Supervisory Policy Manual CG-3 Code of Conduct

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 1 This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ——————— Purpose To set out the minimum standards which the HKMA expects AIs to adopt in respect of their Codes of Conduct and elements of an effective system for enforcing the Codes Classification A statutory guideline issued by the MA under the Banking Ordinance, §7(3) Previous guidelines superseded Guideline 3.2 "Code of Conduct" dated 28.11.86; V.1 dated 21.06.02 Application To all AIs Structure

1. Introduction 1.1 Functions of HKMA 1.2 Implications of non-compliance 1.3 Interpretation 1.4 Application
2. Minimum standards in Code of Conduct 2.1 General 2.2 Responsibility

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22.3 Ethical values 2.4 Conflicts of interest 2.5 Granting credit 2.6 Receiving credit 2.7 Conduct when obtaining business 2.8 Personal benefits 2.9 Use of information 2.10 Private investments 2.11 Outside employment 2.12 Reporting responsibility 2.13 Disciplinary action 3. System for enforcing Code of Conduct 3.1 Oversight by Board of Directors 3.2 Oversight by senior management 3.3 Internal control 3.4 Communication to staff 3.5 Regular review 3.6 Segregation of conflicting responsibilities 3.7 Record maintenance 3.8 Reporting channels 3.9 Audit 3.10 Assistance from law enforcement and regulatory authorities ———————

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 3

1. Introduction 1.1 Functions of HKMA 1.1.1 The HKMA’s primary function under the Banking Ordinance is to promote stability within the Hong Kong banking system. Good and ethical banking practices are essential for safeguarding depositors’ interests, maintaining the stability of the banking system and preserving Hong Kong’s reputation as an international financial centre. 1.1.2 Under §7 of the Banking Ordinance, the MA has the functions, inter alia, to:  take reasonable steps to ensure that AIs operate in a responsible, honest and business-like manner;  promote and encourage proper standards of conduct and sound and prudent business practices among AIs; and  suppress, and aid in suppressing, illegal, dishonourable and improper practices in relation to the business conducted by AIs. 1.1.3 The HKMA believes that it is consistent with these functions to require AIs to promote a sound bank culture (including the expected values and behaviour as well as ethical standards) to which their staff are expected to adhere. This can generally be done by means of establishing a Code of Conduct and having an effective system in place to enforce it. 1.2 Implications of non-compliance 1.2.1 The minimum authorization criterion under para. 10 of the Seventh Schedule to the Banking Ordinance provides that an AI should have adequate accounting systems and adequate systems of control. Moreover, under para. 12 of the Seventh Schedule, the MA should be satisfied that the business of an AI is carried out with integrity, prudence and the appropriate degree of professional competence

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 4 and in a manner which is not detrimental to the interests of depositors or potential depositors. 1.2.2 Failure to adhere to the standards and requirements in this module may call into question whether an AI continues to satisfy the above-mentioned criteria. 1.3 Interpretation 1.3.1 In the context of this module, the term “Code of Conduct” refers to a written statement of the standards of behaviour expected by an AI of its staff. It normally includes expected standards of behaviour and a detailed set of operating principles and guidelines for staff to follow when they conduct business. 1.3.2 The requirements set out in this module should not be read as a substitute for, or as affecting the meaning of, the relevant provisions in the Banking Ordinance or other Ordinances (e.g. §8 and §9 of the Prevention of Bribery Ordinance) which are applicable to AIs. In case of doubt, AIs should seek appropriate legal advice or consult with the relevant regulatory bodies. 1.4 Application 1.4.1 This module applies to all AIs. In the case of locally incorporated AIs, the scope should cover all their branches and subsidiaries subject to the HKMA’s consolidated supervision. 1.4.2 An overseas-incorporated AI or a locally incorporated AI which forms part of an international banking group may adopt the Code of Conduct formulated at the group level or develop its own Code of Conduct for local operations, having regard to Hong Kong’s circumstances and standards set out in this module. AIs adopting the group Code of Conduct should assess whether the group Code of Conduct is consistent with the standards in this module and make appropriate modifications in their local Code of Conduct to address any gaps identified.

