Supervision of Insurance Intermediary Business of Authorized Institutions

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 1 This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Purpose To describe the HKMA's approach to supervising the businesses of regulated activities of AIs that are licensed insurance intermediaries under the Insurance Ordinance Classification A statutory guideline issued by the MA under the Banking Ordinance, §7(3) Previous guidelines superseded IB-1 “Supervision of Insurance Intermediary Business of Authorized Institutions” (V.1) dated 25.06.21 Application To all AIs that are licensed insurance intermediaries Structure

1. Introduction 1.1 Terminology
2. Regulatory and supervisory framework 2.1 General 2.2 Licensing with the IA 2.3 Cooperation between the HKMA and the IA

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 2 3. Supervisory and Enforcement approaches 3.1 General 3.2 Guidelines and supervisory standards 3.3 On-site examinations 3.4 Off-site surveillance 4. Legal requirements in respect of regulated activities of AIs 4.1 The Insurance Ordinance and major subsidiary legislation 5. Major regulatory requirements in respect of insurance business of AIs 5.1 General 5.2 Corporate governance and internal controls 5.3 Guideline on “Fit and Proper” Criteria for Licensed Insurance Intermediaries under the Insurance Ordinance (Cap. 41) (“GL23”) and the HKMA’s expectations on sufficiency of authority of responsible officers 5.4 Code of Conduct for Licensed Insurance Agents and Code of Conduct for Licensed Insurance Brokers (“Codes of Conduct”) 5.5 Guideline on Continuing Professional Development for Licensed Insurance Intermediaries (“GL24”) 5.6 Other major regulatory requirements of the IA 5.7 Regulatory requirements of the HKMA 5.8 Prevention of money laundering and terrorist financing 6. Reporting of certain events 6.1 Statutory reporting requirements 6.2 Reporting of incidents 7. Disciplinary actions —————————

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 3

1. Introduction 1.1 Terminology 1.1.1 In this module: • “authorized insurer” means an insurer that is authorized under the Insurance Ordinance, and “authorized” in the context of “authorized insurer”, has the meaning set out in §2 of the Insurance Ordinance; • “Codes of Conduct” means Code of Conduct for Licensed Insurance Agents and Code of Conduct for Licensed Insurance Brokers issued by the IA pursuant to §95 of the Insurance Ordinance; • “IA” means the Insurance Authority; • “licensed insurance agency” has the meaning set out in §2 of the Insurance Ordinance (i.e. a person who is granted a licence under §64U of the Insurance Ordinance); • “licensed insurance broker company” has the meaning set out in §2 of the Insurance Ordinance (i.e. a company which is granted a licence under §64ZA of the Insurance Ordinance); • “licensed insurance intermediary” means a licensed insurance agency, a licensed insurance broker company, a licensed individual insurance agent, a licensed technical representative (agent), or a licensed technical representative (broker), each of which has the meaning set out in §2 of the Insurance Ordinance; • “licensed technical representative” means a licensed technical representative (agent) or a licensed technical representative (broker), each of which has the meaning set out in §2 of the Insurance Ordinance; • “long term insurance product” / “long term insurance policy” means an insurance product or an insurance policy which is classed as long term business

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 4 specified in Part 2 of Schedule 1 to the Insurance Ordinance; the term “product” and “policy” may be used interchangeably throughout this module; • “misconduct” has the meaning set out in §80(1) of the Insurance Ordinance; • “non-investment-linked long term insurance product” means a long term insurance product except the one under Class C business specified in Part 2 of Schedule 1 to the Insurance Ordinance; • “regulated activity” has the scope set out in §3A of and Schedule 1A to the Insurance Ordinance; • “regulated person” has the meaning set out in §80(1) of the Insurance Ordinance; and • “responsible officer” has the meaning set out in §2 of the Insurance Ordinance (i.e. an individual who is approved by the IA under §64ZE or §64ZF of the Insurance Ordinance). 1.1.2 The explanation of legal terms given above and the summaries of legal and regulatory requirements provided in the remainder of this module are for readers’ reference and guidance only. Legal advice should be sought where precise interpretation is required. 2. Regulatory and supervisory framework 2.1 General 2.1.1 The Insurance Ordinance (along with its subsidiary legislation) is the principal legislation to regulate the insurance industry in Hong Kong, which is a consolidated package of the requirements pertaining to authorization of insurers, licensing of insurance intermediaries, ongoing compliance and reporting obligations of regulated entities and other related matters. The regulatory framework for AIs is set out in the Banking Ordinance, which (along with its

