Updated Guidance on Registration in Respect of Regulated Activities under the Securities and Futures Ordinance and Controls to Ensure Fitness and Properness of Staff

1 Annex 1 Guidance on registration related matters I. Registration to become a registered institution under the Securities and Futures Ordinance Introduction Section 114 of the Securities and Futures Ordinance (SFO) stipulates that no person shall carry on a business in a regulated activity1 or hold himself out as carrying on a business in a regulated activity unless it is a licensed corporation, a registered institution (RI) or a person authorized under section 95(2) of the SFO to provide automated trading services2 . According to section 119 of the SFO, an authorized institution (AI) may apply for registration with the Securities and Futures Commission (SFC) if it intends to engage in one or more than one regulated activity, other than Type 3 (leveraged foreign exchange trading) and Type 8 (securities margin financing) regulated activities. Application for registration as RIs To apply for registration with the SFC, an AI needs to complete the specified application forms and submit these, together with the required supporting documents, to the SFC via the SFC’s electronic platform accessible from its public website. It should be noted when there is a change of the information already submitted to the SFC and the relevant application for registration is still under the latter’s consideration, as required by section 4(2)(a) of the Securities and Futures (Licensing and Registration) (Information) Rules, an applicant must notify the SFC within 7 business days after the change takes place. The notice must be in writing containing a full description of the change. Any AI that intends to apply to the SFC for registration under the SFO must submit applications to obtain the consent of the Monetary Authority for the appointment of at least two executive officers (EOs) in relation to each proposed regulated activity not later than its application to the SFC for registration. Such submission should be made directly to the Hong Kong Monetary Authority (HKMA). Please refer to part II for details of the arrangements for applications in respect of EOs. 1 As defined in Schedule 5 to the SFO. 2 This refers to a person who provides automated trading services but does not engage in traditional dealing activities.

2 Assessment of an application to become an RI Pursuant to section 119 of the SFO, the SFC will refer the application to the Monetary Authority. The HKMA may request the applicant to provide additional information and documents, for example if the business plan and internal control procedures submitted in the application package fail to provide sufficient details for the purpose of the HKMA’s assessment, an Independent Assurance Report on the AI’s fitness and properness including whether it is competent to carry on the regulated activity applied for with reference to the relevant statutory and regulatory requirements3 , etc. In practice, the HKMA will evaluate the application taking into account matters such as the AI’s previous experience in the activities, management capabilities, controls and resources. To facilitate planning, AIs should notify the HKMA of their intended applications in advance. The HKMA will advise the SFC whether the Monetary Authority is satisfied that the applicant is fit and proper to be registered for the regulated activity concerned. The HKMA’s advice to the SFC may include recommendations in respect of any condition of registration. The HKMA may consider making such recommendation where the condition(s) can overcome concerns about the fitness and properness of an applicant. One typical example of such concerns would be where the applicant cannot demonstrate sufficient experience and expertise in relation to a regulated activity, and the resulting condition may be an appropriate restriction on the scope of such activity. Outcome of application Pursuant to section 119 of the SFO, the SFC will have regard to any advice given by the Monetary Authority and may rely wholly or partly on that advice in making its decision to approve (with or without conditions) or refuse (the whole or a part of) an application. The SFC will consult the Monetary Authority before imposing any condition on the registration of an RI. Under section 140 of the SFO, if the SFC forms a preliminary view to refuse the whole or a part of an application; or impose conditions on approving an application, it will inform the applicant of the ground for the preliminary view and give such applicant a reasonable opportunity of being heard. When the SFC makes a final decision, it will notify the applicant in writing of its decision and the reasons for making such decision. The Memorandum of Understanding (MoU) signed between the HKMA and the SFC (available on both regulators’ public websites) sets out details of the referral and consultation procedures mentioned above in relation to AIs’ applications for registration. You may also refer to the SFC’s Licensing Handbook available on 3 As stipulated in paragraph 8.7 of the HKMA’s Guide to Authorization and paragraph 6.2.3 of the SFC’s Licensing Handbook.