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 5 1.4.3 This module should be read in conjunction with other relevant Supervisory Policy Manual modules, including CG-1 “Corporate Governance of Locally Incorporated Authorized Institutions” in the case of locally incorporated AIs, CG-5 “Guideline on a Sound Remuneration System” and CG-6 “Competence and Ethical Behaviour”, as well as any applicable guidance issued and updated by the HKMA from time to time. 2. Minimum standards in Code of Conduct 2.1 General 2.1.1 Each AI should develop its own Code of Conduct, commensurate with its structure, size and business operations. The Code of Conduct should reflect the professional standards and values that promote ethical and responsible professional behaviour among the AI’s staff and guide them in the discharge of their duties. The Code of Conduct should also articulate the acceptable and unacceptable behaviour, and clearly disallow behaviour that could result in the AI engaging in any improper or illegal activity. It should also require that business be conducted in accordance with applicable laws, regulations, standards and guidelines issued by the HKMA and other relevant regulatory authorities. It is reasonable to expect Codes to differ from one another not only in format but also in content. With the growing complexity of the business environments in which AIs operate, each AI should recognise the need to continuously review and where necessary update the Code of Conduct that is relevant to its current needs. 2.1.2 The Code may be comprehensive, covering all legal, regulatory and ethical issues. Alternatively, different codes may be used to cover different topics. For example, an AI may formulate separate codes or policy statements in relation to the prevention of money laundering, the

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 6 Code of Banking Practice1 , conflicts of interest, connected lending, equal opportunities, protection of intellectual property rights, environmental protection issues, etc. AIs may also incorporate extracts from the relevant sections of Ordinances (e.g. §8 and §9 of the Prevention of Bribery Ordinance and §124 of the Banking Ordinance) as part of their Code for ease of reference. 2.1.3 There are certain minimum conduct requirements which are applicable to every AI and should be included in their main Code. These requirements, although not exhaustive, are set out in the subsections that follow. 2.2 Responsibility 2.2.1 Codes of Conduct should specify the name or title of the officer2 (“Code of Conduct officer”) who is responsible for:  handling queries from staff regarding the contents of the Code and any related matters;  reviewing staff declaration of any transaction or activity that may result, or has already resulted, in a conflict of interest (see subsection 2.4 below);  approving requests by staff to accept personal benefits exceeding limits imposed, or otherwise outside acceptable limits, in the Code (see subsection 2.8 below); and  taking appropriate actions to follow up cases reported by staff (see subsection 2.12 below). These functions may be assigned to the same or separate officers. The person(s) appointed should be of sufficient independence, competence, experience, integrity and seniority to discharge them effectively. If an

1 The Code of Banking Practice is issued jointly by the Hong Kong Association of Banks and the DTC Association, and endorsed by the HKMA. It is to be observed by AIs in dealing with and providing services to their customers. 2 The person may be an AI’s compliance officer, an internal legal counsel or some other party (e.g. head of human resources).

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 7 AI decides to appoint more than one person to be responsible for the above functions, the AI should appoint one of them as a central reference point for external liaison. 2.2.2 Normally, the officer responsible for approving the acceptance of personal benefits should have authority to:  permit a staff member to accept a personal benefit unconditionally or subject to such conditions as the officer may specify;  require a staff member to refuse the offer of a personal benefit or to return a personal benefit to its donor;  require a staff member to give a personal benefit which he has received to a charitable organisation nominated by the staff member and acceptable to the officer; or  require a staff member to dispose of a personal benefit which he has received in such manner as the officer may direct. 2.2.3 The officer responsible for reviewing staff declarations relating to conflicts of interest should evaluate the information provided by staff members in accordance with the AI’s conflicts of interest policy and assess whether any cases need to be further escalated to higher levels of management for their review and action on a timely basis. Factors to be considered may include relationship between the staff member concerned and the related party, whether the conflict poses significant reputational risk to the AI, the nature of personal benefit received by staff members, etc. 2.2.4 Where appropriate, AIs may appoint a committee to oversee the implementation of and adherence to the Code.

