Requirements on Money Safe Protection for Anti-Fraud

Annex Requirements on “Money Safe” Protection “Money Safe” (MS) enables customers to segregate a portion of their deposits maintained at Authorized Institutions (AIs) and protect it from fund outflows. Once the customers segregate an amount to be protected under MS, customers may release the MS protected funds for transactions (e.g. fund transfers, withdrawal, etc.) after the AIs concerned have undertaken verification process with the customers. Coverage

1. AIs should provide MS to retail banking individual customers. AIs should also consider offering MS or similar protection to other individual customers (e.g. private banking customers), based on the needs of such customers.
2. MS protection applies to deposit accounts which should, at a minimum, include current accounts, savings accounts and time deposit accounts in Hong Kong Dollar and major non-local currencies1 .

Protection and Use by Customers 3. Use of MS should be voluntary at the discretion of customers. Customers should determine the amount of funds to be protected under MS, subject to any minimum threshold that individual AIs may determine having regard to their operation needs. Where a minimum threshold is set by AIs, the AIs should ensure that the intended protection to customers under MS would not be undermined by the level of the threshold. For reference, most AIs regard HK$10,000 or its equivalent as an appropriate level to be considered if a minimum threshold is to be adopted. 4. In order to facilitate customers to make use of MS to protect themselves, AIs should provide convenient channels for customers to get access to MS, including segregating deposits for MS protection and increasing amount of deposits segregated for MS protection. The channels should include at least,

1 Reference may be made to the non-local currencies specified in the HKMA Return of Foreign Currency Position – Form MA(BS)6, i.e. USD, GBP, JPY, EUR, CNY, CAD, CHF, AUD, SGD and NZD.

• 2 - but not limited to, bank branches and Internet banking platforms2 unless not applicable.

5. Once customers segregate an amount to be protected under MS, AIs should not process fund outflows from the MS protected funds via any channels through any types of transactions, for example, withdrawals, fund transfers, direct debit authorization and standing instruction related transactions, loan and card repayment, bank fees and charges, etc, before completing the release of protection process as specified below.
6. AIs should effect MS protection on deposits as soon as practicable, and in any case not later than 3 working days, upon receiving customers’ instructions on the use of MS. AIs should also strive towards shortening the time for effecting MS protection to 1 working day or even the same day going forward.
7. Where time deposits under MS protection become matured, it is natural that the customers expect the matured amount continues to be protected by MS. In this respect, AIs should take steps to continue to segregate the matured amount as under MS protection, unless the customers take actions to release the MS protection. Some examples for achieving continued MS protection include automatic extension of MS protection to renewal of time deposits, actively seeking customers’ instruction to apply MS protection to funds released from matured time deposits, etc.
8. AIs may determine their own approaches to operate MS protection, for example, creating separate bank accounts for customers, or setting aside the segregated amount in existing accounts of customers, or earmarking the available balance of customer accounts that is not subject to MS protection, etc. For the avoidance of doubt, MS protected funds should continue to be eligible for interest and other relevant benefits that the customers are entitled to if they do not use MS. Release of Protection
9. Customers may choose to release any segregated amount of deposits from MS protection. Upon release of MS protection, fund outflows from the MS protected amount will no longer be disallowed. It is thus important that AIs should undertake a stringent anti-fraud-and-scam focused verification process that is directed to support customers to identify suspicious

2 Internet banking platforms refer to banks’ platforms which deliver financial services over the Internet to customers’ devices, including personal computers and mobile devices.

• 3 - circumstances before an MS protection is released. The verification process should include, among others, face-to-face communication3 between bank staff and the customers with appropriate probing into the circumstances of the release through channels which can effectively achieve the purpose. Taking into account the current situation of frauds and scams, physical presence of the customers at bank branches is the most appropriate channel for releasing MS protection. 10.AIs should have proper procedures for handling any suspicious cases identified during the verification process, for example, alerting the customers or seeking appropriate advice and assistance from the Police. 11.AIs should handle customer requests for release of MS protection without undue delay, and in any case not later than 3 working days. 12.For the avoidance of doubt, any reduction in the amount under MS protection and early uplift of time deposits under MS protection should be handled following the process specified under this section on “Release of Protection”. 13.Where handling of release of MS at bank branches is not practicable (e.g. for digital banks which do not have any physical branch), AIs should adopt similarly effective measures to achieve the intended purpose (e.g. other forms of visual communication between bank staff and the customers supplemented by additional verification measures to address any risk of visual communication without physical presence) as an interim measure, with a view to setting up face-to-face verification channels at a later stage. Customer Communications and Notification 14.In view of the nature of MS, it is important for customers to have a clear understanding of the protection, in particular that fund outflows from the MS protected funds will not be processed before completion of the stringent process for release of MS protection, which is designed for protecting the customers. Hence, when customers use MS, AIs should ensure that the features, operations and release process and channels of MS should be fully and clearly explained to the customers. AIs should specifically remind customers to maintain sufficient funds for meeting daily and other ad hoc needs.

3 For the avoidance of doubt, face-to-face communication requires physical presence.

• 4 - 15.When customers request to release MS protection, in addition to meeting the requirements under the section on “Release of Protection” above, AIs should also ensure that the implications of a release of MS protection is adequately and clearly explained to the customers. 16.AIs should provide proper notifications to facilitate customers to have adequate knowledge of the status of MS protection. AIs should, at a minimum, provide written notifications 4 to customers through effective means when (i) an MS application is effective, (ii) an MS release request is received, and (iii) an MS release request is effective. To enhance customer experience, AIs are also encouraged to inform customers of the funds under MS protection periodically. Customer Awareness 17.Customers play a fundamental role in staying vigilant and taking precautions against frauds and scams. AIs should take proactive measures to raise customer awareness and understanding of MS protection, particularly for vulnerable segments like elderly and students, with a view to encouraging customers to use MS to protect themselves. 18.The industry should also organise collaborative promotion programme to increase public awareness of MS protection.

4 Written notifications can be provided in a non-paper based format or in hard copy printed form.