Supervisory Policy Manual Module IC-4: Complaints Handling and Redress

Supervisory Policy Manual IC-4 Complaints Handling and Redress V.2 – 06.01.2023 This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Purpose To provide guidance to AIs on handling and resolution of customer complaints in connection with their provision of banking and other financial services to individuals and small-to-medium sized enterprises. Classification A statutory guideline issued by the MA under the Banking Ordinance (BO), §7(3). Previous guidelines superseded IC-4 “Complaint Handling Procedures” V.1 dated 22.02.2002 Application To all AIs Structure

1. Introduction 1.1 Financial consumer protection: Complaints handling and redress 1.2 Role of the HKMA 1.3 Scope
2. Key elements of effective complaints handling and redress mechanisms 2.1 General principles 2.2 Policies and procedures 2.3 Accessibility 2.4 Confidentiality 2.5 Objectivity and authority in handling complaints 1

Supervisory Policy Manual IC-4 Complaints Handling and Redress V.2 – 06.01.2023 2.6 Follow-up including investigation of complaints 2.7 Redress 2.8 Response to complainant and review mechanism 2.9 Reporting of potential breaches 2.10 Resources and staff training 2.11 Management oversight and audit 3. Timeframe for complaints handling 3.1 Acknowledgement 3.2 Response to complainants 4. Record keeping 4.1 Retention period and coverage 4.2 Access for inspection and reporting 5. Cooperation with the HKMA and other organisations on complaints handling 5.1 Contact point of AI 5.2 Complaints referred by the HKMA 5.3 Complaints referred by other organisations —————————

1. Introduction 1.1 Financial consumer protection: Complaints handling and redress 1.1.1 Effective complaints handling and redress mechanisms of AIs enhance the trust of customers and help improve service quality as well as customer experience. Thus proper arrangements for achieving these objectives are conducive to promoting general stability of the banking system and protection of bank customers. Insights and feedback gathered from complaints handling processes also help inform efforts in promoting standards of conduct as well as the development of a set of ethical standards and values for which AIs and their staff are expected to follow. 2

Supervisory Policy Manual IC-4 Complaints Handling and Redress V.2 – 06.01.2023 1.1.2 As a member of the Financial Stability Board Consultative Group and the Task Force on Financial Consumer Protection of the Organisation for Economic Co-operation and Development, the HKMA participates in the global efforts on consumer protection. The HKMA also subscribes to the G20/OECD High-Level Principles on Financial Consumer Protection (High-Level Principles) 1 , which promulgates “Complaints handling and redress” as one of the priority areas, that financial consumers should have access to adequate complaints handling and redress mechanisms that are accessible, affordable, independent, fair, accountable, timely and efficient, while such mechanisms should not impose unreasonable cost, delays or burdens on consumers. The High-Level Principles also provide that recourse to independent redress process should be available to address complaints that are not efficiently resolved via the financial service providers and their internal dispute resolution mechanisms. 1.1.3 Following international developments, the HKMA has been working closely with the industry and introduced the Treat Customers Fairly Charter (TCF Charter) with retail banks since 2013 to foster a stronger corporate culture towards fair treatment of customers at all levels of banks and at all stages of their relationship with customers. The TCF Charter for Private Wealth Management Industry has also been implemented since 2017. Principle 4 of the TCF Charter stipulates that “[b]anks should provide customers with reasonable channels to submit claims, make complaints, seek redress, and should not impose unreasonable barriers on customers to switch banks.” 1.1.4 AIs should keep abreast of the latest international standards and make reference to guidance provided by the HKMA from time to time in their regular reviews, and implement appropriate enhancement of their complaints handling and redress mechanisms. Where monetary disputes are involved, AIs should also proactively consider subscribing to independent mediation and 1 The High-Level Principles were first introduced in October 2011 and updated in December 2022. 3