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 8 2.3 Ethical values 2.3.1 Codes of Conduct should contain a set of ethical values that AIs expect their staff to consistently follow in conducting business. Core ethical values would normally include honesty, integrity, diligence, fairness, responsible citizenship and accountability. 2.4 Conflicts of interest 2.4.1 Conflicts of interest generally arise from situations where the private interests of a staff member compete with the interest of the AI. Private interests may include financial and other interests of the staff member, and those of his connections including relatives3 , personal friends or any other parties with whom he has personal ties. 2.4.2 All staff should avoid situations that may lead to or involve a conflict of interest, actual or potential and, in case of doubt, should seek the advice of the Code of Conduct officer. 2.4.3 Staff should make a declaration to the Code of Conduct officer if he becomes aware that he or any of his close family members4 has performed any role or taken any action that poses risk to the staff member of running into a conflict of interest situation with the AI.5 The declaration should state clearly the relationship between the staff member concerned and the related parties, as well as the circumstances leading to potential conflicts of interest. Staff should be able to justify the reason why he failed to make such declaration when conflict of interest is discovered and identified. If there is evidence showing that such omission was done intentionally, recklessly or

3 Reference may be drawn from the definition of “relatives” in Rule 85(4) of the Banking (Exposure Limits) Rules. 4 Referring to those who are in close contact with the staff. This usually applies to spouse, children, parents and siblings. Depending on individual circumstances, the specific scope could differ. 5 For example, staff should make a declaration to the AI as soon as he is aware of the following: private investments made by the spouse of a staff member in the business of an AI’s client with whom the staff has a business relationship, or the directorship held by the spouse of a staff member if the company has a business relationship with the staff member acting on behalf of the AI.

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 9 negligently, then the staff should be made aware that disciplinary action will be taken against him. 2.5 Granting credit 2.5.1 All staff with lending authority should have specified limits that are commensurate with their rank or function as laid down in the AI’s credit policy. No member of staff should grant credit to himself, his relatives or companies in which he or his relatives have a private interest. 2.6 Receiving credit 2.6.1 No member of staff, or his relatives, should borrow or receive credit from third parties on a favoured basis or on terms other than at arm’s length unless previously approved in accordance with the Code of Conduct. 2.7 Conduct when obtaining business 2.7.1 No member of staff should offer any bribe or similar consideration to any person or company in order to obtain business for the AI. 2.7.2 All staff should have an adequate understanding of the Prevention of Bribery Ordinance so as to avoid the pitfalls of corruption in carrying out the AI’s business. In particular, an AI’s staff should be aware that the offering of advantage6 to a public servant7 who acts on behalf of the Government or the public body concerned may constitute a breach of the anti-bribery law in Hong Kong.8 Staff should also observe and comply with §9 of the Prevention of Bribery Ordinance, which provides for criminal penalties for offering advantage to an agent in prescribed circumstances.

6 Advantage is defined under the Prevention of Bribery Ordinance. Common examples of advantage include any gift, loan, fee, commission, employment, etc. 7 Public servant is defined in the Prevention of Bribery Ordinance and generally refers to any government officer, employee or member of a public body. All HKMA staff are subject to the provisions of the Prevention of Bribery Ordinance. 8 §8 of the Prevention of Bribery Ordinance.

