Self-Assessment of Compliance with the Code of Banking Practice 2019

Hong Kong Monetary Authority Self Assessment of Compliance with Code of Banking Practice For period: 1 January 2019 to 31 December 2019 This report is prepared by: Signature : (Sign on hardcopy only) Name : Department : Post Title : Telephone : Fax : Email : (Please provide an ICLNet email address, if any) : (Sign on hardcopy only) Approved by Name of Reporting Institution: INDIAN OVERSEAS BANK

Signature of Chief Executive Name of Chief Executive Name and contact details of the person whom the Hong Kong Monetary Authority may contact in relation to this self-assessment Name and post title: Contact number: Email address: (Please provide an ICLNet email address, if any)

COMPLETION INSTRUCTIONS Please read these notes carefully before completing the self-assessment. Reporting period

1. The reporting period is from 1 January 2019 to 31 December 2019. The self-assessment report should be submitted by 31 March 2020. General
2. This self-assessment should be carried out by the internal audit department, the compliance department or other equivalent unit of the institution. It should be signed by the head of the relevant department and should be approved and co-signed by the Chief Executive of the institution.
3. According to section 1.2 of the Code of Banking Practice (the Code), institutions’ subsidiaries and affiliated companies controlled by them which are not institutions and are not licensed, regulated or supervised by any financial regulators in Hong Kong should also observe the Code where applicable when providing banking services in Hong Kong. If your institution has such subsidiaries and affiliated companies (subsidiaries and affiliated companies), they should be covered by this self-assessment and reported as explained in the following, and a list of their names and types of banking services should be provided in the worksheet titled “List of Subsidiaries”. Declaration
4. If the Code does not apply to your institution and your institution does not have any such subsidiaries and affiliated companies as defined in item 3 above, complete the worksheet titled “Declaration” and return it to the HKMA. In this case, it is not necessary for your institution to complete the rest of the report. Part I and Part I(A) Specific questions
5. In assessing compliance with individual provisions of the Code, the institution, and the subsidiaries and affiliated companies should take into account: • any new provisions, revisions, recommendations or interpretative notes issued by the Code of Banking Practice Committee1 , and • all business segments and channels of and products and services provided by the reporting entity.
6. Responses of the institution should be reported in the worksheet titled “Part I”. If for any question in relation to each section, a negative response is appropriate for one or more requirements under that section, an overall negative response should be entered in the relevant box. If a section does not apply to the institution, e.g. the institution is not engaged in the business concerned, an “NA” should be entered in the relevant boxes. Details should be provided separately in the worksheet titled “Part I - Details” as specified in item 8 below.
7. Responses of the subsidiaries and affiliated companies should be reported in the worksheet titled “Part I (A)”. If for any question in relation to each section, a negative response is appropriate for one or more requirements under that section for one or more subsidiaries and affiliated companies, an overall negative response should be entered in the relevant box. If a section applies to none of the subsidiaries and affiliated companies, e.g. none of the subsidiaries and affiliated companies is engaged in the business concerned, an “NA” should be entered in the relevant boxes. Details should be provided separately in the worksheet titled “Part I (A) - Details” as specified in item 9 below.