3 the SFC’s public website, which provides information of registration matters under the SFO. Registration status As required under the Securities and Futures (Miscellaneous) Rules, after registration with the SFC, an RI must exhibit its certificate of registration in a prominent place at its principal place of business. If an RI has more than one place of business, it must exhibit a copy of the certificate in a prominent place at each of its other places of business that carries out any regulated activity. The copy of certificate should be certified by a director or an EO of the RI. The SFC Public Register of Licensed Persons and Registered Institutions displaysspecified particulars of RIs and EOs of the RIs. Meanwhile, the Register of Securities Staff of AIs (HKMA Register) maintained under section 20 of the Banking Ordinance (BO) captures the particulars of RIs’ relevant individuals (also including EOs, relevant individuals under temporary engagement and itinerant professionals). Please refer to part III for details of the HKMA Register. Reporting of changes Pursuant to section 127 of the SFO, where an RI applies for variation of the regulated activities specified in its certificate of registration by adding any regulated activity, such application will be regarded as an application for registration in respect of that regulated activity. It will be required to provide additional information, e.g. business plan and internal control procedures, in relation to the new regulated activity. An RI that wishes to reduce the regulated activities specified in the certificate of registration should also submit an application to the SFC. To lodge such applications, the RI should complete the SFC’s specified forms supported by relevant information / documents (as the case may be) and submit these documents directly to the SFC. Under section 135 of the SFO and the Securities and Futures (Licensing and Registration) (Information) Rules, an RI is required to notify both the SFC and the HKMA in writing of certain events and within the specified timeframe.

4 II. Executive officers of registered institutions Introduction Under sections 71C and 71D of the BO, every RI shall appoint not less than two EOs to be responsible for directly supervising the conduct of each regulated activity it is registered for under the SFO. As stipulated in section 119 of the SFO, it shall be a condition of registration that for each regulated activity, there is at least one EO available at all times to supervise the business. An individual may be appointed to be an EO for one or more regulated activities. Application to become an EO Under section 71C of the BO, no person may become an EO of an RI without the consent in writing of the Monetary Authority. It is therefore necessary for an AI to ensure that — • application to the HKMA for consent to the proposed appointment of EOs, using the standard application form and relevant supplement forms which are available on the HKMA’s private website and providing the required supporting documents as set out in the form, will be made not later than its application to the SFC to become an RI (except where an AI is already an RI for the regulated activity concerned and seeks to appoint a further EO); and • the individual concerned must not become or act as an EO prior to obtaining the Monetary Authority’s consent. To save subsequent requisitions and avoid unnecessary delay in processing, applicants and the AIs which support the applications are reminded to provide complete, relevant and accurate information, together with necessary annexes and supporting documents as requested in the application form, particularly where specific details and explanations are necessary. Failing to do so may result in longer processing time and / or return of the application form for re￾submission. Assessment of an application to become an EO In considering whether to grant consent to an individual applying to become an EO of an RI, the HKMA will evaluate — (a) whether the applicant is a fit and proper person to be an EO of the institution concerned, and (b) whether the applicant has sufficient authority within the institution concerned to be such EO.

5 It is the responsibility of an applicant to satisfy the HKMA that the applicant is fit and proper and has sufficient authority within the institution concerned to be such EO. The HKMA may request the applicant to provide additional information and documents. Following the general principles set out in the HKMA’s Supervisory Policy Manual Module SB-1 “Supervision of Regulated Activities of SFC-Registered Authorized Institutions” (HKMA SPM SB-1), it is already a requirement that any CEs, ACEs or directors who are directly responsible for supervising the conduct of regulated activities should be appointed as EOs in respect of the regulated activities they oversee and the HKMA may require individuals to become EOs if appropriate. RIs should also ensure that at least one of the EOs for a given regulated activity should be a CE, ACE, director or section 72B manager. In addition, RIs should ensure that all EOs are not more than one rank below the CE, ACE, director or section 72B manager, if they do not themselves fall into these categories, so as to ensure that he or she has sufficient authority to conduct or oversee the relevant regulated activity. Some flexibility may be allowed on exceptional basis subject to adequate justifications, where the HKMA will take into account the size of the RI, the significance of the regulated activity in relation to the overall business of the institution, the management structure as well as the reporting line of the EOs. Outcome of application The Monetary Authority may — • give consent (with or without conditions attached) to an EO; or • refuse an EO application in full or in part (i.e. refuse to give consent in respect of one or more of the regulated activities under application). Where the Monetary Authority gives consent to an EO applicant, the HKMA will as soon as is reasonably practicable give notice in writing to the individual concerned and the RI concerned, and specify any conditions attached to the consent. The notice will indicate the types of regulated activity for which such consent is given. Where the Monetary Authority decides to refuse an EO application, the HKMA will as soon as is reasonably practicable give notice in writing to the individual concerned and the RI concerned and specify the reasons. To be in line with the SFC’s practice, the applicant will be given a reasonable opportunity of being heard, before the Monetary Authority making the final decision.