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 10 2.8 Personal benefits 2.8.1 Members of staff should not use the power or authority deriving from their position to gain, or to influence other staff to take any action in order to gain, a personal benefit or an indirect benefit (e.g. for their relatives or other related parties). 2.8.2 All staff should observe the statutory provisions of §9 of the Prevention of Bribery Ordinance and §124 of the Banking Ordinance, which contain criminal penalties for accepting advantages in prescribed circumstances.9 2.8.3 Members of staff should actively discourage customers from offering personal benefits of any kind, including any type of gift, favour, service, loan, fee or anything of monetary value. 2.8.4 No member of staff should solicit, accept and retain personal benefits from any customer of the AI or any individual or organisation doing or seeking to do business with it. Members of staff may, however, be permitted to accept and retain a personal benefit within the AI’s acceptance criteria 10 set out in the Code of Conduct provided that:  this complies with relevant legal requirements; and

9 For example, the AI’s staff may commit an offence if he offers a job to a family member of the AI’s customer as an inducement for securing business from that customer. Even if the AI’s staff has a personal relationship (e.g. friend) with the AI’s customer, staff acceptance of bonus as a personal reward from that customer as a result of the services rendered without prior permission from the AI may put the staff at risk of breaching the Prevention of Bribery Ordinance. 10 For illustration, these mayinclude:  any normal business entertainment (e.g. a meal involving no more than ordinary amenities). AIs should, however, require their staff to avoid meals or entertainment that are excessive in nature or frequency, so as not to cause embarrassment or loss of objectivity when conducting business. If it is not appropriate to decline an invitation, staff should only accept the invitation with management’s permission on the understanding that they are able to reciprocate;  any gift (including a lai see) given on festive occasions under customary practice, subject to a limit that should not be excessive and, in the judgement of AIs’ management, the acceptance of such gifts would unlikely place their staff in a potential position of obligation to the donor;  any personal benefit arising from kinship or marriage; or  any personal benefit received from a close personal friend, where such friendship is entirely unrelated to the business of the AI, subject to an appropriate limit.

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 11  there is no reasonable likelihood of improper influence or prejudice on the performance of duties by the staff member on behalf of the AI. 2.8.5 Where a staff member wishes to accept a personal benefit which is not within the criteria set out in the Code, he should seek the approval of the Code of Conduct officer, providing him with relevant information in writing such as:  the name of the donor;  a description and, to the extent possible, an assessment of the value of the benefit;  any business connection between the donor and the AI; and  any personal relationship between the staff member and the donor. 2.8.6 The staff member will then be advised whether the gift may be accepted, or should be returned to the donor or disposed of in some other way. 2.9 Use of information 2.9.1 All staff should handle carefully information relating to customers in compliance with relevant statutory requirements, e.g. the Personal Data (Privacy) Ordinance (“PDPO”), and common law customer confidentiality. 2.9.2 No member of staff should release customer information to a third party (see SA-2 “Outsourcing” for guidance in relation to outsourcing arrangements) without written consent from the relevant customer, unless the release complies with the PDPO or he is required or permitted to do so by law. 2.9.3 No member of staff should, during or after termination of his employment with the AI, except in the proper course of his duties or with the written consent of the AI, divulge or make use of any secrets or of any correspondence, accounts, connections or dealings of the AI or its customers or of any knowledge gained in relation thereto during his employment.

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 12 2.9.4 No member of staff should use information so obtained for financial gain in any way. Staff should be made aware that using confidential or proprietary information obtained for personal financial gain or disclosing of such information to a third party without written consent of the AI may constitute a case for disciplinary action or even a criminal offence. 2.10 Private investments 2.10.1 No member of staff should deal in the shares or other securities of any listed company, or any other assets of which he possesses privileged or price-sensitive information that is not generally known to the market. Staff should not disclose such information to any third party. 2.10.2 Staff should immediately notify the AI in writing of the details of any dealings in which they may have inadvertently been concerned in the shares or other securities of any listed companies, or any other assets of which they possess privileged or price-sensitive information that is not generally known to the market. If members of staff are unsure whether a deal would constitute insider dealing 11 , they should consult the appropriate officer in advance of such dealing. 2.10.3 When making investments in their private capacity, all staff should be able to demonstrate that reasonable steps have been taken to avoid:  conflicts of interest with the duties carried out by staff members; and  misuse of privileged information obtained through the normal course of conducting business with customers.