Details 8. If a negative response is entered in the worksheet titled “Part I”, please fill in the corresponding boxes in the worksheet titled “Part I - Details”. For any negative response to Question (i), you must include information on: • the subsection(s) for which there are no policies and procedures • an action plan for setting up policies and procedures or other similar measures, and • target completion date. For any negative response to Question (ii), you must include information on: • the subsection(s) with which the institution does not comply • a brief description of the non-compliance (but where an instance of non-compliance is identified which is a recurrence of similar instances identified in previous exercises, a full account should be provided) • whether rectification of the non-compliance has been completed (Yes or No), and • the date the exception report on the non-compliance was filed to the HKMA2 . If more than one instance is reported under the relevant section, you should provide the above information corresponding to each instance. DO NOT mix answers about different instances in one line; write them in separate paragraphs and align them with answers in neighbouring cells about the same instance. 9. For the subsidiaries and affiliated companies, details should be provided in the worksheet titled “Part I (A) - Details” in the same manner as explained in item 8 above with the additional requirement that the names of subsidiaries and affiliated companies concerned be specified for EACH instance giving rise to the negative response. Part II Supplementary questions 10. Please answer all questions applicable to your institution and the subsidiaries and affiliated companies. Each answer should be supplemented by a description or explanation as required in the question. Use of this template 11. Please do not attempt to modify this template. If you have any questions concerning data input and return submission, please contact our helpdesk on 2878 1800. For enquiries regarding the self-assessment, please contact Ms Wendy So on 2878 1757 or Ms Cora Ching on 2878 8211. 12. When completing “Part I - Details”, “Part I (A) - Details” and “Part II - Supplementary questions”, you may press the “ALT” and “ENTER” keys simultaneously to start a new paragraph within the same box. 1 The Code of Banking Practice Committee has been established by the two industry associations to provide guidance or interpretations of the Code, and to undertake review of the Code from time to time. The Committee’s interpretations and recommendations are issued in the form of circulars by the two industry associations. 2 Please refer to the emails from the HKMA's Banking Conduct Department dated 27 May 2016 and 25 September 2019 in relation to incident reporting form for securities, insurance and MPF businesses, and banking conduct-related issues for the reporting procedures.

SUBMISSION INSTRUCTIONS

1. Please submit both a hard copy and a soft copy of this report to the HKMA in accordance with the following instructions. Hardcopy
2. Mail the signed report to: Banking Conduct Department (Attn: Charmaine She) Hong Kong Monetary Authority 55/F, Two International Finance Centre 8 Finance Street, Central Hong Kong (Ref.: Code of Banking Practice) Softcopy
3. Send the report to the HKMA via the STET system • Download the reporting template to your PC and complete the report • Connect to the STET network (same procedure as sending returns to the HKMA) • Attach the file to an email and send it to: code@hkma.iclnet.hk • Disconnect from the STET network after the submission is completed

---

---

DECLARATION We hereby declare that the Code of Banking Practice applies to neither our institution nor any of the subsidiaries and affiliated companies controlled by it for the period from 1 January 2019 to 31 December 2019. The reasons are: dfd (If you have made a declaration, please leave Part I and II worksheets blank) Signed by (sign on hardcopy only) Signature of Chief Executive Name of Chief Executive (If you have made a declaration, please leave Part I and II worksheets blank)

LIST OF SUBSIDIARIES AND AFFILIATED COMPANIES (a) Section 1.2 specifies that institutions’ subsidiaries and affiliated companies controlled by them which are not institutions and are not licensed, regulated or supervised by any financial regulators in Hong Kong should observe the Code where applicable when providing banking services in Hong Kong. Does your institution have any such subsidiaries and affiliated companies? If yes, please provide a list of all these subsidiaries and affiliated companies in (b). (b) Total number of the subsidiaries and affiliated companies: No. Name of subsidiary or affiliated company Type(s) of banking service(s) provided 1 2 3 4 5 6

