SFC Circular on Protecting Client Assets Against Internal Misconduct

1 Tel: (852) 2231 1222 Fax: (852) 2284 4660 Website: www.sfc.hk Appendix 2 Some Key Measures and Controls to Protect Client Assets Against Internal Misconduct (The SFC acknowledges that the measures adopted by LCs to address the matters set out in Appendix 1 may differ somewhat, for example, depending upon the size of a LC, its business, and the nature, scale and effectiveness of its operational and internal control procedures. Accordingly, Appendix 2 is intended to provide important guidance to LCs to protect client assets, but is not intended to be an exhaustive or prescriptive list. It should be read in conjunction with previous publications issued by the SFC1 , which collectively are intended to provide guidance to LCs to assist them in reviewing and improving their internal controls. In assessing the adequacy of a LC’s internal controls, the SFC will look to see whether this guidance has been adopted by LCs and, if not, whether any alternative measures and controls that have been implemented are effective in achieving the same objectives.)

1. Periodic review and testing 2 (a) Review cash and stock reconciliation (including, where applicable, reconciliation with CCASS records on a sub-account basis) to ensure that reconciliations are properly performed and all discrepancies and outstanding items are properly and swiftly followed up. (b) Ensure proper design of exception reports and review such reports, obtain good understanding of the reasons for the exceptions and ensure that they are properly followed up and resolved. (c) Review trading activities and other transactions in client accounts, such as dormant accounts and staff-related accounts, on a regular basis for irregular movements. (d) Review client accounts receiving third party receipts and making third party payments on a regular basis for unusual patterns or unauthorized transactions. (e) Ensure that when trade documents/ records are being sent to clients that there are procedures to: (i) verify the names and addresses of clients printed on the documents with the client database on a sample basis; and (ii) oversee the trade documents generation and dispatch processes to minimise the risk of tampering by staff.

1 Particularly “Circular to Licensed Corporations – Guarding against Risk of Client Asset Misappropriation” issued on 1 February 2013, “Circular to All Licensed Corporations Licensed for Dealing in Securities – Continuous and Close Supervision of Firm’s Operations” issued on 8 March 2006, “Circular to All Securities Dealers- Segregation of Duties” issued on 22 July 2002, “Suggested Control Techniques and Procedures for Enhancing a Firm’s Ability to Comply with the Securities and Futures (Client Securities) Rules and the Securities and Futures (Client Money) Rules” issued in April 2003, Internal Control Guidelines and the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission. 2 The frequency of the particular review or testing should be determined by taking into account the LC’s structure, modus operandi, nature of the control process, etc.

2 Tel: (852) 2231 1222 Fax: (852) 2284 4660 Website: www.sfc.hk (f) Ensure the integrity of the records by (i) reviewing or re-performing reconciliation processes by checking records of client cash and stock against source documents and records; and (ii) supervising the printing or generation process of records used for reconciliation purposes to minimise the risk of falsification. (g) Compare the transactions and/or position balances in clients’ trade documents with internal records on a sample basis. (h) Review clients’ addresses shown in the client database for anomalies such as use of same address by different clients and follow up on any anomalies. (i) Sample check client transaction records against telephone recordings and other order placing records and vice versa to identify unauthorized or unrecorded client transactions. (j) Confirm stock holding and cash balances directly with clients on a sample basis. (k) Enforce access controls to computer databases such as client database and settlement system. (l) Implement safeguards on critical stationery and documents such as printed/blank trade documents, client agreements and account opening documents. (m)Review all compliance and control related logs or records on a regular basis, such as the complaint log and log of changes to computer databases including client database. In the case of the complaint log, check whether all complaints are subject to an independent review and addressed promptly in an appropriate manner, identify any irregular trends or patterns and follow up on any anomalies. (n) Review the leave plans/records of staff and evaluate the adequacy of staff resources to facilitate the staff to take leave. 2. Approval in relation to clients’ requests (a) Only approve the opening of third party operated accounts, client’s request of cash or stock transfer to a third party account, and amendments to payees of cheques on an exceptional basis after: (i) making proper enquiries, such as the client’s relationship with the third party and the reason of such arrangement, and (ii) diligently review the evidence of client’s written authorization. (b) Only approve amendments to client records (including client address and other contact details) when the amendments are supported by written client authorization.*

3 Tel: (852) 2231 1222 Fax: (852) 2284 4660 Website: www.sfc.hk (c) Only approve client requests for hold mail arrangements when these are genuine requests and supported by written client authorization.* Set a ‘hold mail’ policy to monitor collection of trade documents and with reasonable frequency remind the clients to collect their trade documents as well as to confirm the accounts details with such clients.

• Arrange independent verification process to verify the client authorization with the client directly at least on a reasonable sample basis. (d) Arrange independent confirmation with clients on any cash or stock withdrawal made to third parties to verify its authenticity (including ‘calling back’ clients on their registered phone numbers to confirm the transfer).

3. Messages to be delivered to clients (a) Request clients to pass their funds or physical scrips directly to back office staff for handling. (b) Request clients to contact back office staff for all non-trade related matters, for example, any fund or stock deposit/withdrawal instructions and change of client particulars, unless there are compensating controls such as back office staff to verify non-trade instructions relayed by the account executives with the clients directly. (c) Request clients to contact the management, complaint officer or independent back office staff if they notice any issue or problem with their accounts or records. For example, an “important notice” could be included in the trade documents asking the clients to carefully review the documents and contact the complaint officer, or another designated person, upon noting any discrepancies.