11 Basically, insider dealing takes place when a person connected with a listed company possesses privileged information which could affect the share price when disclosed, and trades, or procures other persons to trade, in the securities or derivatives of the company so as to make profits or avoid losses before the public are aware of the piece of information. It also takes place when a person obtains information through another person whom he knows is connected with a listed company (i.e. an insider), trades or procures other persons to trade in the securities or derivatives of the company.

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 13 In case of doubt, they should consult the Code of Conduct officer before making such investments. 2.11 Outside employment 2.11.1 When staff members are offered to take up any directorship or employment of an entity, particularly a commercial entity, outside an AI’s banking group, they should carefully assess whether accepting these offers would impair their independence and judgement in carrying out the duties at the AI. Staff should refrain from accepting such offers if the additional roles would undermine their time commitment to the business of the AI or give rise to potential conflicts of interest. 2.11.2 No member of staff should take up any directorship, employment or part-time commercial duties, whether paid or unpaid, outside the AI except with prior written approval as required by the Code of Conduct. If such written approval is granted to a staff member, he should report promptly to the Code of Conduct officer once the status of his outside work or employment has changed. 2.11.3 Approval should only be given where the interests of the AI would not be prejudiced. 2.12 Reporting responsibility 2.12.1 Staff should report promptly to the appropriate authorized officer(s) as required in the Code of Conduct once he becomes aware that he is in breach of the Code or when he is in doubt of a potential breach. 2.12.2 It is the responsibility of all staff to contribute to the good reputation of an AI. All staff should be alert to matters which could give rise to fraud, deception, theft, forgery, corruption or other illegal activities. If a staff member, acting reasonably, suspects that an illegal activity is being perpetuated, he should immediately report it to an appropriate officer as required in the Code of Conduct for appropriate follow up (see subsection 3.8).

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 14 2.12.3 Staff should be warned that failure to report such activity in a timely manner may result in disciplinary action. 2.12.4 Staff should also be encouraged to report unethical or questionable practices even if they are not illegal. 2.13 Disciplinary action 2.13.1 Codes of Conduct should specify that all staff of the AI are subject to their provisions and that any breach will give rise to disciplinary action (e.g. verbal warning, issue of a warning letter, adjustment to variable remuneration, demotion or dismissal) and, where applicable, to criminal prosecution. To promote accountability, AIs should consider having mechanisms in place setting out the consequences for staff engaging in unacceptable behaviour. 3. System for enforcing Code of Conduct 3.1 Oversight by Board of Directors 3.1.1 In the case of locally incorporated AIs, the Board of Directors (“the Board”) has an important role in establishing the overall bank culture of AIs (including the expected values and behaviour as well as ethical standards) and ensuring AIs conduct their affairs with a high degree of integrity (see section 2 of CG-1 “Corporate Governance of Locally Incorporated Authorized Institutions” for details). 3.1.2 For instance, the Board (or a Board-level committee with the necessary delegated authority) is responsible for:  laying down company-wide ethical standards and promoting them to all levels of staff;  approving the Code of Conduct;  ensuring that AIs have adequate systems to enforce the Code;  resolving complex ethical dilemmas; and

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 15  ensuring that the reputation risk of AIs is carefully managed. 3.2 Oversight by senior management 3.2.1 As senior management has the responsibility of overseeing the operations of an AI on a day-to-day basis, they should ensure that the AI’s activities are conducted in a manner which is consistent with the requirements set out in the Code of Conduct. This includes, but is not limited to, the following:  implementing the Code of Conduct and policies approved by the Board;  fostering and maintaining ethical standards and expected values set by the Board throughout the AI;  appointing the Code of Conduct officer with sufficient independence, competence, experience, integrity and seniority; and  keeping the Board promptly informed of any material matters in relation to the implementation of the Code of Conduct. 3.2.2 The values held and attitudes demonstrated by the Board and senior management have a great influence on the behaviour of the employees. AIs’ directors and senior management should continuously promote staff awareness and serve as role models for the Code of Conduct. 3.2.3 Where an AI is a branch of an overseas-incorporated bank, senior management responsible for the local operations should oversee the implementation of the Code of Conduct. The results of the local compliance monitoring should be regularly reported to the head/regional office overseeing the Hong Kong operation.