PART I - SPECIFIC QUESTIONS (FOR INSTITUTION) (i) (ii) Section reference in current version Does your institution have policies and procedures in place for compliance with the following sections of the Code: Does your institution comply with the following sections of the Code: Chapter 1 – Relationship between Institutions and Customers 5. Terms and Conditions (i) (ii) 6. Fees and Charges (i) (ii) 7. Debt Recovery Expenses (i) (ii) 8. Collection, Use, Holding and Erasure of Customer Information (i) (ii) 9. Personal Referees (i) (ii) 10. Equal Opportunity (i) (ii) 11. Bank Marketing (i) (ii) 12. Annualised Percentage Rates (APRs) (i) (ii) 13. Handling Customer Complaints (i) (ii) 14. Closing Bank Branches (i) (ii) 15. Management of Banking Activities (i) (ii) Chapter 2 – Accounts and Loans 16. Opening of Accounts (i) (ii) 17. Closing of Accounts (i) (ii) 18. Operation of Accounts (i) (ii) 19. Rights of Set-off (i) (ii) 20. Deposit Accounts (i) (ii) 21. Loans and Overdrafts (i) (ii) 22. Residential Mortgage Lending (i) (ii) 23. Other Secured Lending (i) (ii) 24. Guarantees and Third Party Securities (i) (ii) Chapter 3 – Card Services 26. Issue of Cards (i) (ii) 27. Terms and Conditions (i) (ii) 28. Fees and Charges (i) (ii) 29. Interest Rate (i) (ii) 30. Repayment (i) (ii) 31. Rights of Set-off (i) (ii) 32. Security of Cards/PINs (i) (ii) 33. Transaction Records (i) (ii) 34. Unauthorized Transactions (i) (ii) 35. Lost Cards/PINs (i) (ii) 36. Liability for Loss (i) (ii) 37. Treatment of Credit Balances (i) (ii) 38. Direct Mailing (i) (ii) Chapter 4 – Payment Services 39. Cheques (i) (ii) 40. Cross-border Payments (i) (ii) 41. Other Payment Services (i) (ii) Chapter 5 – Recovery of Loans and Advances 43. Debt Collection Activities (i) (ii) 44. Management of Debt Collection Agencies (i) (ii) Chapter 6 – Electronic Banking Services 45. Disclosure for E-banking Services (i) (ii) 46. Security in relation to E-banking (i) (ii) 47. Reporting of Actual or Suspected Security Incidents (i) (ii) 48. Liability for Loss (i) (ii) Chapter 7 – Stored Value Cards (or Devices) 50. Issue of Stored Value Cards or Devices (SVCs) (i) (ii) 51. Terms and Conditions and Fees and Charges (i) (ii) 52. Operation of SVCs (i) (ii)

PART I - DETAILS (FOR INSTITUTION) If a negative response is entered to Question (i) in the previous worksheet, please fill in the corresponding boxes below. If a negative response is entered to Question (ii) in the previous worksheet, please fill in the corresponding boxes below. Sub￾section(s) Action plan Target completion date (DD/MM/YYYY) Sub￾section(s) Description of non-compliance Rectification completed (Y/N) Filing date of exception report (DD/MM/YYYY) 5. Terms and Conditions (i) (ii) 6. Fees and Charges (i) (ii) 7. Debt Recovery Expenses (i) (ii) 8. Collection, Use, Holding and Erasure of Customer Information (i) (ii) 9. Personal Referees (i) (ii) 10. Equal Opportunity (i) (ii) 11. Bank Marketing (i) (ii) 12. Annualised Percentage Rates (APRs) (i) (ii) 13. Handling Customer Complaints (i) (ii) Section reference in current version Chapter 1 – Relationship between Institutions and Customers

Section reference in current version If a negative response is entered to Question (i) in the previous worksheet, please fill in the corresponding boxes below. Sub- Action plan Target completion section(s) date (DD/MM/YYYY) If a negative response is entered to Question (ii) in the previous worksheet, please fill in the corresponding boxes below. Sub- Description of non-compliance Rectification completed Filing date of exception section(s) (Y/N) report (DD/MM/YYYY) 14. Closing Bank Branches (i) (ii) 15. 16. Management of Banking Activities Chapter 2 – Accounts and Loans Opening of Accounts (i) (i) (ii) (ii) 17. Closing of Accounts (i) (ii) 18. Operation of Accounts (i) (ii) 19. Rights of Set-off (i) (ii) 20. Deposit Accounts (i) (ii) 21. Loans and Overdrafts (i) (ii) 22. Residential Mortgage Lending (i) (ii)

Section reference in current version If a negative response is entered to Question (i) in the previous worksheet, please fill in the corresponding boxes below. Sub- Action plan Target completion section(s) date (DD/MM/YYYY) If a negative response is entered to Question (ii) in the previous worksheet, please fill in the corresponding boxes below. Sub- Description of non-compliance Rectification completed Filing date of exception section(s) (Y/N) report (DD/MM/YYYY) 23. Other Secured Lending (i) (ii) 24. 26. Guarantees and Third Party Securities Chapter 3 – Card Services Issue of Cards (i) (i) (ii) (ii) 27. Terms and Conditions (i) (ii) 28. Fees and Charges (i) (ii) 29. Interest Rate (i) (ii) 30. Repayment (i) (ii) 31. Rights of Set-off (i) (ii) 32. Security of Cards/PINs (i) (ii)