Supervisory Policy Manual IC-4 Complaints Handling and Redress V.2 – 06.01.2023 arbitration services 2 to resolve the matter with complainants in a fair manner. 1.2 Role of the HKMA 1.2.1 Pursuant to §7 of the BO, the HKMA has the functions, among others, of:  taking all reasonable steps to ensure that any banking business, any business of taking deposits, or any other business, carried on by an AI is carried on (i) with integrity, prudence and the appropriate degree of professional competence; and (ii) in a manner which is not detrimental, or likely to be detrimental, to the interests of depositors or potential depositors;  promoting and encouraging proper standards of conduct and sound and prudent business practices among AIs; and  suppressing or aiding in suppressing illegal, dishonourable or improper practices in relation to AIs’ business practices. 1.2.2 Exercising these functions by the HKMA includes requiring AIs to have systems to ensure that customer complaints are fully and promptly followed up and resolved in an appropriate manner. Apart from the issues of fairness to customers in business dealings, effective complaints reporting and monitoring, as well as useful intelligence from whistleblowing, AIs are expected to be able to identify possible misconduct by staff, weaknesses in internal controls as well as emerging operational and reputational risks pursuant to complaint handling. 1.2.3 The HKMA, being the principal regulator and supervisor of AIs, handles complaints lodged against AIs and/or their staff. The HKMA requires the AI concerned to follow up the complaint properly and provide a 2 For example, the Financial Dispute Resolution Centre was set up by the Government of the Hong Kong Special Administrative Region, the HKMA and the Securities and Futures Commission jointly in November 2011 as a non-profit making organisation to administer an independent and impartial financial dispute resolution scheme providing customers with an alternative avenue for resolving monetary disputes with financial institutions. 4

Supervisory Policy Manual IC-4 Complaints Handling and Redress V.2 – 06.01.2023 substantive reply to the complainant. In addition to guidance provided to the AI concerned during the complaints handling process, insights and emerging trends identified by the HKMA from complaint cases are shared with the wider industry through the periodic newsletter “Complaints Watch”. This newsletter aims to promote sound bank culture including customer-centric and proper ethical standards among AIs, and informs the industry about emerging conduct issues and developments. 1.2.4 Separately, information received by the HKMA in handling customer complaints may assist in identifying supervisory concerns or disciplinary concerns which require follow-up actions, including opening an investigation and the taking of supervisory or disciplinary action as appropriate where serious failure of an AI and/or its staff can be established with evidence. Where necessary, the HKMA may refer the complaint to other relevant regulators or enforcement agencies for their consideration and action deemed necessary. 1.2.5 It is the HKMA’s expectation that AIs should have parallel processes for:  handling and resolving customer complaints; and  following up on issues of concerns or control deficiencies as identified during the handling of complaints. 1.2.6 Failure to have in place effective arrangements to handle complaints may call into question whether an AI continues to satisfy the authorization criteria in the Seventh Schedule to the BO. Specifically, paragraph 10 of the Seventh Schedule requires AIs to have adequate accounting systems and systems of control and paragraph 12 requires them to conduct their business with integrity, competence and in a manner not detrimental to the interests of depositors and potential depositors. Having effective complaints handling and redress mechanisms is essential for an AI to meet applicable legal and regulatory obligations. 1.3 Scope 5

Supervisory Policy Manual IC-4 Complaints Handling and Redress V.2 – 06.01.2023 1.3.1 This module applies to complaints, whether oral or written, lodged against an AI and/or its staff, by or on behalf of a customer and complaints referred by the HKMA, about an AI's provision of, or failure to provide, services or products in business areas including but not limited to banking, securities, futures, insurance and mandatory provident fund. 1.3.2 Where the complaint has been resolved by close of business on the next business day of its receipt, the requirements under sections 3 and 4 below are exempted. Where the complaint is anonymous, the requirement under section 3 below is exempted. 2. Key elements of effective complaints handling and redress mechanisms 2.1 General principles 2.1.1 AIs’ complaints handling and redress mechanisms should be:  comprehensive in their coverage;  transparent, accessible and affordable to customers;  fair and impartial for all parties concerned;  timely and efficient, with appropriate and measurable service pledge or performance standards;  able to communicate with the complainants in an effective and pragmatic manner;  able to improve the AI’s accountability and transparency;  consistent approaches for the provision of redress; and  able to reflect customer feedback, issues of concerns and/or emerging risks to the senior management and/or board of directors of AIs for appropriate follow-up, as well as reporting 6

Supervisory Policy Manual IC-4 Complaints Handling and Redress V.2 – 06.01.2023 material matters to the HKMA and other regulators where necessary. 2.2 Policies and procedures 2.2.1 AIs should have appropriate and effective policies and procedures in place for handling customer complaints and following up on issues of concerns as identified during the complaints handling process. In formulating practical procedures, AIs should keep abreast of the latest international standards and take into account guidance provided by the HKMA, including this module, from time to time, as well as relevant principles and provisions of the TCF Charter and Code of Banking Practice. 2.2.2 It is not uncommon that AIs may partner with other service providers or act as an agent in offering financial services and/or products to customers. AIs should clearly set out, in the relevant service agreements, the expected conduct of the business partners and/or service providers engaged by them for the provision of services or products. Where there are complaints concerning the services and/or products provided by their business partners or service providers, AIs should have appropriate arrangements with these parties and inform customers of such arrangements to ensure that complaints are properly dealt with. 2.2.3 The complaint handling procedures should include the following:  acknowledging receipt of complaints;  appropriate follow-up, including possible investigation, of allegations or concerns raised by the complainant;  responding to complainants on all allegations or concerns raised;  availability of any redress or compensation in appropriate circumstances;  appropriate integration of the complaint handling and redress mechanisms with the AI’s business 7

