SFC Circular on Protecting Client Assets Against Internal Misconduct

Our Ref: B1/15C
G16/1C
15 February 2016
The Chief Executive
All Registered Institutions
Dear Sir / Madam,
Circular Issued by the Securities and Futures Commission (“SFC”) on Protecting Client Assets Against Internal Misconduct I am writing to draw your attention to the attached circular issued by the SFC to licensed corporations (“LCs”) licensed for dealing in securities on protecting client assets against internal misconduct (“The Circular”). In the course of its supervisory work, the SFC observed that some LCs have weak internal controls and lax management supervision that render those LCs susceptible to the threat of internal misconduct. The Circular highlights the importance of internal controls and management supervision in guarding against the threat of internal misconduct. A non-exhaustive list of potential red flags, pitfalls and vulnerabilities, and a list of some key measures to which intermediaries should have regard when designing and implementing their operating and internal control procedures, are set out in the appendices to The Circular. Registered Institutions (“RIs”) should have regard to The Circular when designing and implementing relevant operating and internal control procedures, as applicable and appropriate to their particular circumstances. The HKMA will continue to monitor RIs’ compliance with relevant regulatory requirements in its supervisory process. Yours faithfully, Carmen Chu Executive Director (Banking Conduct) Encl. c.c. SFC (Attn: Mr James Shipton, Executive Director (Intermediaries))

---

Circular
Tel: (852) 2231 1222 Fax: (852) 2284 4660 Website: www.sfc.hk 5 February 2016 Circular to Licensed Corporations Licensed for Dealing in Securities Protecting Client Assets Against Internal Misconduct The SFC wishes to remind licensed corporations (“LCs”) licensed for dealing in securities that they should have internal control procedures and financial and operational capabilities which can be reasonably expected to protect their operations, their clients and other licensed or registered persons from financial loss arising from theft, fraud, and other dishonest acts, professional misconduct or omissions 1 . In particular theft and fraud against client assets may result from failure to guard against the threat of internal misconduct. In the course of our supervisory work, we have observed that some LCs have weak internal controls and lax management supervision that render them susceptible to the threat of internal misconduct. Internal misconduct involving theft and fraud against client assets may be perpetrated not only by front office staff, but also by: back office staff (for example, settlement staff); collusion between front and back office staff; or collusion between staff and third parties. A non￾exhaustive list of potential red flags, pitfalls and vulnerabilities which a LC should be vigilant about detecting is set out in Appendix 1. LCs are also expected to promptly deal with any threats by taking appropriate preventive measures. In particular, LCs are reminded to put in place the following procedures and controls that have been found to be lacking in some firms:
 ensure that key duties and functions are appropriately segregated, particularly those duties and functions which when performed by the same individual may result in errors going undetected or may increase the risk of internal misconduct; and  identify inconsistent, unusual or questionable transactions/ records including through:
o the reconciliation of records process; o frequent independent review of exception reports; and o regular review of compliance and control related logs or records. Whilst it is acknowledged that there are no perfect measures to fully eliminate the risk of internal misconduct against client assets, LCs can implement effective internal controls to reduce the likelihood of its occurrence. To this end, to ensure proper implementation of a firm’s internal controls and their on-going effectiveness for protection of client assets, LCs should, among other things:
 establish and enforce clear policies and procedures that cover all relevant aspects of the firm’s operations;  review and improve the policies and procedures regularly to ensure that they remain effective in light of changing circumstances and risks; and

1 Paragraph 4.3 of the Code of Conduct for Persons Licensed by or Registered with the SFC (“Code of Conduct”)

Tel: (852) 2231 1222 Fax: (852) 2284 4660 Website: www.sfc.hk  adopt internal audit and compliance review functions to evaluate and ensure adherence to its policies and procedures. In the case of smaller sized LCs which may not have the resources to support a completely independent internal audit or compliance review function, their management 2 should exercise extra caution and diligence and closely monitor and oversee the operations and risks to their firms. In addition, specific knowledge and diligence is required for management to fulfil their responsibilities for ensuring that effective internal controls over client assets are established and maintained, and that they are operating effectively. The management, in particular those staff new to management positions, should:

 take all necessary steps to fully understand the operations and internal controls of the firm relating to client assets;  familiarise themselves with the types of reports or other information available for monitoring whether the related company policies and procedures are being properly followed by staff;  in the case of smaller sized LCs, possess sufficient knowledge and understanding to oversee (and where appropriate test by re-performing) the operational processes relating to client assets so as to ensure the effectiveness of the relevant controls. Where needed, seek professional advice to review and strengthen the control and monitoring measures; and  when reviewing or approving documents within these processes, question whether the documents make sense and be vigilant of any irregular patterns or trends. While LCs need to recognize and understand the red flags, pitfalls and vulnerabilities set out in Appendix 1, these also need to be viewed by each LC within the context of its own particular circumstances, including its structure, business operations and needs. Appendix 2 lists some key measures to which LCs should have regard when designing and implementing their operating and internal control procedures for the purpose of protecting client assets against internal misconduct. Ultimately, the management of a LC is responsible for the adequacy and effectiveness of its internal controls and should ensure that the LC adopts measures which are appropriate to its particular circumstances and that appropriately comply with the applicable rules and guidance issued by the SFC. Investor protection is one of the SFC’s regulatory objectives under the Securities and Futures Ordinance and the SFC will not hesitate to take any necessary actions against those LCs and/or their management who fail to put in place appropriate internal controls and management supervision to protect the firms and their clients from the threat of control failings that increases the risks of financial loss arising from theft, fraud, and other dishonest acts, professional misconduct or omissions.