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 5 subsidiary legislation) is a statute providing the legal framework for supervision of AIs. 2.1.2 While the IA is the regulator of insurance industry in Hong Kong, pursuant to §4G of the Insurance Ordinance and the approval of the Chief Executive in Council, the IA has delegated its inspection powers under §64ZZF(6) and investigation powers under §64ZZH(1) of the Insurance Ordinance to the MA in relation to businesses of regulated activities carried on by AIs. Also, the MA supervises AIs in accordance with the Banking Ordinance. The HKMA is therefore responsible for the day-to-day supervision of regulated activities of AIs. 2.2 Licensing with the IA 2.2.1 Under §64G of the Insurance Ordinance, a person must not carry on a regulated activity, or hold out that the person is carrying on a regulated activity, in the course of the person’s business or employment, or for reward, unless the person is a licensed insurance intermediary or is exempt under the Insurance Ordinance. 2.2.2 An AI that intends to carry on regulated activities must apply to the IA for an insurance intermediary licence. The HKMA normally will require the AI to provide an Independent Assurance Report on the AI’s fitness and propriety and whether the AI is competent to carry on regulated activities with reference to the relevant statutory requirements as well as regulatory requirements issued by the IA and the HKMA, if the AI is new to a line of business in the insurance market of Hong Kong or if the plan is regarded as complex. AIs should refer to Chapter 8 of the Guide to Authorization issued by the HKMA for detail of the requirement on the Independent Assurance Report. To facilitate planning, AIs should notify the HKMA of their intended application in advance. 2.2.3 AIs are also required to appoint at least one individual as its (proposed) responsible officer to supervise the carrying on of regulated activities and to ensure adequate and effective

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 6 policies, controls and procedures are in place for the purpose of compliance with the Insurance Ordinance and other applicable regulatory requirements. The HKMA’s expectations in relation to the sufficiency of authority of responsible officers of AIs, including the number of responsible officers, are detailed in paragraphs 5.3.2 to 5.3.4. 2.2.4 The IA has issued the “Explanatory Note on Licensing Requirements for Banking Sector under Regulatory Regime for Insurance Intermediaries” and “Explanatory Note on “Regulated Activity” under the Insurance Ordinance (Cap. 41)” providing guidance on the extent to which activities, including certain banking activities, related to insurance would be regarded as regulated activities, and thus AIs and their staff would be required to be licensed under the Insurance Ordinance. AIs should study the Explanatory Notes carefully in assessing whether there are needs for them and their staff to apply for insurance intermediary licences. AIs and their staff are reminded to refrain from carrying on any regulated activity if they are not licensed insurance intermediaries. 2.2.5 AIs should also refer to the circulars issued by the IA from time to time to licensed insurance intermediaries regarding the licensing-related matters. 2.3 Cooperation between the HKMA and the IA 2.3.1 To facilitate the cooperation and strengthen the collaboration between the MA and the IA, the two regulators have entered into a Memorandum of Understanding (“MoU”) in July 2019 setting out the framework for coordinating the regulation and supervision of entities or financial groups in which the two regulators have a mutual regulatory interest, as well as the collaborative arrangements for licensing, supervision, complaint handling, enforcement, etc. in relation to businesses of regulated activities carried on by AIs. The MA and the IA also signed another MoU in May 2021 setting out the collaborative arrangements between the two regulators

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 7 in relation to the group-wide supervision regime for insurance groups under the Insurance Ordinance. 2.3.2 As a general principle, inspections and investigations under the Insurance Ordinance in relation to businesses of regulated activities of AIs are conducted by the MA, and complaints relating to businesses of regulated activities of AIs are also handled by the MA. Nevertheless, the IA may also exercise its powers under the Insurance Ordinance in relation to businesses of regulated activities carried on by AIs, when the IA considers it necessary to do so. The IA and the HKMA will maintain close communication in such circumstances. 2.3.3 Pursuant to §53A of the Insurance Ordinance and §120 of the Banking Ordinance, the IA and the MA may disclose information to each other. The two regulators conduct regular meetings and other forms of supervisory dialogues to discuss matters of mutual interest relating to the performance of their regulatory and supervisory functions. 3. Supervisory and Enforcement approaches 3.1 General 3.1.1 Pursuant to §7 of the Banking Ordinance, one of the functions of the MA is to take all reasonable steps to ensure that the businesses of AIs are carried on with integrity, prudence and the appropriate degree of professional competence. Further, the mandate of the MA is to promote and encourage proper standards of conduct and sound and prudent business practices amongst AIs. 3.1.2 In its efforts to enhance bank customer protection, the HKMA takes into account the G20/OECD High-level Principles on Financial Consumer Protection. These principles, which include, among others, equitable and fair treatment of customers, disclosure and transparency, and responsible business conduct, have been incorporated in the Code of Banking Practice (“Code”) issued jointly by the Hong