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 16 3.3 Internal control 3.3.1 AIs should maintain a system to ensure staff members are in compliance with the Code of Conduct. In cases where staff members engage in activities that require approval from the AI under the Code of Conduct, the appropriate authority within the AI and that authority’s responsibility in granting such approval should be clearly set out. Procedures should be in place for the Code of Conduct officer to manage in a timely manner the actual and potential misconduct cases reported by staff members or identified by the AI, and where necessary, to escalate them to higher levels of management for their attention and action. 3.3.2 In the event of non-compliance with the Code of Conduct by any staff member, the AI should promptly review the situation leading to such non-compliance and assess if this is reflective of any deficiencies in its internal control systems that would necessitate remedial action. 3.3.3 AIs should have sufficient control measures in addressing actual conflicts of interest as well as in avoiding potential conflicts of interest. They should have a set of written policies that identify the relationships, services, activities or transactions of the AI in respect of which conflicts of interest may arise, and set out measures for preventing or managing these conflicts.12 3.3.4 An AI should state clearly in its Code of Conduct the transactions or activities (including, but not limited to private investments, granting or receiving credit, and outside employment) for which staff declaration is required and provide relevant templates for staff declaration. 3.3.5 With a view to managing conflicts of interest, AIs should require staff to: (i) for new recruits, report within a reasonable period whether there would be any conflicts of interest between their private interests (including those

12 For example, an AI may impose restrictions on certain private investments made by staff to prevent potential conflicts of the staff’s interest with those of the AI.

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 17 associated with their close family members that the new staff members are aware of) and their job duties; (ii) for incumbent staff, review annually the accuracy of declarations made previously, and where necessary update the records; and (iii) for staff whose job nature is to be substantially changed (e.g. through rotation, promotion), assess whether additional declaration would be required. 3.4 Communication to staff 3.4.1 Enforcing a Code of Conduct requires understanding and active participation by all levels of staff in an AI. AIs should therefore communicate clearly to their staff the standards and requirements set out in the Code through effective and continual communications and training, and in particular, that:  strict adherence to those standards is expected of them; and  disciplinary action may be taken against them if they do not adhere to those standards (see also para. 2.13.1 above). 3.4.2 It is important that staff are reminded at periodic intervals of the requirements of the Code and are updated on the latest requirements when there is any change of the Code. Examples should be provided to staff so that they are more aware of the circumstances leading to a disciplinary action. Apart from the use of internal circulars, AIs should develop training programmes (e.g. forming part of the induction course for new recruits and of refresher courses for existing staff) for various levels of their staff in relation to the Code or other relevant ethical issues. AIs may also issue guidelines to staff on specific subjects (e.g. conflicts of interest) with examples or case studies, having regard to the specific operational need of individual departments.

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 18 3.5 Regular review 3.5.1 The Code of Conduct should be reviewed at least annually by the Board (or a Board-level committee with the necessary delegated authority) and updated to keep abreast of changes in the business environment and regulatory requirements. If any policy gaps are identified, the Board (or the designated Board-level committee) should be informed. Timely and appropriate remedial actions should be taken to address the policy gaps. 3.5.2 For a Hong Kong branch of an overseas-incorporated AI, senior management should be responsible for regular compliance monitoring of the AI’s adherence to the Code of Conduct. If policy gaps are identified, senior management should report to the head/regional office overseeing the Hong Kong branch and discuss appropriate modifications. 3.6 Segregation of conflicting responsibilities 3.6.1 Staff should not be assigned conflicting responsibilities that may make them susceptible to abuses or result in undetected errors. 3.6.2 AIs should establish “Chinese Walls” (i.e. functional segregation reinforced by physical separation) to prevent the accidental communication of confidential information between departments of the same AI. 3.6.3 Access rights to confidential information should only be granted to staff for legitimate business purposes on a need-to-know basis. 3.7 Record maintenance 3.7.1 AIs should maintain a written record (either in electronic or physical format) of all personal benefits received by staff which they have been permitted to retain. This record need not cover benefits which the Code of Conduct permits staff to accept or retain without further reference. AIs should also maintain a record of the declarations

