey and only a few automated elements are in place. • The CRP and PDD processes are conducted with vast amount of paperwork that require human effort. RMs are involved throughout the sales process and PDD is conducted by the product team where look-through exercises are carried out manually. • Most control and monitoring procedures are performed through checklists and management information is compiled and reported by responsible personnel. Stage 2: Partial automation The account opening process is mostly digitalised whereby digital CRP forms are employed with built-in consistency checks. • While human controls and assessment are still needed, the PDD system is digital in which key product information can be automatically pre-populated and systematic risk calculations can be performed. • The system can generate preliminary alerts for identified suitability mismatches and identify electronic call memos that classified solicited trades as execution-only trades. Management information is created with pre-established digital templates and visualisation tools. Stage 3: Full automation The whole customer journey and banks’ internal review and monitoring processes are digitalised. • The KYC and account opening processes are completely online with automatic categorisation of professional investor (PI), vulnerable customer (VC), and customers with derivative knowledge (DK). • The PDD process is enabled by data feeds and automatic generation of risk disclosures. Alerts are generated by the system when potential suitability mismatches are detected. • Virtual relationship managers are used to advise clients and provide guidance on the system. • Digital controls and monitoring tools are in place and management information is generated online with a detailed breakdown of key data analysis such as trends and sales patterns. Stage 4: Automation with advanced technology The CRP process is further enhanced with the deployment of big data analytics to study customer behaviors. • Machine Learning (ML) or Artificial Intelligence (AI) is used to conduct dynamic client profiling. Rule-based product classification and PRR calculations are employed to enable more efficient PDD process. • Robo-advisory and voice-to-text form an integral aspect of the sales and advisory process and automated trade monitoring procedures enable real-time management information generation. There are various paths towards automation and full implementation of Regtech solutions. Therefore, the following stages are only indicative of a spectrum from manual to automation:

16 | Regtech Adoption Practice Guide | Sales Practices and Suitability 4. Build vs Buy Banks should evaluate the available options to decide whether to build, procure, or partner with solution providers to devise the most suitable Regtech solutions. Regardless of the option, a comprehensive cost and benefit analysis covering initial, ongoing and hidden costs should be conducted. The solution must be suitable for the bank’s current maturity level, aligned with the bank’s strategic priorities and compatible with the bank’s existing infrastructure. For banks of smaller scale, developing a Regtech solution in-house may be less practical. They may turn to the marketplace to look for automation and Regtech solutions that may cater to their distinct needs. Proper due diligence should be performed on vendors, with specific attention to their integrity, stability, consistency, security, business continuity management, and overall adherence to the bank’s operational resilience framework. 5. Customer experience The COVID-19 pandemic has induced changes in consumer behaviour, leading to more digital interactions between banks and their customers. It is evident that Regtech-empowered suitability frameworks can help to effectively respond to the growing demand for digital interactions throughout the sales process. However, it is important to ensure a smooth transformation process that allows customers to reap the most benefits of digitalisation without their experience being compromised by the trade-off between digitalisation and human interaction. • The digitalised system should be augmented by a help centre to respond to any customer needs promptly. Escalation channels regarding unforeseen incidents and complaint handling procedures should be established in advance to ensure all customer needs are addressed adequately with the necessary management attention. • The user interface needs to be designed in a user￾friendly way to allow customers to easily navigate the platform. • In determining the extent of digitalisation, banks should also consider whether they want to take on full digitalisation or employ a hybrid approach where relationship managers can still leverage Regtech tools that allow them to more effectively offer recommendations while maintaining personal interaction for relationship building and addressing different customer needs, e.g. customers who are less technology-savvy. 6. Ensure a smooth transition Depending on the complexity and scale of the transition, a cross-functional implementation team may be necessary to ensure all involved functions are well coordinated and all aspects of the transition are under control. Management should have proper control and monitoring procedures in place to oversee the implementation process. When the new system is ready for use, the algorithms, models, and system should be run and tested to ensure everything operates as intended. Senior management should also implement appropriate programmes to recruit, train and retrain employees with suitable skillsets. Sufficient training should be provided to relevant staff to ensure they are well prepared to navigate the uplifted system to fully realise the benefits of Regtech solutions.