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 8 Kong Association of Banks and the DTC Association, and endorsed by the HKMA. The Code applies to the overall relationship between AIs and their customers in Hong Kong, and should be observed by AIs in dealing with and providing products and services to their customers. The HKMA has also worked closely with the banking industry to promote sound bank culture that supports prudent risk management and contributes towards incentivising proper staff behaviour leading to positive customer outcomes and high ethical standards in the banking industry. 3.1.3 In the context of regulated activities, the HKMA performs the role of front line supervisor and supervises AIs’ compliance with all relevant requirements, providing an appropriate degree of protection to bank customers. 3.1.4 In practice, the board1 and senior management of an AI bear the primary responsibility for putting in place sound controls and systems commensurate with the AI’s risk profile for properly managing the risks associated with the regulated activities. They have the responsibility of, among others, protecting their customers’ interests, and are expected to play a proactive role in ensuring effective risk management and establishing the AI’s culture, values and behavioural standards that promote prudent risk-taking and fair treatment of customers. Meanwhile, the HKMA monitors AIs’ compliance with relevant laws and regulatory standards, promotes good corporate governance and sound bank culture, and takes a range of supervisory and enforcement actions to address issues identified. 3.1.5 The HKMA adopts a risk-based supervisory approach and measures that are appropriate and proportionate to the risks posed by AIs’ regulated activities to the public. To ensure a fair and consistent supervisory process, generally speaking, 1 For a locally-incorporated AI, the board may delegate its oversight duties to designated board-level committee(s). As regards the Hong Kong operations of an AI incorporated outside Hong Kong, the term “board” generally refers to the local senior management of the AI under the scrutiny by its head office or regional headquarters.

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 9 there are three levels of measures that the HKMA would consider. 3.1.6 The first level of supervisory action is encouraging adoption of good practices. The HKMA would share good practices with the industry, and encourage AIs which have not yet adopted such good practices to do so, as far as practicable, to strengthen their practices and controls. 3.1.7 In addition, where the HKMA identifies management, system or control deficiencies of AIs in its supervisory process, the HKMA would consider the second and the third levels of supervisory action, taking into consideration the nature and the severity of the deficiencies and implications. 3.1.8 The second level of supervisory action would be deployed where deficiencies in controls and practices of AIs are identified. Such deficiencies may include AIs’ controls or practices that do not meet the regulatory requirements and/or the regulators’ expected standards. To address such deficiencies, the HKMA would consider various supervisory actions according to the specific circumstances of each case. Usually, the AI concerned would be required to implement corrective actions to rectify the problem. Where the deficiencies suggest systemic issues, the AI concerned would be required to take more rigorous actions. Typically, it would be instructed to commission an independent review of the relevant controls and/or transactions according to the HKMA’s requirements and take proper actions to address the review findings. For example, if the deficiencies have impact on aggrieved customers’ interests, the AI concerned would have to address aggrieved customers’ concerns through appropriate measures such as enhanced complaint handling procedures. The AI concerned may also be required to cease business practices that had caused serious supervisory concerns. 3.1.9 The third level of supervisory action would be triggered when the HKMA finds prima facie case of any ground for discipline, such as misconduct by an AI or a licensed

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 10 technical representative of an AI, or any of them ceasing to be a fit and proper person. In this situation, the HKMA would consider conducting investigation on the case. Upon the completion of the investigation, the HKMA would inform the IA of the findings and conclusion for the IA’s consideration of whether to exercise its disciplinary powers under the Insurance Ordinance. 3.1.10 The objective of the HKMA’s enforcement work is to enforce the laws in Hong Kong governing the various operations of AIs. By taking effective enforcement actions and other appropriate follow-up actions against offenders, the HKMA strives to deter improper practices and behaviour in order to promote proper standards of conduct and prudent business practices among AIs, and to provide a measure of protection to bank customers. 3.1.11 The HKMA sets the enforcement standards with respect to banking conduct and practices under the Banking Ordinance. With respect to the insurance intermediary regime under the Insurance Ordinance, the HKMA's enforcement standards mirror those adopted by the IA. The overriding principles of the HKMA’s enforcement processes are to ensure fairness, integrity and legal compliance, and to observe the due process. 3.1.12 While the HKMA will generally have regard to the above categorisation of supervisory and enforcement actions, the actual measures to be taken in each case will be governed by the facts and circumstances of the case. 3.2 Guidelines and supervisory standards 3.2.1 The IA has the power under the Insurance Ordinance to make, publish or amend from time to time, rules, codes, guidelines, or other regulatory instruments relating to the carrying on of regulated activities. The IA will consult the HKMA before making, publishing or amending any of these rules, codes, guidelines, etc. insofar as they relate or apply to AIs in relation to regulated activities of AIs.