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 19 submitted by staff relating to conflicts of interest and private investments. 3.7.2 Such records should be subject to periodic reviews by the senior management or a designated staff member (e.g. the compliance officer) to ensure that:  they are properly maintained;  the approvals given to staff to retain personal benefits are justified;  there is no likelihood that the staff receiving personal benefits have been placed in a position of obligation;  the declarations made by staff relating to conflicts of interest or private investments are properly reviewed; and  actions to manage the breaches of the Code of Conduct are appropriate. 3.7.3 Upon request by the HKMA, such records should be made available to it for review. The AI’s document retention policy should take account of all relevant legislation. 3.8 Reporting channels 3.8.1 Staff should report matters which could give rise to fraud, deception, theft, forgery, corruption or other illegal activities to the Code of Conduct officer through their internal complaint channels. Reporting of instances of unethical behaviour or questionable practices should also be encouraged. The reporting channels should be designed for staff to communicate, in confidence and without the risk of reprisal, concerns or observations of any violations. AIs should also encourage staff to “speak up” or escalate issues without fear of adverse consequences (e.g. bullying or retaliation). 3.8.2 Complaints should be dealt with quickly and disciplinary action should be taken if necessary. The outcome of investigations into complaints of a serious nature should

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 20 be reported to senior management and the Board (or a Board-level committee with the necessary delegated authority) of a locally incorporated AI, or to the head/regional office overseeing the Hong Kong operation in the case of an overseas-incorporated AI. 3.8.3 Once an AI has become aware of an incident assessed to potentially have a significant impact on its business, customers or reputation (e.g. matters which could give rise to illegal activities, or misconduct incidents under internal investigation that may adversely impact the AI’s reputation), the AI concerned should notify the HKMA immediately and provide it with whatever information is available at the time. Depending on the nature of such incident, AIs should also report it to other relevant regulatory (e.g. the Securities and Futures Commission) or law enforcement authorities as soon as practicable. 3.9 Audit 3.9.1 Audits should be regularly performed to assess the effectiveness of the systems required by the Code of Conduct. 3.9.2 The findings of these audits should be reported to the Board or a Board-level committee with the necessary delegated authority (or the relevant governance body at the head/regional office overseeing the Hong Kong operation in the case of an overseas-incorporated AI) on a timely basis and appropriate remedial action should be taken to address any concerns or weaknesses raised. 3.10 Assistance from law enforcement and regulatory authorities 3.10.1 Where necessary, AIs may seek the assistance of the HKMA or other law enforcement or regulatory authorities in relation to their Code of Conduct and other ethical issues. 3.10.2 For instance, AIs may approach the regional offices or the Hong Kong Business Ethics Development Centre of the

Supervisory Policy Manual CG-3 Code of Conduct V.2 – 09.12.22 21 Independent Commission against Corruption (“ICAC”) 13 for assistance in developing ethics programmes catering to their specific needs. These may include:  formulating or improving a Code of Conduct and offering advice on how to implement the Code effectively;  strengthening system of controls and work procedures to prevent corruption, fraud and other malpractices; and  providing training courses for various levels of staff on subjects, such as legislation governing corruption and fraud in Hong Kong, measures to manage staff integrity and skills to handle ethical dilemmas at work. 3.10.3 AIs may also seek advice on corruption prevention from the Corruption Prevention Advisory Service of the ICAC.14 ————————— Contents Glossary Home Introduction

13 https://www.icac.org.hk/en/service/educate/business-sector/index.html 14 Please refer to the link for more details: https://cpas.icac.hk/EN/