Supervisory Policy Manual IC-4 Complaints Handling and Redress V.2 – 06.01.2023 operations as well as other risk management and control systems; and  proper written record of the correspondence and processes be kept. 2.2.4 When deciding what constitute appropriate complaints handling procedures, individual AIs should have regard to:  guidance provided by the HKMA and keep abreast of the relevant international standards from time to time;  size and organisational structure of the AI;  products and services being provided; and  expected number of complaints, and the likely nature and complexity. 2.2.5 AIs should put in place appropriate management controls and take reasonable steps to ensure that complaints are handled fairly, consistently and promptly and that AIs should also seek to identify through complaints handling any recurring, as well as any specific, issues of serious concerns and/or systemic impacts, and take prompt remedial actions. 2.2.6 AIs should take appropriate steps to handle anonymous complaints, or whistleblowing reports, albeit not being able to issue written acknowledgment or reply to the complainants. Even if a complaint is anonymous, as with other complaints, any issues alleged by the complainant and substantiated after investigation should be rectified as soon as practicable. 2.2.7 AIs should be prepared to deal with complaints lodged by a third party on behalf of a customer, if the latter has provided a proper authorisation to the AI concerned. 2.2.8 Where a complaint involves multiple AIs, e.g. mis￾transfer of funds, the AIs concerned should provide practical assistance to each other for handling the complaint. 8

Supervisory Policy Manual IC-4 Complaints Handling and Redress V.2 – 06.01.2023 2.2.9 For complaints referred to an AI by the HKMA, the AI concerned should follow the guidance in subsection 5.2 below. 2.3 Accessibility 2.3.1 AIs should:  make available information about their complaints handling processes to the public through a variety of channels. Such information should be clear, easily understood and, including but not limited to key contact details, workflow, timeframe and appeal mechanism;  create no barrier (e.g. imposition of a fee) to the public for lodging complaints;  ensure that their staff are able to answer general enquiries about the complaints handling processes; and  acknowledge receipt of complaints within the timeframe set by the HKMA (see subsection 3.1 below). 2.3.2 Special assistance should be given to complainants experiencing vulnerability (e.g. with disability or language problems). 2.3.3 AIs’ correspondence relating to complaints should be in clear and plain language. Correspondence with complainants should generally be in the language chosen or used by individual complainant and the official languages of Hong Kong. 2.4 Confidentiality 2.4.1 Procedures should be designed to protect the identity of complainants. 2.4.2 Information in relation to a complaint should be treated as confidential and should be processed by the responsible staff strictly on a need-to-know basis. 2.4.3 AIs should at all times comply with the Personal Data (Privacy) Ordinance (PDPO) and any relevant codes of 9

Supervisory Policy Manual IC-4 Complaints Handling and Redress V.2 – 06.01.2023 practice issued or approved by the Privacy Commissioner for Personal Data (PCPD) giving practical guidance on compliance with the PDPO. 2.5 Objectivity and authority in handling complaints 2.5.1 AIs’ complaints handling procedures should make provision for:  complaints to be followed up, and investigated as appropriate, by staff who were not directly involved in the matter which is the subject of the complaint and who are competent to investigate into allegations or concerns raised by complainants;  the staff charged with responding to complaints to have the authority to settle complaints (including offering redress where appropriate) or to have ready access to those who have the necessary authority; and  responses which address the subject matter of the complaint accurately and adequately and, where a complaint is substantiated, to offer appropriate redress. 2.5.2 AIs should also have review mechanisms in place to assess the appropriateness and fairness of the handling of a complaint. 2.6 Follow-up including investigation of complaints 2.6.1 AIs should understand the allegations raised by complainants and that enquiry should be made to clarify the allegations or concerns as necessary. 2.6.2 The complaints handling staff should adopt an impartial approach to both the complainant and the subject of complaint when following up the matter and making inquiries and gathering further information. 2.6.3 The follow-up including investigation process should be a fact-finding process not affected by any undue influence. AIs should ensure that the findings and result of the handling of a complaint should be supported by 10