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 11 3.2.2 In interpreting the requirements set out in the Insurance Ordinance and/or issued by the IA, the HKMA will consult the IA where appropriate. 3.2.3 Taking into consideration the unique circumstances of bancassurance, in particular special trust in AIs by customers and growing expectation for enhanced protection of bank customers, the HKMA may from time to time and in consultation with the IA provide guidance to AIs regarding the relevant legal and regulatory requirements in the context of the banking environment, or promulgate additional requirements through guidelines, circulars or other regulatory instruments to accord protection to customers. 3.2.4 The general approach adopted by the HKMA is to require AIs to comply with the relevant legal requirements as well as the regulatory standards and requirements promulgated by the IA and the HKMA in relation to regulated activities. The HKMA will also take into account an AI’s compliance with these standards and requirements in considering whether that AI satisfies the continuing authorization criteria in respect of adequate systems of control and business manner under paragraphs 10 and 12 of the Seventh Schedule to the Banking Ordinance. 3.2.5 AIs should ensure their management and staff are well informed of the legal and regulatory requirements applicable to carrying on of regulated activities and keep abreast of any new requirements and updates. 3.3 On-site examinations 3.3.1 The HKMA conducts on-site examinations of regulated activities of AIs. The focuses of examination are mainly on regulatory compliance, internal controls and management supervision. 3.3.2 The objective of examination is to enable the HKMA to understand the way in which the relevant AI carries on regulated activities and to determine whether it has in place appropriate and effective policies, procedures and controls

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 12 to ensure compliance with the relevant legislation, rules, codes, guidelines, circulars and other regulatory instruments issued by the IA and the HKMA. AIs should be able to demonstrate that the relevant policies and procedures and control measures are well established and effectively applied. 3.3.3 While the general power to conduct examinations of AIs comes from §55 of the Banking Ordinance, the IA has delegated its inspection power under §64ZZF(6) of the Insurance Ordinance to the MA in relation to businesses of regulated activities carried on by AIs. Please refer to paragraphs 4.1.2 and 4.1.3 below for detail. 3.3.4 From time to time, the HKMA and the IA may conduct joint or concurrent examinations on businesses of regulated activities carried on by AIs. 3.3.5 In addition, the HKMA may conduct mystery shopping programme on the businesses of regulated activities carried on by AIs as and when necessary and appropriate. 3.4 Off-site surveillance 3.4.1 To facilitate the continuing supervision of regulated activities of AIs, the HKMA conducts a half-yearly survey, namely “Survey on Sale of Insurance Products” to collect from AIs relevant information on their sale of insurance products. The survey is designed to provide the HKMA with a general understanding of the regulated activities being carried on by AIs and the trends in the industry. 3.4.2 The HKMA may also require AIs to submit other regular and/or ad-hoc surveys or reviews for off-site surveillance. 3.4.3 The HKMA will take into account the information collected from off-site surveillance in prioritising supervisory resources to focus on potential issues (e.g. in determining the scope and focus of on-site examinations). The HKMA will also follow up with individual AIs as necessary if the information collected reveals weaknesses or deficiencies in the AIs’

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 13 regulatory compliance, internal controls and management supervision. 4. Legal requirements in respect of regulated activities of AIs 4.1 The Insurance Ordinance and major subsidiary legislation 4.1.1 Similar to other licensed insurance intermediaries, AIs and their staff that are licensed insurance intermediaries are subject to the provisions in the Insurance Ordinance. The relevant provisions include but not limited to: • Part X of the Insurance Ordinance

• Restrictions in relation to personnel of licensed insurance agencies, personnel of licensed insurance broker companies, and licensed technical representatives stipulated in §§64J, 64K, 64L and 64M • Part XI of the Insurance Ordinance
• Conduct requirements for licensed insurance intermediaries, licensed insurance agencies, licensed insurance broker companies and responsible officers set out in §§90, 91 and 92 (“Statutory Conduct Requirements”)
• Rules on conduct requirements for licensed insurance intermediaries made by the IA pursuant to §94 • Rules made by the IA under §129 of the Insurance Ordinance Insurance (Maximum Number of Authorized Insurers) Rules (Cap. 41K)
• The rules prescribe the maximum number of authorized insurers by which a person may be appointed as a licensed insurance agency or a licensed individual insurance agent. These rules are applicable to AIs that are licensed insurance agencies.