2 The term “management” used in this circular has the same meaning as “Management” that has been defined in the Management, Supervision and Internal Control Guidelines for Persons Licensed by or Registered with the Securities and Futures Commission (“Internal Control Guidelines”)

Tel: (852) 2231 1222 Fax: (852) 2284 4660 Website: www.sfc.hk Should you have any queries regarding the contents of this circular, please contact Ms Kammy Kwok at 2231 1455. Intermediaries Supervision Department Intermediaries Division Securities and Futures Commission Enclosure End SFO/IS/004/2016

---

Tel: (852) 2231 1222 Fax: (852) 2284 4660 Website: www.sfc.hk
Appendix 1
List of Possible Red Flags, Pitfalls and Vulnerabilities Staff-related

1. Staff concurrently performing front and back office functions who are subject to minimal
   checks, balances and supervision.
2. Staff who are closely related and perform key front and back office functions and who are
   subject to limited supervision.
3. Long serving staff coupled with trusting management and other staff who are
   accustomed to obeying the instructions of those long servicing staff.
4. Unusual behaviour of staff such as:
   (a) refusal to take leave; and
   (b) working excessive hours not warranted by workloads, particularly work undertaken outside usual office hours. Controls over trade documents
5. Printed trade documents pending dispatch left in an unsecure location, which increases
   risk of tampering by staff.
6. Unrestricted access to the system generating trade documents and records.
7. Blank trade documents kept in an unsecured location.
8. Staff collecting trade documents/ records on clients’ behalf who may have the chance to
   alter or withhold such documents/ records.
9. Clients with “hold mail” arrangements whose trade documents/ records are not collected
   for an extended period.
   Client assets controls
10. Clients passing their funds or physical scrips to their account executives for onward
    passing to the back office staff of the LC.
11. Allowing staff (including but not limited to account executives) to collect cheques or
    physical scrips on behalf of clients who have requested to withdraw funds or physical scrips.

Tel: (852) 2231 1222 Fax: (852) 2284 4660 Website: www.sfc.hk
12. Clients contacting their account executives for all matters related to their accounts,
including non-trade related matters, such as deposit and withdrawal of funds and verification of account balances, which are ordinarily handled by the back office staff.
13. Allowing transfers of stocks or funds between different client accounts with no apparent
reason.
14. Allowing staff to use their own funds to settle trades on clients’ behalf with no apparent
reason.
15. Approving amendments to the payee of cheques issued to clients without written client
instructions.
16. Inadequate review of whether client sales proceeds have been credited to the relevant
client accounts when the clients have requested that the sales proceeds be retained in their accounts and no subsequent payment has been made to them by the LC.
17. Amendments by staff to clients’ instructions of cash or stock withdrawal without written
client authorization and lacking proper internal review and approval. Reconciliation of client asset records controls
18. Absence of independent review of client cash and stock reconciliation.
19. No proper and independent reconciliation between trade documents/ records issued to
clients and the LC’s ledgers and/or between the LC’s ledgers and external records, such as bank statements and CCASS records.
20. No verification against source documents/ records when reviewing client asset
reconciliation.
21. No proper and independent review of exception reports, for example, reports for
monitoring discrepancies in stock balance between internal records and external records.
22. No proper and independent reconciliation between internal stock ledger and CCASS
records on sub-account basis.
23. Failure to ensure any discrepancies are noted during the reconciliation process are
properly accounted for and followed up and reviewed in a timely manner. Client orders and accounts controls
24. Client orders cannot be traced back to telephone recordings, deal slips, etc.
25. No formal reactivation procedures over dormant accounts and no monitoring of activities
when they suddenly becoming active.

Tel: (852) 2231 1222 Fax: (852) 2284 4660 Website: www.sfc.hk
26. Clients who do not appear to have any relationship that have the same correspondence,
residential and/or email address.
27. Change of client particulars without proper client instructions and lacking proper internal
approval and review.
28. Client agreements or other account opening records not kept in a secured location.
29. Failure to keep an audit log of change in client particulars for review by management.

