SFC Circular on Protecting Client Assets Against Internal Misconduct Annex 2: List of Possible Red Flags, Pitfalls and Vulnerabilities

1 Tel: (852) 2231 1222 Fax: (852) 2284 4660 Website: www.sfc.hk Appendix 1 List of Possible Red Flags, Pitfalls and Vulnerabilities Staff-related

1. Staff concurrently performing front and back office functions who are subject to minimal checks, balances and supervision.
2. Staff who are closely related and perform key front and back office functions and who are subject to limited supervision.
3. Long serving staff coupled with trusting management and other staff who are accustomed to obeying the instructions of those long servicing staff.
4. Unusual behaviour of staff such as: (a) refusal to take leave; and (b) working excessive hours not warranted by workloads, particularly work undertaken outside usual office hours. Controls over trade documents
5. Printed trade documents pending dispatch left in an unsecure location, which increases risk of tampering by staff.
6. Unrestricted access to the system generating trade documents and records.
7. Blank trade documents kept in an unsecured location.
8. Staff collecting trade documents/ records on clients’ behalf who may have the chance to alter or withhold such documents/ records.
9. Clients with “hold mail” arrangements whose trade documents/ records are not collected for an extended period. Client assets controls
10. Clients passing their funds or physical scrips to their account executives for onward passing to the back office staff of the LC.
11. Allowing staff (including but not limited to account executives) to collect cheques or physical scrips on behalf of clients who have requested to withdraw funds or physical scrips.

2 Tel: (852) 2231 1222 Fax: (852) 2284 4660 Website: www.sfc.hk 12. Clients contacting their account executives for all matters related to their accounts, including non-trade related matters, such as deposit and withdrawal of funds and verification of account balances, which are ordinarily handled by the back office staff. 13. Allowing transfers of stocks or funds between different client accounts with no apparent reason. 14. Allowing staff to use their own funds to settle trades on clients’ behalf with no apparent reason. 15. Approving amendments to the payee of cheques issued to clients without written client instructions. 16. Inadequate review of whether client sales proceeds have been credited to the relevant client accounts when the clients have requested that the sales proceeds be retained in their accounts and no subsequent payment has been made to them by the LC. 17. Amendments by staff to clients’ instructions of cash or stock withdrawal without written client authorization and lacking proper internal review and approval. Reconciliation of client asset records controls 18. Absence of independent review of client cash and stock reconciliation. 19. No proper and independent reconciliation between trade documents/ records issued to clients and the LC’s ledgers and/or between the LC’s ledgers and external records, such as bank statements and CCASS records. 20. No verification against source documents/ records when reviewing client asset reconciliation. 21. No proper and independent review of exception reports, for example, reports for monitoring discrepancies in stock balance between internal records and external records. 22. No proper and independent reconciliation between internal stock ledger and CCASS records on sub-account basis. 23. Failure to ensure any discrepancies are noted during the reconciliation process are properly accounted for and followed up and reviewed in a timely manner. Client orders and accounts controls 24. Client orders cannot be traced back to telephone recordings, deal slips, etc. 25. No formal reactivation procedures over dormant accounts and no monitoring of activities when they suddenly becoming active.

3 Tel: (852) 2231 1222 Fax: (852) 2284 4660 Website: www.sfc.hk 26. Clients who do not appear to have any relationship that have the same correspondence, residential and/or email address. 27. Change of client particulars without proper client instructions and lacking proper internal approval and review. 28. Client agreements or other account opening records not kept in a secured location. 29. Failure to keep an audit log of change in client particulars for review by management.