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 14 Insurance (Financial and Other Requirements for Licensed Insurance Broker Companies) Rules (Cap.41L)

• The rules set out the requirements on licensed insurance broker companies relating to financial and other aspects. AIs that are licensed insurance broker companies should observe these rules. 4.1.2 Pursuant to §4G of the Insurance Ordinance and the approval of the Chief Executive in Council, the IA has delegated its powers under §§64ZZF(6) and 64ZZH(1) of the Insurance Ordinance to the MA in relation to businesses of regulated activities carried on by AIs. 4.1.3 Under §64ZZF(6) of the Insurance Ordinance, the MA may in writing appoint a person as an inspector for the purpose of ascertaining whether an AI which is a licensed insurance intermediary, or a licensed technical representative of an AI, complies with the applicable requirements in §64ZZF(1) of the Insurance Ordinance. The inspector may: (a) enter any business premises of the AI or the licensed technical representative of the AI; (b) inspect, and make copies or otherwise record details of, a business record of the AI or the licensed technical representative of the AI; and (c) make inquiries of the AI or the licensed technical representative of the AI, or a person whom the inspector has reasonable cause to believe has information relating to, or is in possession of, a business record of the AI or the licensed technical representative of the AI, concerning:
• a business record of the AI or the licensed technical representative of the AI; or
• a transaction or activity that was undertaken in the course of, or may affect, the regulated activity carried on by the AI or the licensed technical representative of the AI.

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 15 4.1.4 The MA may commission an investigation of matters in relation to a business of a regulated activity carried on by an AI under §64ZZH(1) of the Insurance Ordinance, if: • the MA has reasonable cause to believe that: (a) a provision of the Insurance Ordinance may have been contravened; (b) a person may have been involved in defalcation, fraud, misfeasance or other misconduct in relation to the carrying on of a regulated activity; or (c) a person has carried on, or is carrying on, a regulated activity in a manner that is not in the interests of policy holders or potential policy holders or the public interest; or • the MA, for considering whether to recommend the IA to exercise any power under §81 of the Insurance Ordinance, has reason to enquire if a person is, or was, guilty of misconduct or not a fit and proper person. 4.1.5 While as a general principle, inspections and investigations in relation to businesses of regulated activities of AIs are conducted by the MA, the IA may also, after consulting the MA, exercise its inspection or investigation powers under the Insurance Ordinance on its own or jointly with the MA. 5. Major regulatory requirements in respect of insurance business of AIs 5.1 General 5.1.1 The HKMA requires all AIs to comply with all relevant legislation, rules and regulations, and conduct their businesses including the businesses of regulated activities in a responsible, honest and business-like manner, and with integrity, prudence and the appropriate degree of professional competence. Failure to comply with any applicable legal and regulatory requirements will call into

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 16 question whether the AI or the licensed technical representative of the AI is a fit and proper person to remain licensed, and may lead to disciplinary actions. 5.1.2 A general description of the major regulatory requirements applicable to AIs and their licensed technical representatives in relation to their insurance business are set out in the ensuing subsections. AIs and their licensed technical representatives should refer to the relevant documents for the detailed requirements, and are also advised to regularly visit the websites of the HKMA and the IA for updates on legal and regulatory requirements. 5.2 Corporate governance and internal controls 5.2.1 An AI should establish and implement proper organisational and management structure with clear roles and lines of responsibility and accountability of its senior management. 5.2.2 The responsible officer and the relevant senior management of an AI should possess the appropriate range of knowledge, skills and experience to understand and manage the insurance business of the AI. They should also be provided with sufficient resources for discharging their responsibilities and be timely apprised of the status of the AI’s insurance business through regular and effective communications. 5.2.3 An AI should put in place proper controls, policies and procedures, adequate supervision and staff training to ensure that the AI and its staff, particularly its licensed technical representatives, comply with all applicable legal and regulatory requirements, as well as the AI’s relevant policies and procedures. The responsible officer and the relevant senior management of an AI should be accountable for ensuring that the controls and procedures in relation to the insurance business of the AI are in place and effective. 5.2.4 AIs are expected to demonstrate to the satisfaction of the HKMA that their remuneration systems (or, in the case of AIs incorporated outside Hong Kong, the remuneration system applicable to officers and employees engaged in the conduct