Regtech Adoption Practice Guide | Sales Practices and Suitability | 17 4.1 Use Case #1 – Product due diligence workflow and database 4.1.1 Challenge Investment portfolios have been growing in terms of complexity and volume. A bank was faced with mounting due diligence tasks associated with these portfolios. Most of these challenges were due to the lack of automation in workflows which resulted in: Low administrative task efficiency: The bank had to commit a considerable amount of resources to ensuring the quality of ongoing product maintenance, including regular product reviews and product risk rating updates. Prolonged product onboarding process: Due diligence performed on new products by product team members often needed to be passed on to more senior members for review and approval. Each review required the standard PDD template to be manually refilled for documentation purpose, which caused additional time delay in the onboarding process. 04 Regtech use cases Slow product information update: The product team used a spreadsheet to manually log a vast amount of product-related information (e.g. ISIN, product name and features, due dates of product due diligence reviews, etc.). With new bonds hitting the shelf every week and new funds every month, there were sometimes latency issues, and the product lists were not always up to date. Due to the limited resources available, risk ratings of investment products were not updated on a timely basis. As the demand for wealth management services was growing, the bank foresaw that more business opportunities would ensue. The bank therefore started actively exploring solutions to migrate the repetitive and manual processes to automated tools and enhance operational efficiency without compromising compliance robustness. 4.1.2 Solution In order to address the above challenges, the bank purchased a Software-as-a-Service solution that automated the end-to-end PDD process, reduced manual work, and lowered the associated labour cost.

18 | Regtech Adoption Practice Guide | Sales Practices and Suitability The solution started with a data intake process which extracted data feeds from credible and reliable data source providers. The data were then combined, normalised and converted into a standardised format and enabled the solution to automatically: • Complete product due diligences and generate product disclosures. • Fill in the tailored PDD templates with different product classification logic, covering even derivative products, Chapter 37 bonds, and complex products. • Generate PDD checklists and relevant product disclosures on a real-time basis. The solution significantly improved the efficiency of product maintenance, shortened the due diligence process, and increased the effectiveness of governance via enhanced management information as measured by comparison with the original approach. 4.1.3 Key success factors Parallel implementation The bank adopted a two-phased parallel implementation plan which was instrumental in ensuring a smooth migration without operational disruptions. During the first phase of the implementation, the product team was split into two. One team was responsible for quality checks on the PDD outputs of the new PDD solution being implemented, whereas the other team followed the original approach in performing manual PDD checks and documentation. Phase two started with a post-implementation review. The predominant focus of the evaluation was to investigate whether the intended objectives of the solution were met by using key statistics analysis, comparison with the manual approach, and user acceptance testing. The PDD solution received positive feedback from the review and obtained management’s green light to move forward. After all the necessary testing and fine tuning of the solution were completed, the two separate product teams merged, and the second phase concluded with a comprehensive migration of the PDD process onto the new system. The two phased parallel implementation enabled the bank to test the effectiveness of the new solution with a backup plan, and demonstrate the bank’s independent review of the accuracy of the system’s outputs. By comparing the outputs generated from the new system with that produced using the original approach, the bank was able to quantify the actual improvement in efficiency. Adequate staff training and communication The project management team arranged several rounds of mandatory training for the product teams, compliance team, risk team, and relationship managers to equip them with sufficient knowledge of the system. The project manager designated one system master in each team to answer technical queries and provide troubleshooting solutions. Updates were also delivered to the relevant teams to convey clear information on the implementation stages of the PDD solution and the implementation arrangements for different teams. With adequate training before and during implementation, process owners became proficient in using the tool even in phase one, which reduced operational risk arising from manual mistakes. By delivering timely updates on implementation stages and arrangements, all relevant staff were aligned and well-prepared for the transition to the later stages and final migration. 4.2 Use case #2 - Sales suitability supervision 4.2.1 Challenge Maintaining robust governance and oversight over the suitability processes is important for meeting regulatory expectations and protecting the interests of customers. A bank in Hong Kong recognised challenges in fulfilling the existing governance framework given the expanding customer base, growing sales volume and increasing product complexity.