6 Application for provisional consent Section 71E of the BO provides that the Monetary Authority may, upon request of a person seeking consent to be an EO of an RI, and in his absolute discretion, give provisional consent to the person to be such EO. The Monetary Authority may attach any condition to the provisional consent as the Monetary Authority thinks proper. This provision aims to facilitate RIs’ compliance with the statutory condition of registration to have at least two EOs to supervise the business of each regulated activity. The Monetary Authority shall refuse to give provisional consent unless the EO applicant satisfies the Monetary Authority that the giving of such consent will not prejudice the interests of depositors or potential depositors of the RI concerned and the investing public. After a provisional consent is granted, the formal consent will be given when the HKMA has satisfactorily completed the vetting procedures (i.e. background checks) in respect of the individual. Submission of information in relation to EOs and reporting of changes By the nature of their engagement in regulated activities, EOs are relevant individuals and hence their specified particulars need to be included in the HKMA Register. The HKMA Register will contain the same types of particulars for EOs and non￾EOs, except that for every EO, there will be an indication of the regulated activities for which the individual is an EO. Please refer to part III for details of the HKMA Register. The e-Register4 for the submission of relevant individuals’ particulars does not accept an RI’s submission of information in relation to an EO5 . All such submissions must be made in writing to the HKMA. The following points should be noted in this regard. (a) The information contained in an EO application will be sufficient for the purpose of the HKMA Register. Upon granting consent, the HKMA will perform the system inputs for updating the HKMA Register. (b) Before an EO may take up the responsibility of directly supervising any additional regulated activity, a new consent from the Monetary Authority must be obtained. The EO has to complete the application form and 4 HKMA’s web-based online system to facilitate submission of the specified particulars of relevant individuals for the purpose of the HKMA Register. 5 Where a relevant individual is concurrently an EO for one regulated activity and a non-EO for another, the information (including subsequent changes) on the latter type of regulated activity should be submitted by the RI concerned through the e-Register to the HKMA.

7 relevant supplement forms and go through the same procedures as a new application. (c) Where an individual ceases to be an EO (of any or all regulated activities for an RI), or in the case of other subsequent changes to the information relating to an EO that has been provided to the HKMA (whether for the purpose of the application for Monetary Authority’s consent or after obtaining the consent), the RI should notify the HKMA within 7 business days of such changes. Also, for a change in the information as specified in Part 2 of Schedule 3 to the Securities and Futures (Licensing and Registration) (Information) Rules, the RI should notify both the HKMA and the SFC within the same timeframe. (d) RIs are reminded that the SFC’s disclosure requirement regarding notifications of cessation of accreditation per Frequently Asked Questions (FAQs) on “Disclosure of investigations commenced by licensed corporations in the notifications of cessation of accreditation” also applies to an EO. In other words, an RI is required to provide information to the SFC and the HKMA about whether an individual is under any investigation commenced by the RI within 6 months preceding the cessation of appointment of that individual as an EO. If the internal investigation commences subsequent to the notification of cessation of appointment as an EO, the RI should notify the SFC and the HKMA as soon as practicable.

8 III. Register of Securities Staff of AIs Section 119 of the SFO imposes a statutory condition of registration for every RI to ensure that its relevant individuals (also including EOs, relevant individuals under temporary engagement and itinerant professionals) are fit and proper. RIs are reminded that relevant individuals who are no longer fit and proper (e.g. unable to pass the requisite local regulatory framework paper within specified timeframe6 ) should therefore be promptly de-registered. The HKMA Register Under section 20(3) of the BO, every RI is required to submit specified particulars of its relevant individuals to the Monetary Authority for inclusion of such individuals’ particulars in the HKMA Register. Only those individuals whose names are entered in the HKMA Register may engage in any regulated function in any regulated activity of an RI. In accordance with section 20(4B) of the BO, such particulars are available for public inspection in the form of an online record on the HKMA’s public website. The specified particulars of a relevant individual that are included in the HKMA Register include:

1. Name in English *
2. Name in Chinese (if applicable) *
3. Hong Kong Identity Card (HKID) number and Passport number7
4. Nationality
5. Date of birth
6. Effective date and Ending date of temporary engagement period (if applicable)
7. Central Entity Identification number assigned by the SFC (if applicable) For each type of regulated activity:
8. Capacity *
9. Date on which the relevant individual was first so engaged *
10. Effective date of new regulated activity to be engaged in (if applicable) It should be noted that certain personal data are obtained for administrative purposes, only items with an asterisk are shown on the HKMA Register for public inspection. Please refer to the notes for completion available on the e-Register at the HKMA’s private website for further details of the above particulars. 6 In line with the SFC’s treatment for licensed representatives, the HKMA usually allows a 6-month grace period for a relevant individual who has yet to pass the local regulatory framework paper but has satisfied all other elements of the competence test. Refer to subsection 4.4.6 of the HKMA SPM SB-1 for details. 7 For avoidance of doubt, Hong Kong permanent resident is required to provide HKID number only. Non-Hong Kong permanent resident should provide both HKID number (if any) and passport number.

9 The HKMA Register also includes the RI’s name, business address and central entity identification number assigned by the SFC; the unique registration number assigned by the HKMA to the relevant individual; the registration conditions (if any) on the relevant individual; the registration history of the relevant individual; and the record of public disciplinary actions (if any) taken against the relevant individual by the SFC and the HKMA in Hong Kong (for a period of 5 years from the date when the relevant public disciplinary action takes effect). For relevant individuals under temporary engagement or itinerant professionals, there is an indication that the individual is under temporary engagement or engaged as itinerant professional respectively.

The specified particulars of relevant individuals included in the HKMA Register are in line with those required for licensed representatives under the Securities and Futures (Licensing and Registration) (Information) Rules in respect of the SFC Public Register of Licensed Persons and Registered Institutions insofar as they are applicable. RIs should notify each individual concerned of the HKMA’s collection of the individual’s personal data, the purpose of such collection as mentioned herein and the individual’s rights under the Personal Data (Privacy) Ordinance (PDPO) as summarised in the Personal Information Collection Statement of the Monetary Authority (PICS)8 . Online submission to the HKMA The particulars of the relevant individuals as set out above should be submitted to the HKMA for the purpose of the HKMA Register prior to their beginning to act for the RI in respect of any regulated activity. They should not begin to act in that capacity until their names and specified particulars have been entered in the HKMA Register. Information in respect of relevant individuals (excluding EOs) should be submitted to the HKMA via the e-Register at the HKMA’s private website. Please refer to part II for details of the arrangements in respect of EOs. RIs will be notified by the same e-Register that the information has been placed on the HKMA Register, and an HKMA registration number will be assigned to the relevant individual. 8 The PICS is included in the e-Register upon submission of information.

10 Reporting of changes and on-going maintenance of relevant individuals’ particulars in the HKMA Register Section 20(4)(b) of the BO requires RIs to notify the HKMA of any subsequent change to the information submitted to the HKMA for the purpose of the HKMA Register within 7 business days of the change. Also, in line with the reporting requirements imposed by the SFC on licensed representatives under the Securities and Futures (Licensing and Registration) (Information) Rules, RIs are required to notify the HKMA in writing within 7 business days upon knowledge of certain information (including any subsequent change) of any of their relevant individuals. Please refer to subsection 5.5 of the HKMA SPM SB-1. RIs should have procedures and systems in place to meet the reporting requirements. To ensure full compliance, such notification requirements should be clearly communicated to all relevant individuals. RIs should put in place adequate control procedures for on-going maintenance of their relevant individuals’ particulars for the purpose of the HKMA Register. Some examples of controls that should be put in place include: (a) developing a set of procedures to ensure that proper approval for information submitted to the HKMA for entering into the HKMA Register and the subsequent changes (amendment or deletion) is obtained and recorded, and an appropriate audit trail is maintained; (b) notifying the relevant individuals of: (i) any of their personal particulars (new or changes) to be submitted for the purposes of the HKMA Register before making the submission; and (ii) the fact that the changes have been made to the HKMA Register after receiving the HKMA’s confirmation. RIs should maintain proper records of the notifications made to the relevant individuals; and (c) performing periodic checks with the HKMA Register against the RI’s own records (preferably by the compliance unit) to ensure accuracy of registration details.