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 17 of their business and operations in Hong Kong) are sound and in compliance with the relevant guidance. 5.3 Guideline on "Fit and Proper" Criteria for Licensed Insurance Intermediaries under the Insurance Ordinance (Cap. 41) (“GL23”) and the HKMA’s expectations on sufficiency of authority of responsible officers 5.3.1 Licensed insurance intermediaries and related persons (i.e. the responsible officers, controllers, partners and directors of licensed insurance agencies and licensed insurance broker companies) should be fit and proper. GL23 outlines the criteria and matters that the IA will normally consider in determining the fitness and properness of licensed insurance intermediaries and related persons. The criteria and matters cover areas such as “education or other qualifications or experience”, “ability to carry on a regulated activity competently and fairly”, “reputation, character, reliability, honesty and integrity”, “financial status and solvency”, etc. 5.3.2 Among other things, a responsible officer or a proposed responsible officer of a licensed insurance agency or a licensed insurance broker company should have sufficient authority for discharging his/her responsibilities as a responsible officer. Having regard to organisational and management structure of AIs and supervisory experience of the HKMA, guidance on the HKMA’s expectations in relation to sufficiency of authority of responsible officers of AIs is as follows: (a) If any of the individuals responsible for directly supervising the conduct of regulated activities of an AI is the chief executive, an alternate chief executive or a director as defined in the Banking Ordinance of the AI, the HKMA expects such individual to be appointed as a responsible officer of the AI. (b) If the situation in (a) above is not applicable, the appointment of a responsible officer of the AI should be based on seniority in accordance with the internal organisational and management structure of the AI. In

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 18 other words, the responsible officer should be the individual in the highest rank responsible for directly supervising the regulated activities of the AI. (c) An AI should ensure that at least one responsible officer is the chief executive, an alternate chief executive, a director or a manager as defined under the Banking Ordinance of the AI, and any remaining responsible officers of the AI should not be more than one rank below the chief executive, an alternate chief executive, a director or a manager of the AI if they do not themselves fall into these categories. 5.3.3 In order to ensure the carrying on of regulated activities is adequately supervised, an AI should appoint sufficient number of responsible officers, taking into account relevant factors including the scale of business; nature of insurance services and products; number of licensed technical representatives; organisational and management structure (for example, carrying on of regulated activities by different business units or in different lines of businesses may be supervised by different individuals), etc. of the AI. 5.3.4 Flexibility in assessing the sufficiency of authority of a responsible officer will only be allowed on an exceptional basis with justifications taking into account factors such as size of the AI; significance of regulated activities in relation to the overall business of the AI; the organisational and management structure of the AI; and the reporting line of the responsible officer. 5.3.5 The above guidance takes effect with the implementation arrangements of the licensing regime for insurance intermediaries under the Insurance Ordinance. 5.4 Code of Conduct for Licensed Insurance Agents and Code of Conduct for Licensed Insurance Brokers (“Codes of Conduct”) 5.4.1 Pursuant to §95 of the Insurance Ordinance, the IA has issued and published the Codes of Conduct to promulgate principles of conduct and the related standards and practices

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 19 with which licensed insurance agents and licensed insurance brokers are ordinarily expected to comply in carrying on regulated activities. These principles, standards and practices are high-level, and AIs should adopt proper policies and procedures, internal controls and risk management systems, having due regard to their own circumstances. 5.4.2 The IA and the HKMA may take guidance from the Codes of Conduct in considering: (a) whether an AI or a licensed technical representative of an AI is fit and proper to remain licensed as licensed insurance intermediary; (b) whether an AI, a responsible officer of an AI, or a licensed technical representative of an AI has satisfied the Statutory Conduct Requirements; or (c) any other matters under the Insurance Ordinance to which the Codes of Conduct may be relevant. Failure to comply with the Codes of Conduct may also amount to misconduct, if there has been an act or omission that, in the opinion of the IA or the HKMA, is or is likely to be prejudicial to the interests of policy holders or potential policy holders, or the public interest. 5.5 Guideline on Continuing Professional Development for Licensed Insurance Intermediaries (“GL24”) 5.5.1 GL24 outlines the continuing professional development (“CPD”) requirements for licensed insurance intermediaries. In general, licensed technical representatives are required to attend not less than 15 CPD hours in each assessment period, including a minimum of 3 CPD hours related to a topic which falls under “Ethics or Regulations”. AIs should monitor and ensure their licensed technical representatives comply with the applicable CPD requirements.