Section reference in current version If a negative response is entered to Question (i) in the previous worksheet, please fill in the corresponding boxes below. Sub- Action plan Target completion section(s) date (DD/MM/YYYY) If a negative response is entered to Question (ii) in the previous worksheet, please fill in the corresponding boxes below. Sub- Description of non-compliance Rectification completed Filing date of exception section(s) (Y/N) report (DD/MM/YYYY) 33. Transaction Records (i) (ii) 34. Unauthorized Transactions (i) (ii) 35. Lost Cards/PINs (i) (ii) 36. Liability for Loss (i) (ii) 37. Treatment of Credit Balances (i) (ii) 38. 39. Direct Mailing (i) Chapter 4 – Payment Services Cheques (i) (ii) (ii) 40. Cross-border Payments (i) (ii) 41. Other Payment Services (i) Chapter 5 – Recovery of Loans and Advances (ii)

Section reference in current version If a negative response is entered to Question (i) in the previous worksheet, please fill in the corresponding boxes below. Sub- Action plan Target completion section(s) date (DD/MM/YYYY) If a negative response is entered to Question (ii) in the previous worksheet, please fill in the corresponding boxes below. Sub- Description of non-compliance Rectification completed Filing date of exception section(s) (Y/N) report (DD/MM/YYYY) 43. Debt Collection Activities (i) (ii) 44. 45. Management of Debt Collection (i) Agencies Chapter 6 – Electronic Banking Services Disclosure for E-banking Services (i) (ii) (ii) 46. Security in relation to E-banking (i) (ii) 47. Reporting of Actual or Suspected (i) Security Incidents (ii) 48. 50. Liability for Loss (i) Chapter 7 – Stored Value Cards (or Devices) Issue of Stored Value Cards or (i) Devices (SVCs) (ii) (ii) 51. Terms and Conditions and Fees and (i) Charges (ii) 52. Operation of SVCs (i) (ii)

PART I (A) - SPECIFIC QUESTIONS (FOR SUBSIDIARIES AND AFFILIATED COMPANIES) (i) (ii) Section reference in current version Does your institution have policies and procedures in place for compliance with the following sections of the Code: Does your institution comply with the following sections of the Code: Chapter 1 – Relationship between Institutions and Customers 5. Terms and Conditions (i) (ii) 6. Fees and Charges (i) (ii) 7. Debt Recovery Expenses (i) (ii) 8. Collection, Use, Holding and Erasure of Customer Information (i) (ii) 9. Personal Referees (i) (ii) 10. Equal Opportunity (i) (ii) 11. Bank Marketing (i) (ii) 12. Annualised Percentage Rates (APRs) (i) (ii) 13. Handling Customer Complaints (i) (ii) 14. Closing Bank Branches (i) (ii) 15. Management of Banking Activities (i) (ii) Chapter 2 – Accounts and Loans 16. Opening of Accounts (i) (ii) 17. Closing of Accounts (i) (ii) 18. Operation of Accounts (i) (ii) 19. Rights of Set-off (i) (ii) 20. Deposit Accounts (i) (ii) 21. Loans and Overdrafts (i) (ii) 22. Residential Mortgage Lending (i) (ii) 23. Other Secured Lending (i) (ii) 24. Guarantees and Third Party Securities (i) (ii) Chapter 3 – Card Services 26. Issue of Cards (i) (ii) 27. Terms and Conditions (i) (ii) 28. Fees and Charges (i) (ii) 29. Interest Rate (i) (ii) 30. Repayment (i) (ii) 31. Rights of Set-off (i) (ii) 32. Security of Cards/PINs (i) (ii) 33. Transaction Records (i) (ii) 34. Unauthorized Transactions (i) (ii) 35. Lost Cards/PINs (i) (ii) 36. Liability for Loss (i) (ii) 37. Treatment of Credit Balances (i) (ii) 38. Direct Mailing (i) (ii) Chapter 4 – Payment Services 39. Cheques (i) (ii) 40. Cross-border Payments (i) (ii) 41. Other Payment Services (i) (ii) Chapter 5 – Recovery of Loans and Advances 43. Debt Collection Activities (i) (ii) 44. Management of Debt Collection Agencies (i) (ii) Chapter 6 – Electronic Banking Services 45. Disclosure for E-banking Services (i) (ii) 46. Security in relation to E-banking (i) (ii) 47. Reporting of Actual or Suspected Security Incidents (i) (ii) 48. Liability for Loss (i) (ii) Chapter 7 – Stored Value Cards (or Devices) 50. Issue of Stored Value Cards or Devices (SVCs) (i) (ii) 51. Terms and Conditions and Fees and Charges (i) (ii) 52. Operation of SVCs (i) (ii)