Identification of relevant individuals According to paragraph 8.1 of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission, a registered person is required to provide clients with, among other things, the identity and status of

11 employees acting on its behalf with whom the client may have contact. As such, RIs should implement effective measures to enable clients to identify staff who are relevant individuals, particularly at retail branches.

For example, RIs may issue an “information card” to each relevant individual with clear identification on the card specifying (preferably in both English and Chinese) the following information: (i) name of the relevant individual; (ii) registration number assigned to the relevant individual by the HKMA; and (iii) names of regulated activities in which the relevant individual is engaging. Relevant individuals may identify themselves to clients by presenting the “information card” if so requested. Alternatively, the information can be included in the relevant individuals’ business cards.

1 Annex 2 Guidance on controls to ensure the fitness and properness of relevant individuals and others Fitness and properness of relevant individuals1 In addition to guidance issued by the regulators from time to time including subsection 4.4.12 of the Hong Kong Monetary Authority’s (HKMA) Supervisory Policy Manual Module SB-1 “Supervision of Regulated Activities of SFC-Registered Authorized Institutions” (HKMA SPM SB-1), set out below is guidance to registered institutions (RIs) on controls to ensure fitness and properness of relevant individuals. (1) Background checks – (a) RIs should ensure that background checks are performed on all relevant individuals. The background checks should at least cover those areas specified in subsection 4.4.12 of the HKMA SPM SB-1. As good practice, the background checks of proposed relevant individuals performed by RIs as observed include areas such as civil litigations and criminal records, which cover a wider scope than the existing regulatory requirements. (b) Regarding staff transferred from branches / affiliates outside Hong Kong, if the Hong Kong office of the RI rely on the branches / affiliates to perform the background checks, the staff should only be registered after the Hong Kong office of the RI has obtained satisfactory confirmation on the scope and results of the background checks performed by the branches / affiliates concerned. Such background checks should take into account the relevant statutory and regulatory requirements in Hong Kong. (c) The performance and results of background checks and follow-up actions of any apparent irregularity should be properly documented. As good practice, RIs as observed clearly document such in a standardised assessment checklist and maintain a good record system for such information. (d) RIs should obtain reference checks from previous employers of the proposed relevant individuals, which should also cover, among other things, whether the proposed relevant individual is or has been dismissed or requested to resign from any office or employment, or 1 For the avoidance of doubt and for the purpose of this Annex, where references to “relevant individuals” are made, the term covers “executive officers (EOs)” unless otherwise stated.

2 subject to internal investigations or disciplinary actions by the previous employers in relation to conduct matters. (e) Registration of staff should not take place before receipt of results of previous employment checks, and follow-up actions on any apparent irregularity should be taken with proper documentation maintained. (2) Verification of relevant industry experience – In respect of individuals who rely on relevant industry experience gained from other institutions to exempt from licensing examinations, RIs should establish due diligence steps to verify their relevant industry experience with previous employers to the extent practicable, instead of solely relying on the individuals’ curriculum vitae and self-declaration. For the purpose of verifying whether and in what capacity an individual was registered or licensed, RIs should request the previous employers to provide information on the individual’s last registration or licence status2 within the previous employment periods, or alternatively, verify such information through credible publicly available records, such as the Register of Securities Staff of AIs (HKMA Register) maintained under section 20 of the Banking Ordinance (BO), or the Public Register of Licensed Persons and Registered Institutions of the Securities and Futures Commission. (3) Response to other RIs’ request for information – Authorized institutions (AIs) should provide, within a reasonable period of time, a clear response to all relevant information requested by other RIs including that about previous employees’ employment history, registration status, any dismissal, being requested to resign, and internal investigations or disciplinary actions in relation to conduct matters. (4) Self-declaration mechanism – RIs should ensure their self-declaration mechanism is effective such as conducting regular review on the comprehensiveness of their self-declaration form taking into account the latest regulatory requirements. The self-declaration form should have sufficient scope to ensure compliance with subsection 5.5 of the HKMA SPM SB-1. Proper documentation should be maintained for the obtaining of self-declaration and follow-up actions on any apparent irregularity. (5) Regular internal audit of the controls – RIs should arrange for reviews, on a regular basis, by internal auditors of the controls related to the registration of relevant individuals. 2 The information should at least include the effective period of last registration or licence, the types of regulated activities and the individual’s capacity.

