SFC Circular on Client Facilitation Annex 2: Thematic Review Observations and Expected Standards

Appendix 1 Observations from the thematic review of client facilitation are set out below along with the SFC’s expected standards. Some good practices are highlighted, as are some less satisfactory practices which did not meet the expected standards. I. Controls, monitoring and management supervision Expected standards Sufficient management oversight should be in place to ensure that trade exceptions and other matters related to client facilitation are brought to management’s attention for timely review. Policies and procedures should be established which cover the key areas relating to client facilitation such as client consent, order visibility, system access, the accuracy of indications of interest (IOIs) and position limits. These policies and procedures should be reviewed and updated on a regular basis. Effective control functions should be established to properly manage the risks associated with client facilitation and to ensure adequate controls for detecting and addressing potential misconduct. All relevant staff should be provided with periodic training on client facilitation as well as updates on internal policies and procedures. Observations Management oversight

1. In some LCs, committees comprised of senior management and other stakeholders would review exception reports1 generated from day-to-day client facilitation operations or produced by second and third lines of defense. Good practices Senior management was required to sign off on daily reports capturing exceptions identified from day-to-day client facilitation operations and to delegate responsibility for investigating the exceptions to an independent team of trade surveillance staff. The results of investigations and any remediation would be reported to senior management in a timely manner. Policies and procedures
2. A number of LCs had written policies and procedures in place on client facilitation.
3. Some LCs had policies and procedures which clearly defined the scope of their client facilitation services and traders’ responsibilities2 and included key controls such as risk 1 For example, when the client facilitation desk bought or sold the same securities as the agency desk in a short period of time, some LCs would capture these orders in the trade exception reports. 2 For example, some LCs’ policies and procedures clearly stated that only client facilitation traders were responsible for providing risk prices to clients.

2 limits, trading restrictions3 , disclosure to clients of conflicts of interest and access to order information by agency and principal traders. 4. We noted the following practice which deviated from the expected standards:  Some LCs’ policies and procedures only covered conflicts of interest as a general topic but not key client facilitation controls such as client consent, order visibility, system access, the accuracy of IOIs and position limits. Controls and monitoring a. Trade surveillance alerts 5. To conduct proactive client facilitation4 , LCs built positions in anticipation of future client orders. Some LCs imposed risk limits to prevent client facilitation desks from taking excessive positions beyond those considered necessary based on client demand. Their surveillance systems would generate alerts where the positions taken by client facilitation desks exceeded the risk limits imposed. 6. In some LCs’ surveillance systems, alerts were generated by irregularities which indicated potential misconduct such as front running. These alerts were reviewed by trade surveillance staff from the control functions who analysed the trade data and market conditions to decide whether to take further action and to document the rationale behind the decision for audit trail purposes. 7. An LC required management approval for any major change in the logic of the surveillance system. User acceptance testing was conducted for proposed changes before seeking approval. 8. We noted the following practice which deviated from the expected standards:  An LC’s trade surveillance system generated a large number of false alerts which could be avoided by enhancing the system logic. Most of the alerts were closed by the surveillance team without sufficient written justification or follow-up action. Good practices Peer reviews of trade surveillance alerts were conducted periodically. Surveillance team members spot-checked alerts closed by team members to assess whether they were closed with sufficient justification. To assess whether clients were treated fairly, the trade surveillance team reviewed all trades switched from the agency desks which generated profits for the client facilitation desk. 3 For example, client facilitation traders might be restricted from building up positions which could not be justified by anticipating future client orders. 4 Proactive or active client facilitation involves a client facilitation trader building an inventory in anticipation of future client orders and then proactively marketing their services to potential clients. Reactive or passive client facilitation refers to a client approaching a trader to initiate a trade execution request. The client facilitation trader subsequently takes a principal position and becomes the counterparty to the trade.