Supervisory Policy Manual IC-4 Complaints Handling and Redress V.2 – 06.01.2023 objective evidence as far as practicable to address the concerns of the complainants. 2.6.4 The complaints handling staff should keep themselves abreast of latest regulatory requirements and be capable of identifying possible regulatory breach and misconduct during the follow-up including investigation process. Where necessary, assistance from the Compliance or other relevant function(s) of the AI should be sought. 2.7 Redress 2.7.1 Where an AI considers that redress is appropriate, it should aim to provide the complainant with a fair compensation for any act or omission for which it should be responsible. 2.7.2 Appropriate redress may not always involve a financial element. It may sometimes entail an apology, for example. Where financial redress is deemed appropriate, interest on the amount should be considered. 2.7.3 In case a settlement cannot be reached on the financial redress bilaterally with the complainant, the AI concerned should make sufficient efforts of inviting the complainant to join it in seeking mediation and/or arbitration service as an independent redress process to resolve the matter in a timely and efficient manner. 2.8 Response to complainant and review mechanism 2.8.1 For the purposes of this module, AI’s response should include whether it (i) accepts the matters complained (and offers redress where appropriate); or (ii) offers redress without accepting the matters complained; or (iii) rejects the matters complained and gives reasons for doing so. 2.8.2 If the complainant raises further enquiries and/or dissatisfaction about the complaint handling result, the AI concerned should review the complainant’s enquiries to see if there is new objective information to support the allegation(s) and provide further response to the complainant within reasonable time. 11

Supervisory Policy Manual IC-4 Complaints Handling and Redress V.2 – 06.01.2023 2.9 Reporting of potential breaches 2.9.1 When there is possible regulatory breach and/or misconduct identified during follow-up including investigation of a complaint, escalation to senior management and self-reporting to the HKMA or other regulators should be made as soon as reasonably practicable. 2.9.2 Appropriate and timely remedial actions should be taken to avoid recurrence of similar incidents. 2.10 Resources and staff training 2.10.1 AIs should allocate adequate resources to ensure the efficiency and effectiveness of complaints handling and redress mechanisms, including hotlines for handling enquiries and receiving complaints, supported by experienced staff with relevant skill and knowledge, appropriate training, technology and finance. 2.10.2 AIs should take reasonable steps to ensure that all relevant employees (including employees of appointed agents) are aware of the complaints handling procedures and act in accordance with the established procedures. In particular, public-facing staff should be provided with adequate training on the complaints handling procedures. 2.11 Management oversight and audit 2.11.1 AIs should implement or otherwise integrate an appropriate control system for monitoring complaints trend and customer satisfaction level, taking into account the size, scope and scale of their businesses as well as nature of customer relationships. Relevant management information may include but not limited to:  statistics on the volume and type of complaints, either received by the AI directly or referred by the HKMA or other sources;  how well the complaints handling and redress mechanisms meet service pledge or performance standards, including processing time for each complaint; 12

Supervisory Policy Manual IC-4 Complaints Handling and Redress V.2 – 06.01.2023  complaints handling results (i.e. whether allegations are substantiated or unsubstantiated);  nature and level of redress provided;  the level of complainants’ satisfaction with how complaints are handled; and  whether issues or deficiencies have been identified and remediated efficiently and effectively. 2.11.2 Senior management of AIs should be responsible for ensuring effectiveness of the complaints handling and redress mechanisms. Management review should focus on whether:  deficiencies related to AIs’ business conduct and operations as identified in the complaints handling processes are promptly and properly rectified;  resources allocated to the complaints handling function remain sufficient to resolve complaints in an effective and efficient manner;  issues and findings identified in audits or other independent reviews are followed up appropriately; and  any enhancement to the complaints handling and redress mechanisms is warranted, taking into account the latest development in areas such as scale and scope of products or services being offered, regulatory landscape, and technological innovation. 2.11.3 Where material matters are identified, especially for concerns about an AI’s culture and conduct, the senior management should report to the board of directors for steer and institute prompt enhancements or remediation as appropriate. 2.11.4 Regular audits should be conducted by competent and independent parties. Audit exercises should aim at examining whether:  the complaints handling and redress mechanisms fulfil the stated aims of the policy; and 13