3 (6) “Fit and proper” assessment – (a) RIs should assign a suitably qualified designated unit with an overall responsibility to ensure completion of all required checking and assessments of proposed relevant individuals (e.g. background checks (including reference checks), self-declaration, etc.) before registration. If different units are involved in the checking and assessment process, there should be proper training to ensure that all responsible staff members have sufficient knowledge of the relevant regulatory requirements and internal procedures. (b) RIs should take into account all relevant factors in performing “fit and proper” assessment. The “fit and proper” assessment should be performed preferably with the use of a standardised and comprehensive checklist. The unit and staff members responsible should maintain proper documentation and supporting documents on all required checking and assessment of every proposed relevant individual (e.g. background checks (including reference checks), self-declaration, etc.), the results, and the follow-up actions on any apparent irregularity found, and the identity of the assessor and the approver. The assessment should be approved by an independent reviewer at a reasonable level of seniority. (c) RIs should maintain proper documentation to demonstrate how a proposed relevant individual meets the “fit and proper” requirements, including: • whether the individual fulfils the competence requirements before registration; and • whether the individual is subject to the “6-month grace period” arrangement, or exemption from examination is subject to conditions, and if so, how the individual becomes eligible for such exemption and the specific conditions applicable. (d) RIs should not solely rely on the “fit and proper” assessments performed by previous employers and should, with proper documentation, clear all concerns about the individual’s meeting the competence requirements for the relevant regulated activities3 and other “fit and proper” requirements, before registering the individual as a relevant individual. 3 An example is an individual who has not passed any licensing examination, does not possess relevant professional qualification or a degree in a designated field (or other degree with passes in at least two courses in the designated fields), and has no working experience in the securities industry.

4 (e) RIs should put in place clear and adequate policies and procedures to ensure that the “fit and proper” assessment of the proposed relevant individuals is properly conducted and adequately documented. Such policies and procedures should also include without limitation to the division of duties and responsibilities among different units involved in the “fit and proper” assessment. (7) Controls on 6-month grace period – For staff who are allowed a 6-month grace period to pass the local regulatory framework paper, RIs should adopt vigorous measures to ensure compliance with subsection 4.4.6 of the HKMA SPM SB-1. There should be clear communications to the staff as well as their supervisors at the outset about the 6-month grace period treatment and the prompt de-registration of the staff if they cannot pass the requisite examination by the end of the grace period. (8) Clear responsibilities of relevant individuals – The responsibilities of relevant individuals should be clearly defined and supported by up-to-date job descriptions, organisation charts and levels of authority. As good practice, RIs as observed have clear internal guidelines on the mapping of job duties and internal ranks with the types of regulated activities and the capacity to be registered for different categories of staff members across various business units. (9) Ongoing monitoring of relevant individuals’ fitness and properness (a) As good practice, RIs as observed perform regular bankruptcy checks against their internal credit database on all existing relevant individuals to ensure their continuous fitness and properness in financial status. (b) To ensure that their relevant individuals remain fit and proper, as good practice, among other things, RIs as observed require all relevant individuals to make an annual self-declaration on matters set out in subsection 5.5 of the HKMA SPM SB-1 to ensure their continuous fitness and properness. (c) RIs should refer potential breaches of regulatory requirements by relevant individuals (e.g. arising from customer complaints) to the compliance unit for review and appropriate action. Prohibition of unregistered dealing Under section 114(3) of the Securities and Futures Ordinance (SFO), no person shall perform any regulated function in relation to a regulated activity carried on as a business or hold himself out as performing any regulated function, unless such person carries on for an RI a regulated activity for which the RI is registered