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 20 5.6 Other major regulatory requirements of the IA 5.6.1 The IA also has promulgated various regulatory requirements in relation to selling of insurance products. Below are some of the guidelines issued by the IA that AIs should comply with in the sale of non-investment-linked long term insurance products. Guideline on Underwriting Long Term Insurance Business (other than Class C Business) (“GL16”) • While GL16 sets out the requirements for authorized insurers in underwriting long term insurance business (other than Class C business), some of the requirements are relevant to AIs. For example, GL16 stipulates that customers’ needs should be properly assessed through the use of financial needs analysis (“FNA”) before non￾investment-linked long term insurance products be marketed to the customers, and sets out the product information that should be provided or disclosed to customers during the selling process. Guideline on Offering of Gifts (“GL25”) • GL25 provides guidance on restrictions on the use of gifts and rebates which AIs should observe in selling long term insurance products. Guideline on Long Term Insurance Policy Replacement (“GL27”) • Given the long-term nature of life insurance policies, the customer may suffer losses as a result of the financial implications, insurability implications, claims eligibility implications, etc. arising from policy replacement. GL27 aims to address this issue and sets out the requirements on policy replacement to help ensure a customer can make a fully informed decision. AIs should take all reasonable steps to ascertain whether a customer is purchasing a long term insurance policy as a policy replacement, and if so, explain to the customer the implications of and risks associated with the policy

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 21 replacement. AIs are also required to assess and provide advice to the customer on whether the proposed purchase of the new long term insurance policy is in the customer’s best interests, taking account of the potential implications and adverse consequences to the customer arising from the policy replacement. Along the requirements in GL27, AIs should put in place adequate policies and procedures and control measures to identify, monitor, review and follow up on policy replacement. Guideline on Cooling-off Period (“GL29”) • The provision of a cooling-off period for policy holders to reflect on their decision helps protect policy holders’ interests. GL29 sets out the relevant requirements for cooling-off period. AIs should inform customers their rights to cancel the policies within the cooling-off period before the customers sign the policy application forms. Should the AIs be responsible for delivery of insurance policies, they are also required to deliver the po licies within the prescribed timeframe as set out in GL29. Guideline on Financial Needs Analysis (“GL30”) • GL30 sets out the minimum standards and practices that need to be implemented and adopted for carrying out an appropriate FNA. AIs should collect adequate information from customers and have due regard to such information before making any insurance recommendation. Among other requirements, where a customer has indicated that premium financing is intended to be used, an AI must take that into account when assessing the customer’s ability and willingness to pay insurance premium. • GL30 also lays down the handling requirements for mismatch cases where the recommended product does not meet the needs and circumstances of the customer based on the information collected during the FNA process. AIs should put in place appropriate control measures to handle mismatch cases.

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 22 5.6.2 The IA issues and updates from time to time interpretation notes, frequently asked questions, etc. to provide further guidance in relation to the relevant guidelines. AIs should also take into account the guidance set out therein in compliance with the regulatory requirements. 5.7 Regulatory requirements of the HKMA 5.7.1 Taking into consideration the special trust that customers place on AIs, the HKMA provides guidance to AIs, or promulgates additional regulatory requirements in respect of regulated activities of AIs as and when appropriate. These guidance and requirements cover product due diligence; advertisement; suitability assessment; product disclosure; controls and monitoring, etc. as well as any additional customer protection measures for dealing with vulnerable customers; sale of specific categories of insurance products (such as annuity insurance products, protection linked plan and indexed universal life products); distribution of insurance products through specific channels; premium financing, etc. The HKMA will assess the compliance of AIs with these guidance and requirements in its on-going supervision. 5.7.2 Before entering into a long term distribution agreement with an authorized insurer, an AI should take into account customer protection to both existing policy holders and potential policy holders, as well as the AI’s reputation risk, as part of its considerations. The AI should conduct due diligence on the authorized insurer to assess, among other things, the credibility and capability of the authorized insurer. There should also be ongoing due diligence review afterwards. In addition, the AI should ensure that there are provisions in the agreement to provide it with the flexibility to protect customers in case of any material concerns on the authorized insurer, for example, the situations where the credibility, capability or financial viability of the authorized insurer, etc. deteriorates and impacts the reputation of the bancassurance business.