3 b. Responsibilities of compliance and internal audit functions 9. The compliance and internal audit functions of some LCs conducted regular or ad-hoc reviews of controls associated with client facilitation activities. 10. We noted the following practice which deviated from the expected standards:  Some LCs’ compliance and internal audit functions did not carry out any monitoring or review of client facilitation activities. Others carried out compliance and internal audit reviews but most of these focused on a single control, such as client consent, and neglected other important areas, for example, controls on order visibility and system access and the accuracy of IOIs. Good practices Compliance functions reviewed all proactive client facilitation orders and compared their execution times against those of agency orders to detect potential front running. Awareness and training 11. Some LCs conducted specific client facilitation training for new joiners as well as existing staff, covering topics such as client consent requirements and visibility restrictions. Training records were kept and monitored by independent training units. 12. An LC conducted training on client consent which covered various ways of obtaining consent, the specific staff responsible for obtaining it and the controls and monitoring to ensure it had been obtained. 13. We noted the following practice which deviated from the expected standards:  An LC conducted training sessions which covered conflicts of interest in general but failed to address specific client facilitation topics such as consent requirements and visibility restrictions. Staff might not be fully aware of internal policies and procedures as well as the potential risks associated with client facilitation.

4 II. Segregation of agency and facilitation activities Expected standards To protect sensitive client information and avoid conflicts of interest, the physical work locations of agency and client facilitation traders should be segregated. The responsibilities of client facilitation traders should be clearly defined in mandates. To prevent client facilitation traders from accessing agency order flows in trading systems, their user profiles and access rights should be granted according to their job responsibilities and subjected to periodic review. For client facilitation orders, communications between agency and client facilitation traders should be recorded and monitored on a timely basis. Observations Physical segregation 14. A number of LCs seated agency traders away from client facilitation traders to prevent leakage of sensitive client information. Some LCs located compliance staff between agency and client facilitation traders on the trading floor to further reinforce the segregation. 15. We noted the following practices which deviated from the expected standards:  Some LCs’ client facilitation desks were seated next to the agency desks. The LCs considered that close proximity would facilitate better coordination in cases where orders were referred from agency desks to client facilitation desks to meet clients’ specific demands.  Some LCs’ client facilitation traders participated in meetings which involved all traders, including agency traders. However, these LCs did not have any controls to prevent client facilitation traders from inadvertently obtaining sensitive client order information. Systems access segregation 16. Effective system segregation can prevent client facilitation traders from viewing agency flows. A number of LCs had policies and procedures to manage access rights. Access requests were logged in workflow systems, approved by supervisors or line managers and endorsed by a secondary reviewer. Furthermore, where staff members were assigned to a new role, their access rights would be reviewed and modified. 17. A number of LCs assigned client facilitation traders to a specific user profile with visibility restrictions. The agency flow was not visible to client facilitation traders, except where an order was raised by agency traders and routed to the client facilitation desk. Communication channels 18. Since agency traders might relay client facilitation orders to client facilitation traders, a number of LCs implemented controls to prevent leakage of confidential client information

5 through all available communication channels, including voice (phone and in-person), emails, instant messaging systems and squawk boxes. 19. Some LCs implemented shared drive access controls on agency and client facilitation traders and regularly reviewed access records. 20. An LC required that the communication of client facilitation orders between client-facing staff and client facilitation traders be recorded. Such records were subject to periodic review. 21. We noted the following practice which deviated from the expected standards:  Some agency and client facilitation traders were granted access to the same folders in the shared drives even though the LC had segregated other physical and system access. Access to these shared folders was not subject to any monitoring or review.

6 III. Consent and disclosure Expected standards As LCs assume a risk-taking principal position against clients in client facilitation activities, the nature of the trades should be disclosed to clients and their prior consent obtained5 so that they are fully aware of the inherent conflicts of interest. The parties responsible for obtaining client consent should be clearly defined. Where either client-facing staff who handle client facilitation orders or the client facilitation desk are located in Hong Kong6 , client consent is required. Observations Consent requirement 22. A number of LCs had policies and procedures to prescribe when client consent would be needed and who would be responsible for obtaining client consent under various trade scenarios. 23. We noted the following practice which deviated from the expected standards:  A client facilitation trader did not obtain consent from his clients. He said he had known his clients for years and hence, by assumption, they should know he was a client facilitation trader and the orders were client facilitation orders. Good practices Systematic pre-trade controls were implemented for obtaining consent for client facilitation orders. The client facilitation traders had to acknowledge in the trading system that consent was obtained before they were permitted to proceed to execution. Consent and disclosures for affiliates and overnight orders 24. For a number of LCs, the Hong Kong market is an Asian trading hub and their execution teams commonly handle orders from overseas affiliates as well as overnight orders. They would disclose the nature of the trade prior to the execution of a client facilitation order so that the client is fully aware of the inherent conflicts of interest. 25. Client-facing staff (whether located in or outside Hong Kong) of some LCs were also trained in or made aware of consent requirements. 26. A number of LCs relied on affiliates to obtain consent from clients located outside Hong Kong. When execution teams in Hong Kong received orders from affiliates, they confirmed with the affiliates whether consent was obtained. 5 In cases where clients place a basket order, client consent can be obtained for the entire basket order and does not need to be obtained for each constituent stock. 6 In cases where LCs handle client facilitation orders placed by their affiliates on behalf of the affiliates’ clients located outside Hong Kong, ie, the end clients, LCs can rely on their affiliates to obtain prior consent from the end clients. LCs should be able to demonstrate that they have exercised due care when relying on affiliates in obtaining client consent.

