Self-Assessment of Compliance with Supervisory Policy Manual Module TB-1 Regulation and Supervision of Trust Business

Our Ref.:B1/15C
B9/219C
4 July 2024
The Chief Executive
All Authorized Institutions
Dear Sir/ Madam,
Self-Assessment of Compliance with Supervisory Policy Manual Module TB-1 “Regulation and Supervision of Trust Business” This circular aims to share with authorized institutions (“AIs”) a summary of the results of a self-assessment on compliance with the Supervisory Policy Manual Module TB-1 (“SPM TB-1”) covering the period from 1 June 2023 to 31 December 2023. Summary of assessment results The self-assessment was participated by AIs and subsidiaries of locally incorporated AIs (“AI subsidiaries”) which carried on trust business in Hong Kong as trustees during the assessment period (“reporting institutions”), and was carried out by the internal audit departments, compliance departments or other equivalent units of the reporting institutions. The self-assessment covered 84 provisions relating to trust business in SPM TB-1 (including the Code of Practice for Trust Business (“Code”)). The overall status of compliance during the assessment period was satisfactory:

• No instance of non-compliance was reported.

• On partial compliance, in aggregate 12 instances were reported. The reporting
  institution with the highest number of instances of partial compliance reported 5 such instances. It should be noted that an issue might be reported under different provisions as relevant and counted as more than one instance.

• Among the partial compliance, 8 instances were on provisions relating to
  Principle 4 “Corporate governance and internal controls” of the Code, which

• 2 -
  stipulates that a trustee should establish a proper corporate governance structure and implement adequate internal controls and risk management systems to ensure that its trust business is effectively managed. The reported issues pertained to such areas as:
   oversight and monitoring of the performance of delegates or service providers on delegated or outsourced functions or operations;  controls in investment monitoring, e.g. adequacy of investment rules documentation and review frequency;  risks and controls assessment; and  policies and procedures on complaint handling. A table of partial compliance by general principles of the Code is at the Annex. According to the rectification plans of the reporting institutions concerned, as of the submission date of the self-assessment (i.e. 31 March 2024), 3 instances of partial compliance had been rectified and the remedial actions for the remaining instances are expected to be completed by Q3 2024. The reporting institutions concerned should ensure that all remedial actions are implemented in accordance with the reported plans. Taking this opportunity, all AIs and AI subsidiaries that carry on trust business in Hong Kong as trustees are reminded to put in place systems and controls to ensure observance of SPM TB-1, in particular the general principles and the practical standards detailed in the Code, and timely report any material non-compliance to the HKMA and take appropriate remedial actions. The HKMA will continue to monitor compliance with SPM TB-1 in its ongoing supervision. Locally incorporated AIs should pass a copy of this circular to their subsidiaries which carry on trust business in Hong Kong as trustees for their attention. In case of any questions on this letter, please contact Ms Candy Tam at 2878-1292 or Ms Arissa Chan at 2878-8814. Yours faithfully, Alan Au Executive Director (Banking Conduct) Encl.

• 1 -
  Annex
  Instances of Partial Compliance with the
  General Principles of the Code
  General principles Instances of partial compliance Principle 1: Fairness, honesty and integrity 0 Principle 2: Due skill, care and diligence 1

• Para A.4.3.2(b) of the Code – A trustee should establish internal rules of
  confidentiality as appropriate, including necessary information boundaries, such as physical separation of certain departments or data segregation. Principle 3: Management and control of trust assets 3

• Para A.5.3.1 of the Code – Regular reconciliation of client monies and
  where practicable other assets held on trust against the trustee or third￾party records, and where practicable verification of asset ownership, should be conducted by staff of the trustee operationally independent of the regular management and administration of the trust and be subject to periodic review and approval by appropriate management staff. For physical assets, commensurate with the prudent and effective exercise of trustee’s duty, periodic audits should be conducted at the premises where the physical assets are kept.

• Para A.5.3.2 of the Code – Proper procedures should be implemented to
  follow up any issues or discrepancies identified, take any rectification and remedial measures, and report or escalate matters as appropriate. Principle 4: Corporate governance and internal controls 8

• Para A.6.5 of the Code – A trustee should have proper oversight of all
  delegates and other parties, e.g. agents, nominees, custodians, and other service providers, appointed or engaged for providing services related to its trust business. Among others, a trustee should have adequate internal control policies and procedures for ongoing monitoring of such delegates and other parties to be satisfied that the operations and functions concerned are performed in compliance with relevant legal and regulatory requirements (including those in this Code) and the trust governing documents.

• Para A.6.8.1 of the Code – A trustee should assess and continually manage
  the risks associated with a delegated or outsourced function or operation.

• Para A.6.8.2(c) of the Code – A trustee should implement controls to
  monitor the performance, manage the relationship with the delegate or other service provider on a continuous basis, and implement safeguards to protect the integrity and confidentiality of customer information.

• 2 -
  General principles Instances of partial compliance

• Para A.6.9.1 of the Code – A trustee should implement adequate procedures
  and controls in managing, administering, and overseeing, as applicable, the operation of the trust. Examples of these controls include cashflow monitoring, investment monitoring, safekeeping and valuation of assets, trust accounting, receipt and distribution of payments and assets, where applicable and in accordance with the trust governing documents together with all applicable legal and regulatory requirements.

• Para A.6.10.1(b) of the Code – Complaints should be handled, investigated
  and addressed in a fair, prompt and appropriate manner. Staff assigned to handle the complaint should be independent and should not be involved in the subject of the complaint.

• Para A.6.11.1 of the Code – A trustee should establish an effective risk
  management framework and implement adequate procedures and internal controls to identify, monitor and manage risks in acting as a trustee. Principle 5: Compliance with legal and regulatory requirements and standards 0 Principle 6: Co-operation with regulators 0 Total 12