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 23 5.7.3 The AI should ensure that adequate provisions including appropriate exit clauses are put in place to provide the AI with the ability to terminate the agreement and, if the agreement includes exclusive distribution, the ability for the AI to exempt from the exclusivity, as necessary. 5.7.4 In case the AI decides to terminate a distribution agreement with an authorized insurer, the AI should work out with the authorized insurer appropriate arrangements for the existing policy holders to ensure that the interest of the existing policy holders will not be jeopardised. 5.8 Prevention of money laundering and terrorist financing 5.8.1 In addition to the Anti-Money Laundering and Counter￾Terrorist Financing Ordinance, the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Authorized Institutions), the Supervisory Policy Manual on "AML-1 Supervisory Approach on Anti-Money Laundering and Counter-Financing of Terrorism" and other relevant guidance issued by the HKMA, AIs that are licensed insurance intermediaries should also have regard to the IA’s Guideline on Anti-Money Laundering and Counter-Terrorist Financing (“GL3”) in carrying on their businesses of regulated activities. 6. Reporting of certain events 6.1 Statutory reporting requirements 6.1.1 Licensed insurance intermediaries including those which are AIs are required under the Insurance Ordinance to notify the IA certain changes, including: (a) under §64P, a licensed insurance intermediary must notify the IA in writing of any change of particulars (as specified in §64P(2)) within 14 days after the date on which the change takes place; (b) under §§64Q and 64R, a licensed insurance agency or a licensed insurance broker company must notify the IA

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 24 in writing of the intended appointment or the termination: • at least 14 days before the licensed insurance agency or the licensed insurance broker company appoints a licensed technical representative to carry on regulated activities in one or more lines of business as an agent of the agency or the broker company; • within 14 days after the date on which the licensed insurance agency or the licensed insurance broker company terminates the appointment of a licensed technical representative; • within 14 days after the date on which the appointment of a responsible officer of the licensed insurance agency or the licensed insurance broker company is terminated; (c) under §64T, a licensed insurance broker company must notify the IA in writing of the intention and the intended date of cessation at least 3 months before it ceases to carry on regulated activities; and (d) under §64ZZD, a licensed insurance agency or a licensed insurance broker company must notify the IA in writing: • within 1 month after the date on which a person becomes, or ceases to be, a partner, director or controller of the licensed insurance agency; • within 1 month after the date on which a person becomes, or ceases to be, a director or controller of the licensed insurance broker company. 6.1.2 Contravention of any of the above reporting requirements may constitute an offence. AIs that are licensed insurance intermediaries should put in place adequate policies and procedures to ensure compliance with their reporting obligations.

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 25 6.2 Reporting of incidents 6.2.1 Paragraph 4 under Controls and Procedures in Section IX of the Code of Conduct for Licensed Insurance Agents and paragraph 5 under Controls and Procedures in Section IX of the Code of Conduct for Licensed Insurance Brokers set out the incidents that AIs, as licensed insurance agencies or licensed insurance broker companies, should report to the IA. AIs should as soon as practicable report such incidents to the IA and concurrently to the HKMA. 6.2.2 Along the established reporting arrangement of banking conduct incidents, AIs should submit conduct incident report to the HKMA where the AI is aware of, among other incidents: • non-compliance with the Insurance Ordinance, including subsidiary legislation, codes, guidelines, circulars or other relevant regulatory requirements issued by the IA; • non-compliance with the HKMA’s relevant requirements and the Code; or • misconduct or fitness and properness issues concerning a licensed technical representative or a responsible officer of the AI. 7. Disciplinary actions 7.1 As the IA has delegated its investigation powers under §64ZZH(1) of the Insurance Ordinance to the MA in relation to businesses of regulated activities carried on by AIs, investigation on such matters will generally be conducted by the MA. The HKMA will inform the IA conclusion of the investigation and whether it recommends the IA to exercise disciplinary power under §81 of the Insurance Ordinance. 7.2 Under §81 of the Insurance Ordinance, the IA may exercise disciplinary powers in respect of a person who is or was a regulated person.

Supervisory Policy Manual IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions V.2 – 21.11.25 26 7.3 The IA may take the following disciplinary actions: • revoke or suspend the licence of the person; • revoke or suspend the approval of the person as a responsible officer; • prohibit the person from applying to be licensed; • prohibit the person from being appointed as a responsible officer; • reprimand the person publicly or privately; or • order the person to pay a pecuniary penalty. 7.4 The IA must consult the MA before exercising a disciplinary power under §81 of the Insurance Ordinance in respect of (i) an AI, (ii) a person who is or was a regulated person and is or was employed by an AI, or (iii) a person who is or was a regulated person and is or was appointed as an agent by an AI, in relation to any regulated activity carried on by the AI. 7.5 It is essential for the senior management of AIs to draw to the attention of their licensed technical representatives, responsible officers and the persons concerned in the management of the regulated activities of the AIs that they shall be personally and legally liable to the disciplinary sanctions if they are found guilty of misconduct and/or considered to be not fit and proper. ————————— Contents Glossary Home Introduction