Regtech Adoption Practice Guide | Sales Practices and Suitability | 19 More specifically, the bank faced the following challenges: Lack of robust management information • As the customer base and product complexity continued to grow, management needed more detailed information to fully understand the latest trends and pain points. Manually generated management information reports did not include data and information at the requisite level of granularity. • Management information reports were only available for management review at the end of each month, and the information and data were aggregated and presented using a standardised template that did not allow further customisation. Therefore, management was only able to make comparisons on monthly data, which often might not depict the full story when monitoring deviations or irregularities. Lack of visualisation Management had to rely on simple graphs, charts and tables that might not be intuitive, with limited detail affecting management’s ability to quickly grasp critical issues that required attention and spot irregularities within the limited review time. 4.2.2 Solution The bank subscribed to a governance tool which helped to address the above-mentioned drawbacks of the existing manual suitability governance process. Data accessibility and availability The digital governance tool provided real-time data on customers, products, and sales with customisable scale and granularity, which improved oversight as all relevant information and data captured by the system can be presented to management on an ongoing basis. Moreover, when there were specific cases that required further investigation, management was able to easily perform an information drill-down with a few simple clicks on the user interface without the need to convene relevant personnel and request detailed information. In addition, the solution provided insight into transaction data by facilitating the identification of the specific customer profiles, associated RMs, and trade periods that were linked to audio records, thereby improving monitoring of the sales advisory process. Overall, the fully digitalised tool improved visibility into trends on customer demographics and product sales, all of which are critical for informing management’s decisions.

20 | Regtech Adoption Practice Guide | Sales Practices and Suitability Ongoing monitoring and enhanced governance The system automatically flagged irregularities that required management attention and therefore allowed timely investigation and rectification where necessary. For instance, the system automatically scanned product names introduced by the RM in the sales process by examining the call memos. With the introduction of products by RM, a call would more likely be considered a solicitation. By cross-referencing the products traded as part of the call, the surveillance function of the system was able to automatically flag solicited trades that were classified as execution-only trades, thereby enabling a more timely identification of potential misconducts. Management also clearly mapped the roles and responsibilities in the system so that when potential misconducts were detected, they would be assigned to the appropriate process owners and their supervisors within a pre-defined turnaround time. Assigning ownership ensured that the investigation and follow-up of red flags were effectively monitored and tracked through the system. Any unresolved issues were then included in the reports to Compliance and subject to regular audit reviews. Visualisation The interface and dashboard of the system provided intuitive visualisation of management information related to product, transaction, and customer information. Future trends were also projected and forecasted using pre￾established algorithms. These visualisation features allowed management to make timely and data-enabled decisions. 4.2.3 Key success factors Regular effectiveness reviews Six months after the roll-out of the governance tool, management conducted a post-implementation review to evaluate whether the tool was achieving the intended objectives. Users of the tool, including the Business Risk Management team and Compliance team, recognised the value of real-time data on products, transactions, and customers which helped to inform their regular transaction surveillance exercises. In addition to the post-implementation review, management also conducted annual effectiveness reviews to ensure users could provide useful feedback to the solution provider. After collecting feedback, the product manager requested the solution provider to further customise the tool to deliver a more user-friendly interface and fix the identified data capture issues. Regular effectiveness reviews not only enabled further system enhancements based on users’ direct feedback and emerging needs, but also allowed management to monitor and ensure the continued appropriateness of the tool in use. Customisation based on user requirements and regulations Development of a governance tool is an iterative process. Multiple rounds of user feedback and solution refinement may be required to ensure the solution suits the actual need of the bank. In this particular case, customisation is of paramount importance as the tool aimed to address the governance challenges associated with sales suitability. To meet the distinct user requirements, the tool was developed with customised algorithms, suitability checkpoints, and tailored customer profile analytics. Adequate planning and customisation ensured that the tool was developed and designed in line with the bank’s internal control system as well as the relevant regulatory requirements on suitability. An effective and comprehensive process owner mapping exercise and user requirement collection process also played a pivotal role in guaranteeing that the tool was flexible and effective in meeting distinct user needs.