PART I (A) - DETAILS (FOR SUBSIDIARIES AND AFFILIATED COMPANIES) If a negative response is entered to Question (i) in the previous worksheet, please fill in the corresponding boxes below. If a negative response is entered to Question (ii) in the previous worksheet, please fill in the corresponding boxes below. Name(s) of subsidiary(ies) or affiliated company(ies) Sub￾section(s) Action plan Target completion date (DD/MM/YYYY) Name(s) of subsidiary(ies) or affiliated company(ies) Sub￾section(s) Description of non-compliance R e c t Filing date of exception report (DD/MM/YYYY) 5. Terms and Conditions (i) (ii) 6. Fees and Charges (i) (ii) 7. Debt Recovery Expenses (i) (ii) 8. Collection, Use, Holding and Erasure of Customer Information (i) (ii) 9. Personal Referees (i) (ii) 10. Equal Opportunity (i) (ii) 11. Bank Marketing (i) (ii) 12. Annualised Percentage Rates (APRs) (i) (ii) 13. Handling Customer Complaints (i) (ii) 14. Closing Bank Branches (i) (ii) 15. Management of Banking Activities (i) (ii) Chapter 2 – Accounts and Loans 16. Opening of Accounts (i) (ii) Section reference in current version Chapter 1 – Relationship between Institutions and Customers

If a negative response is entered to Question (i) in the previous worksheet, please fill in the corresponding boxes below. If a negative response is entered to Question (ii) in the previous worksheet, please fill in the corresponding boxes below. Name(s) of subsidiary(ies) or affiliated company(ies) Sub￾section(s) Action plan Target completion date (DD/MM/YYYY) Name(s) of subsidiary(ies) or affiliated company(ies) Sub￾section(s) Description of non-compliance R e c t Filing date of exception report (DD/MM/YYYY) Section reference in current version 17. Closing of Accounts (i) (ii) 18. Operation of Accounts (i) (ii) 19. Rights of Set-off (i) (ii) 20. Deposit Accounts (i) (ii) 21. Loans and Overdrafts (i) (ii) 22. Residential Mortgage Lending (i) (ii) 23. Other Secured Lending (i) (ii) 24. Guarantees and Third Party Securities (i) (ii) Chapter 3 – Card Services 26. Issue of Cards (i) (ii) 27. Terms and Conditions (i) (ii) 28. Fees and Charges (i) (ii) 29. Interest Rate (i) (ii)

If a negative response is entered to Question (i) in the previous worksheet, please fill in the corresponding boxes below. If a negative response is entered to Question (ii) in the previous worksheet, please fill in the corresponding boxes below. Name(s) of subsidiary(ies) or affiliated company(ies) Sub￾section(s) Action plan Target completion date (DD/MM/YYYY) Name(s) of subsidiary(ies) or affiliated company(ies) Sub￾section(s) Description of non-compliance R e c t Filing date of exception report (DD/MM/YYYY) Section reference in current version 30. Repayment (i) (ii) 31. Rights of Set-off (i) (ii) 32. Security of Cards/PINs (i) (ii) 33. Transaction Records (i) (ii) 34. Unauthorized Transactions (i) (ii) 35. Lost Cards/PINs (i) (ii) 36. Liability for Loss (i) (ii) 37. Treatment of Credit Balances (i) (ii) 38. Direct Mailing (i) (ii) Chapter 4 – Payment Services 39. Cheques (i) (ii) 40. Cross-border Payments (i) (ii) 41. Other Payment Services (i) (ii) Chapter 5 – Recovery of Loans and Advances