---

Tel: (852) 2231 1222 Fax: (852) 2284 4660 Website: www.sfc.hk
Appendix 2
Some Key Measures and Controls to Protect Client Assets Against Internal Misconduct (The SFC acknowledges that the measures adopted by LCs to address the matters set out in
Appendix 1 may differ somewhat, for example, depending upon the size of a LC, its business,
and the nature, scale and effectiveness of its operational and internal control procedures. Accordingly, Appendix 2 is intended to provide important guidance to LCs to protect client assets, but is not intended to be an exhaustive or prescriptive list. It should be read in conjunction with previous publications issued by the SFC 1 , which collectively are intended to provide guidance to LCs to assist them in reviewing and improving their internal controls. In assessing the adequacy of a LC’s internal controls, the SFC will look to see whether this guidance has been adopted by LCs and, if not, whether any alternative measures and controls that have been implemented are effective in achieving the same objectives.)

1. Periodic review and testing
   (a) Review cash and stock reconciliation (including, where applicable, reconciliation with CCASS records on a sub-account basis) to ensure that reconciliations are properly performed and all discrepancies and outstanding items are properly and swiftly followed up. (b) Ensure proper design of exception reports and review such reports, obtain good understanding of the reasons for the exceptions and ensure that they are properly followed up and resolved. (c) Review trading activities and other transactions in client accounts, such as dormant accounts and staff-related accounts, on a regular basis for irregular movements. (d) Review client accounts receiving third party receipts and making third party payments on a regular basis for unusual patterns or unauthorized transactions. (e) Ensure that when trade documents/ records are being sent to clients that there are procedures to:
   (i) verify the names and addresses of clients printed on the documents with the client database on a sample basis; and (ii) oversee the trade documents generation and dispatch processes to minimise the risk of tampering by staff.

1 Particularly “Circular to Licensed Corporations – Guarding against Risk of Client Asset Misappropriation” issued on 1 February 2013, “Circular to All Licensed Corporations Licensed for Dealing in Securities – Continuous and Close Supervision of Firm’s Operations” issued on 8 March 2006, “Circular to All Securities Dealers- Segregation of Duties” issued on 22 July 2002, “Suggested Control Techniques and Procedures for Enhancing a Firm’s Ability to Comply with the Securities and Futures (Client Securities) Rules and the Securities and Futures (Client Money) Rules” issued in April 2003, Internal Control Guidelines and the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission. 2 The frequency of the particular review or testing should be determined by taking into account the LC’s structure, modus operandi, nature of the control process, etc.

Tel: (852) 2231 1222 Fax: (852) 2284 4660 Website: www.sfc.hk (f) Ensure the integrity of the records by (i) reviewing or re-performing reconciliation processes by checking records of client cash and stock against source documents and records; and (ii) supervising the printing or generation process of records used for reconciliation purposes to minimise the risk of falsification. (g) Compare the transactions and/or position balances in clients’ trade documents with internal records on a sample basis. (h) Review clients’ addresses shown in the client database for anomalies such as use of same address by different clients and follow up on any anomalies. (i) Sample check client transaction records against telephone recordings and other order placing records and vice versa to identify unauthorized or unrecorded client transactions. (j) Confirm stock holding and cash balances directly with clients on a sample basis. (k) Enforce access controls to computer databases such as client database and settlement system. (l) Implement safeguards on critical stationery and documents such as printed/blank trade documents, client agreements and account opening documents. (m)Review all compliance and control related logs or records on a regular basis, such as the complaint log and log of changes to computer databases including client database. In the case of the complaint log, check whether all complaints are subject to an independent review and addressed promptly in an appropriate manner, identify any irregular trends or patterns and follow up on any anomalies. (n) Review the leave plans/records of staff and evaluate the adequacy of staff resources to facilitate the staff to take leave.
2. Approval in relation to clients’ requests
(a) Only approve the opening of third party operated accounts, client’s request of cash or stock transfer to a third party account, and amendments to payees of cheques on an exceptional basis after:
(i) making proper enquiries, such as the client’s relationship with the third party and the reason of such arrangement, and (ii) diligently review the evidence of client’s written authorization. (b) Only approve amendments to client records (including client address and other contact details) when the amendments are supported by written client authorization.*

Tel: (852) 2231 1222 Fax: (852) 2284 4660 Website: www.sfc.hk (c) Only approve client requests for hold mail arrangements when these are genuine requests and supported by written client authorization.* Set a ‘hold mail’ policy to monitor collection of trade documents and with reasonable frequency remind the clients to collect their trade documents as well as to confirm the accounts details with such clients.

• Arrange independent verification process to verify the client authorization with the
  client directly at least on a reasonable sample basis.
  (d) Arrange independent confirmation with clients on any cash or stock withdrawal made to third parties to verify its authenticity (including ‘calling back’ clients on their registered phone numbers to confirm the transfer).

3. Messages to be delivered to clients
   (a) Request clients to pass their funds or physical scrips directly to back office staff for handling. (b) Request clients to contact back office staff for all non-trade related matters, for example, any fund or stock deposit/withdrawal instructions and change of client particulars, unless there are compensating controls such as back office staff to verify non-trade instructions relayed by the account executives with the clients directly. (c) Request clients to contact the management, complaint officer or independent back office staff if they notice any issue or problem with their accounts or records. For example, an “important notice” could be included in the trade documents asking the clients to carefully review the documents and contact the complaint officer, or another designated person, upon noting any discrepancies.