Regtech Adoption Practice Guide | Sales Practices and Suitability | 21 Sales suitability is imperative to the protection of customers’ interests in their banking experiences. With the growing complexity and volume of the products sold, the conventional sales suitability framework may require innovative solutions to more effectively achieve its desired objectives. As this Guide has illustrated, various Regtech solutions can potentially contribute to the sales suitability process through digitalising the CRP journey, automating the PDD process, offering robo-empowered sales advisory services, and leveraging data to enable better management supervision. It is key that banks perform dynamic review during the transformation journey to ensure that the new 05 Conclusion sales suitability model is delivering satisfactory outcomes. Section 3 of this Guide has provided a walkthrough of the fundamental considerations that banks should take into account when formulating their strategy. Many banks are gearing up to catch up with the trend of growing demand for wealth management products. Regtech solutions can be a helpful tool to maintain a proper mechanism of sales suitability assessment while complying with the requirements.

22 | Regtech Adoption Practice Guide | Sales Practices and Suitability A.1Acknowledgements KPMG co-authors and subject matter expert contributors: Paul McSheaffrey, James O’Callaghan, Jeffrey Hau, Christy Ying, editor Philip Wiggenraad A.2Relevant regulatory requirements and/or guidance A Appendix Name Link Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission https://www.sfc.hk/-/media/EN/assets/components/codes/ files-current/web/codes/code-of-conduct-for-persons￾licensed-by-or-registered-with-the-securities-and-futures￾commission/Code_of_conduct-Dec-2020_Eng.pdf Guidelines on Online Distribution and Advisory Platforms https://www.sfc.hk/-/media/EN/assets/components/codes/ files-current/web/guidelines/guidelines-on-online-distribution￾and-advisory-platforms/guidelines-on-online-distribution-and￾advisory-platforms.pdf Frequently Asked Questions on Compliance with Suitability Obligations by Licensed or Registered Persons (FAQs) https://www.sfc.hk/en/faqs/intermediaries/supervision/ Compliance-with-Suitability-Obligations/Compliance-with￾Suitability-Obligations Guidelines on Online Distribution and Advisory Platforms (the Guidelines) and Paragraph 5.5 of the Code of Conduct https://www.sfc.hk/en/faqs/intermediaries/supervision/ Guidelines-on-Online-Distribution-and-Advisory-Platforms/ Guidelines-on-Online-Distribution-and-Advisory-Platforms Joint Circular on Intermediaries’ Virtual Asset-related Activities https://www.hkma.gov.hk/media/eng/doc/key-information/ guidelines-and-circular/2022/20220128e2.pdf Circular Issued by the Securities and Futures Commission (SFC) Regarding Report on the Thematic Inspection of Selling Practices of Licensed Corporations https://www.hkma.gov.hk/media/eng/doc/key-information/ guidelines-and-circular/2012/20121024e1.pdf Distribution of Fixed Income and Structured Products https://www.hkma.gov.hk/media/eng/doc/key-information/ guidelines-and-circular/2018/20180208e1.pdf

Regtech Adoption Practice Guide | Sales Practices and Suitability | 23 Feedback from Recent Reviews on Selling of Investment Funds https://www.hkma.gov.hk/media/eng/doc/key-information/ guidelines-and-circular/2019/20191122e2.pdf Guidance on Selling of Investment Products and Handling of Client Securities https://www.hkma.gov.hk/media/eng/doc/key-information/ guidelines-and-circular/2017/20170223e1.pdf Issues and good practices in relation to the sale of investment products https://www.hkma.gov.hk/media/eng/doc/key-information/ guidelines-and-circular/2014/20140730e1.pdf Frequently Asked Questions on Investor Protection Measures in respect of Investment, Insurance and Mandatory Provident Fund Products https://www.hkma.gov.hk/media/eng/doc/key-information/ guidelines-and-circular/2020/20201223e1a1.pdf HKMA Circular on Investment horizon and suitability assessment https://www.hkma.gov.hk/media/eng/doc/key-information/ guidelines-and-circular/2018/20181018e2.pdf HKMA Circular on Investor Protection Measures in respect of Investment, Insurance and Mandatory Provident Fund Products https://www.hkma.gov.hk/media/eng/doc/key-information/ guidelines-and-circular/2019/20190925e2.pdf HKMA Circular on Distribution of Investment and Insurance Products through Non-face-to-face Channels https://www.hkma.gov.hk/media/eng/doc/key-information/ guidelines-and-circular/2021/20210924e2.pdf https://www.hkma.gov.hk/media/eng/doc/key-information/ guidelines-and-circular/2021/20210924e2a1.pdf