Supervisory Policy Manual IC-4 Complaints Handling and Redress V.2 – 06.01.2023  the procedures are operating effectively and efficiently. 2.11.5 Audit results should be reported to the senior management and board of directors to help improve AIs’ customer-centric culture, complaints handling and redress mechanisms as well as operating processes as appropriate, and may also inform future development of products and services. 3. Timeframe for complaints handling 3.1 Acknowledgement 3.1.1 AIs should acknowledge a complaint within seven calendar days of its receipt, giving the name or job title and contact details of the staff responsible for handling the complaint, as well as details of the complaints handling procedures. Complaints should be processed in writing as far as practicable to avoid misunderstanding about the facts of the case, while AIs should keep proper audit trail (e.g. audio record or call report) where circumstances are warranted to acknowledge or handle a complaint orally. 3.1.2 AIs which are able to resolve a complaint or provide a response (see subsection 3.2.1 below) within seven calendar days of receiving a complaint may combine the acknowledgement of the complaint with the response. 3.2 Response to complainants 3.2.1 Within 30 calendar days after receiving a complaint, AIs should provide the complainant with:  a response in accordance with subsection 3.2.2 below; or  an interim response which explains why the AI is not in a position to make a response in accordance with subsection 3.2.2 below, giving reasons for the delay and an indicative timeframe (normally not exceeding 60 calendar days) for a full response. 14

Supervisory Policy Manual IC-4 Complaints Handling and Redress V.2 – 06.01.2023 3.2.2 In any case, a full response should be provided to the complainant within a reasonable period of time, taking into account the nature and complexity of the complaint. The response should set out:  the allegation(s) or concern(s) raised by the complainant;  results of the AI’s follow-up including investigation of the complaint;  whether the AI (i) accepts the matters complained (and offers redress where appropriate); (ii) offers redress without accepting the matters complained; or (iii) rejects the matters complained and gives reasons for doing so; and  a review mechanism if the complainant provides new objective information to AI. 4. Record keeping 4.1 Retention period and coverage 4.1.1 AIs should record and retain details of complaints, including anonymous complaints, for a minimum period of two years from the date of their receipt3. 4.1.2 Details to be recorded should include, where applicable:  complainant’s name;  substance of the complaint;  follow-up including investigation process;  complaint handling results;  any correspondence between the AI and the complainant, including how the complaint was resolved and details of any redress offered by the AI; and  whether any alleged issues, if substantiated, were rectified or being rectified, including detailed actions and timeframe. 3 AIs should observe the data protection principles of Schedule 1 to the PDPO and any relevant codes of practice issued or approved by the PCPD on records retention. 15

Supervisory Policy Manual IC-4 Complaints Handling and Redress V.2 – 06.01.2023 4.2 Access for inspection and reporting 4.2.1 Records should be kept in a convenient and accessible form to facilitate inspection by the HKMA during regular or ad-hoc examinations and reviews. 4.2.2 The HKMA will follow up with AIs on issues or deficiencies in relation to business conduct and/or control systems as identified in the complaints handling processes. Where necessary, the HKMA may also request a report from an AI on the number and type of complaints received and the manner in which they have been handled. 5. Cooperation with the HKMA and other organisations on complaints handling 5.1 Contact point of AI 5.1.1 To enhance communication with the HKMA in relation to complaints handling, AIs should provide the HKMA at the time of their authorization with details of major contact point(s) within the AI responsible for complaints handling and redress. 5.1.2 AIs should notify the HKMA of any subsequent changes of their contact point(s). 5.2 Complaints referred by the HKMA 5.2.1 In respect of complaints involving business dealings between an AI and its customer and/or disputes on the relevant terms and conditions, as these are commercial disputes between the two parties, the HKMA considers it appropriate for the AI concerned to follow up and respond to the complainant directly. 5.2.2 The HKMA expects complaints referred to an AI to be fully followed up and investigated as appropriate, and that AI’s reply should be in writing and addressing the allegations or concerns raised by the complainant. 5.2.3 Findings from follow-up including investigation of the complaint, together with copies of any correspondence 16

Supervisory Policy Manual IC-4 Complaints Handling and Redress V.2 – 06.01.2023 with the complainant, should be submitted to the HKMA as soon as possible. 5.3 Complaints referred by other organisations 5.3.1 AIs should render appropriate assistance to other organisations or parties4 that have received complaints on the AIs and/or their staff. 5.3.2 Apart from replying to the complainant concerned upon completion of the handling processes, AIs should also make available the relevant correspondence and documents to such referring parties (subject to the need to maintain customer confidentiality and, if necessary, after seeking the consent of the complainant), as well as explaining their internal policies and procedures governing the subject matter of the complaint, actions taken to resolve the complaint and any offer of redress. ————————— Contents Glossary Home Introduction 4 Such as members of the Legislative Council (LegCo), LegCo Secretariat, the Consumer Council and the media. 17