Self-Assessment of Compliance with Supervisory Policy Manual Module TB-1 Regulation and Supervision of Trust Business

1 - Annex Instances of Partial Compliance with the General Principles of the Code General principles Instances of partial compliance Principle 1: Fairness, honesty and integrity 0 Principle 2: Due skill, care and diligence 1 • Para A.4.3.2(b) of the Code – A trustee should establish internal rules of confidentiality as appropriate, including necessary information boundaries, such as physical separation of certain departments or data segregation. Principle 3: Management and control of trust assets 3 • Para A.5.3.1 of the Code – Regular reconciliation of client monies and where practicable other assets held on trust against the trustee or third￾party records, and where practicable verification of asset ownership, should be conducted by staff of the trustee operationally independent of the regular management and administration of the trust and be subject to periodic review and approval by appropriate management staff. For physical assets, commensurate with the prudent and effective exercise of trustee’s duty, periodic audits should be conducted at the premises where the physical assets are kept. • Para A.5.3.2 of the Code – Proper procedures should be implemented to follow up any issues or discrepancies identified, take any rectification and remedial measures, and report or escalate matters as appropriate. Principle 4: Corporate governance and internal controls 8 • Para A.6.5 of the Code – A trustee should have proper oversight of all delegates and other parties, e.g. agents, nominees, custodians, and other service providers, appointed or engaged for providing services related to its trust business. Among others, a trustee should have adequate internal control policies and procedures for ongoing monitoring of such delegates and other parties to be satisfied that the operations and functions concerned are performed in compliance with relevant legal and regulatory requirements (including those in this Code) and the trust governing documents. • Para A.6.8.1 of the Code – A trustee should assess and continually manage the risks associated with a delegated or outsourced function or operation. • Para A.6.8.2(c) of the Code – A trustee should implement controls to monitor the performance, manage the relationship with the delegate or other service provider on a continuous basis, and implement safeguards to protect the integrity and confidentiality of customer information.

2 - General principles Instances of partial compliance • Para A.6.9.1 of the Code – A trustee should implement adequate procedures and controls in managing, administering, and overseeing, as applicable, the operation of the trust. Examples of these controls include cashflow monitoring, investment monitoring, safekeeping and valuation of assets, trust accounting, receipt and distribution of payments and assets, where applicable and in accordance with the trust governing documents together with all applicable legal and regulatory requirements. • Para A.6.10.1(b) of the Code – Complaints should be handled, investigated and addressed in a fair, prompt and appropriate manner. Staff assigned to handle the complaint should be independent and should not be involved in the subject of the complaint. • Para A.6.11.1 of the Code – A trustee should establish an effective risk management framework and implement adequate procedures and internal controls to identify, monitor and manage risks in acting as a trustee. Principle 5: Compliance with legal and regulatory requirements and standards 0 Principle 6: Co-operation with regulators 0 Total 12