If a negative response is entered to Question (i) in the previous worksheet, please fill in the corresponding boxes below. If a negative response is entered to Question (ii) in the previous worksheet, please fill in the corresponding boxes below. Name(s) of subsidiary(ies) or affiliated company(ies) Sub￾section(s) Action plan Target completion date (DD/MM/YYYY) Name(s) of subsidiary(ies) or affiliated company(ies) Sub￾section(s) Description of non-compliance R e c t Filing date of exception report (DD/MM/YYYY) Section reference in current version 43. Debt Collection Activities (i) (ii) 44. Management of Debt Collection Agencies (i) (ii) Chapter 6 – Electronic Banking Services 45. Disclosure for E-banking Services (i) (ii) 46. Security in relation to E-banking (i) (ii) 47. Reporting of Actual or Suspected Security Incidents (i) (ii) 48. Liability for Loss (i) (ii) Chapter 7 – Stored Value Cards (or Devices) 50. Issue of Stored Value Cards or Devices (SVCs) (i) (ii) 51. Terms and Conditions and Fees and Charges (i) (ii) 52. Operation of SVCs (i) (ii)

PART II – SUPPLEMENTARY QUESTIONS 1 a) Is there an internal assessment system in your institution which monitors compliance with the Code (including compliance by the subsidiaries and affiliated companies) and enables your institution to identify areas of non-compliance? b) If yes, please provide a brief description of this system and explain how the system helps your institution in assessing compliance with the Code in day-to-day operations (through e.g. mystery shopping, customer satisfaction survey, review of customer complaints, and provision of sales kits and scripts). If no, please provide your reasons and indicate how compliance is monitored. Description/ Explanation: 2 a) Are there channels within the internal assessment system through which the identified areas of non-compliance (including those of the subsidiaries and affiliated companies) can be reported to the senior management of your institution? b) If yes, please provide a brief description of the channel(s). If no, please explain how the senior management of your institution oversee and ensure compliance with the Code? Description: 3 a) b) Description: Are you satisfied that all new products and services (if any) launched by your institution (including the subsidiaries and affiliated companies) during the period under review comply with the Code? Please also describe the system in place to ensure that all new products and services launched by your institution (including the subsidiaries and affiliated companies) comply with the Code. 4 a) Are you satisfied that appropriate training has been provided to relevant staff to enable them to understand the requirements of the Code? b) Please provide a brief report on staff training, including the methods (e.g. classroom training), trainers (e.g. Compliance Department), frequency, materials used, and mechanism to monitor quality and effectiveness of the staff training about the Code and its requirements. Description:

5 a) In relation to section 12.3 of the Code, are there any circumstances where your institution (including the subsidiaries and affiliated companies) has charged an APR of over 48%? If yes, please complete Q5(b) and Q5(c) below. b) Description: c) Description: Please provide the range of APRs charged, the reasons why such high interest rates are considered not to be unreasonable or unfair and the controls in place (e.g. documentation, escalation to senior officers for review and sign-off) to ensure that the charging of such rates is justified in all the circumstances. Please advise the proportion (in number and in %) of loans of your institution and of the subsidiaries and affiliated companies in respect of which APR>48% is charged. 6 a) Section 14 of the Code requires institutions to give reasonable notice, of not less than 2 months unless it is not practicable to do so, to customers before closing a branch. Please specify whether your institution (including the subsidiaries and affiliated companies) has, in any exceptional circumstances, given notice of less than 2 months before closing a branch. If yes, please provide the details in Q6(b) below. b) For each exceptional case, please provide justifications for not giving 2-months notice to customers before closing the particular branch in question. Description: 7 a) b) Description: Section 26.1 of the Code requires that card issuers should act responsibly in the issue and marketing of credit cards and the setting of credit card limits, in particular to persons (such as full-time students) who may not have independent financial means. Please specify whether your institution has issued credit cards to, or launched marketing campaigns for credit cards targeted at, full-time students or other persons who may not have independent financial means during the reporting period. If yes, please provide in Q7(b) below further details on your system for ensuring compliance with section 26.1 of the Code. Please describe the system in place to ensure compliance with the Code.