7 27. Some LCs encouraged clients to provide consent at the time they placed overnight orders if the clients or the LCs anticipated that the orders might need to be executed through the client facilitation desk.

8 IV. Indications of interest (IOIs)7 Expected standards IOIs should only be disseminated when they are based on a genuine client or proprietary intent to trade. IOIs should provide sufficient details8 , and controls and monitoring should be implemented to ensure they are accurate and updated in a timely manner. Due care should be exercised when disseminating IOIs to reduce the likelihood of sensitive trade information being abused. Observations IOIs dissemination practices and controls 28. A number of LCs’ traders used IOIs as a means to disseminate their trading intent to the market. The majority of IOIs were posted electronically (eg, through FIX9 messaging) through IOI platforms provided by third-party vendors and the status of the IOIs was updated automatically. 29. The industry generally categorised IOIs as “natural” or “non-natural”. “Natural” IOIs were underlined by agency orders, back-to-back transactions or unwinding actual positions resulting from client facilitation orders. “Non-natural” IOIs were underlined by LCs’ proprietary positions. We received feedback that LCs might have different definitions of “natural” and “non-natural” IOIs. 30. Some LCs disseminated IOIs on behalf of their overseas group companies. They indicated that they would hold themselves accountable for the accuracy of IOIs disseminated on behalf of their group companies. 31. For orders with significant market impact, one LC used voice or direct messaging instead of an IOI system. 32. We noted the following practices which deviated from the expected standards:  The policies and procedures of a number of LCs only covered the dissemination of IOIs through third-party vendors’ platforms and did not include controls to ensure the accuracy of IOIs disseminated through other communication channels such as phone calls and emails.  Some LCs did not have any controls to ensure IOIs were accurate and up-to-date.  An LC’s client facilitation traders were inadvertently granted access to IOIs disseminated by its own agency desk on a third-party vendor’s platform due to management oversight. This highlighted the lack of a review of IOI visibility. The respective access rights were immediately removed upon our enquiry during the review. 7 As a way to source potential clients with an interest in trading, LCs disseminate IOIs from time to time. It is common for client facilitation desks to disseminate IOIs due to the nature of their business. However, since IOIs are not only disseminated by client facilitation desks, this guidance should be applied across all trading desks. 8 For example, whether IOIs are underlined by agency orders, back-to-back transactions, a proprietary intent to trade or the unwinding of actual positions resulting from client facilitation trades. 9 Financial Information eXchange.

9 Good practices Guidance was provided to staff on the definition of “natural” and “non-natural” IOIs. Controls ensured that IOIs contained accurate information and were sent to the target recipients. Reports were periodically generated highlighting potentially inaccurate or misleading IOIs. Department supervisors and the compliance function reviewed the reports and would follow up with the relevant departments if there were any incidents or exceptions. Client tiering and opt-out mechanisms 33. A number of LCs considered that adopting client tiering made it more likely for IOIs to reach clients with a genuine interest in responding. It also prevented the leakage of confidential trade information. 34. Clients of some LCs were allowed to opt out of disseminating their trading intent to the market as IOIs. In return, the LCs would not send IOIs to these clients to reduce the likelihood of sensitive trade information being abused. Good practices Clients were tiered according to criteria such as business scale, trading strategies and past willingness to trade large blocks of shares. Tiering clients and strategically selecting IOI recipients reduced the likelihood of disseminating trade information to recipients who might abuse it. These criteria were periodically reviewed to ensure clients were being appropriately tiered.