5 and his name is entered in the HKMA Register. A person who, without reasonable excuse, contravenes section 114(3) of the SFO commits an offence. A person who knowingly allows or facilitates an individual who is not a relevant individual to engage in any regulated function in relation to a regulated activity for an RI may be regarded as aiding and abetting a breach of section 114(3) of the SFO, and if the person is a relevant individual, his fitness and properness for being a relevant individual may be called into question. An RI and its staff members supervising the relevant lines of business may be subject to disciplinary action for inadequate controls and lack of supervision of staff to ensure compliance with section 114(3) of the SFO. RIs should have adequate controls to ensure compliance with the prohibition of unregistered dealing under section 114(3) of the SFO. In doing so, RIs should put in place adequate control procedures to avoid possible unregistered dealings. These should include, among others, the following: (a) EOs and other relevant members of management should be reminded of their responsibility for ensuring proper registration of the relevant individuals in the HKMA Register. Staff members who are not relevant individuals should not be instructed or allowed to take part in any regulated function of a regulated activity (e.g. receiving orders relating to securities or futures contracts from clients or execution of such orders). This restriction applies also to those personnel who provide administrative or secretarial support to frontline staff. (b) Staff members who are not relevant individuals may sometimes be required to communicate with clients, such as taking messages of telephone calls. Such activities may be performed as a regular duty or only on an ad hoc basis, particularly when the responsible relevant individuals are on leave or out of office. If staff members are in doubt whether performance of such activities will become engaging in any regulated function in relation to a regulated activity, they should consult the relevant unit (e.g. the compliance unit) on this matter. RIs should also provide adequate guidance to the staff members concerned on how to deal with the possible scenarios as well as to refer the clients to a relevant individual who is registered for the appropriate type of regulated activity (e.g. Type 1 for orders relating to securities). (c) Whenever staff members (e.g. supervisor of or frontline staff served by a staff member who is not a relevant individual) become aware that an individual is / has been involved in possible unregistered dealing, they should immediately report the incident to the compliance unit for investigation. RIs should seek proper legal advice if they have doubt about possible unregistered dealing of any staff member. Where there is a reasonable ground to believe that unregistered dealing has taken place, the

6 RI should immediately stop such practice and report the matter to the HKMA in writing as soon as practicable. (d) RIs should ensure that staff members who are seeking registration with the HKMA are fully aware that they are not allowed to engage in any regulated function of a regulated activity before proper registration. It is also the responsibility of the supervisors of these staff members to ensure compliance with this requirement. (e) RI should inform relevant individuals that it is in their own interest to check and ensure that their particulars have been properly entered into the HKMA Register (at https://apps.hkma.gov.hk/eng/) before they engage in any new regulated activity. (f) RIs should inform relevant individuals that it is their responsibilities to act in compliance with the registered capacity as well as any conditions imposed by the Monetary Authority and / or the RI concerned. (g) RIs should arrange regular training to staff on the implications of unregistered dealing and the importance of compliance with the relevant legal requirements as well as internal control procedures in this regard. Disciplinary actions Disciplinary actions in respect of RIs, their relevant individuals and persons involved in the management of their regulated activities are set out in Part IX of the SFO and sections 58A and 71C of the BO. RIs should take steps to ensure that their relevant individuals fully understand the implications of non-compliance with the legal and regulatory requirements under the securities regime. Adequate training must be provided to them in order that they are aware of the range of formal sanctions that they may be subject to in case they breach the requirements, commit misconduct, or are otherwise found to be not fit and proper for engaging in regulated activities. Under section 71C(13) of the BO and section 193(2) of the SFO, where an RI is guilty of misconduct as a result of the commission of any conduct occurring with the consent or connivance of, or attributable to any neglect on the part of, an EO of the RI, the conduct will also be regarded as misconduct on the part of the EO and “guilty of misconduct” will be construed accordingly. It is essential for the senior management of RIs to draw to the attention of their relevant individuals and persons involved in the management of regulated activities that they shall be personally and legally liable to these disciplinary sanctions if they are found guilty of misconduct and / or considered to be not fit and proper.

1 Annex 3 Key examples of guidelines on registration and related matters Key examples of the existing applicable guidelines issued by the Hong Kong Monetary Authority (HKMA) and the Securities and Futures Commission (SFC) on registration and related matters relating to regulated activities under the Securities and Futures Ordinance include, but are not limited to, the following: • HKMA’s “Guide to Authorization” • HKMA’s Supervisory Policy Manual module SB-1 “Supervision of Regulated Activities of SFC-Registered Authorized Institutions” • HKMA’s circular dated 16 October 2017 on “Management Accountability at Registered Institutions” • SFC’s “Licensing Handbook” • SFC’s “Fit and Proper Guidelines” • SFC’s “Guidelines on Competence” • SFC’s “Guidelines on Continuous Professional Training”

1 Annex 4 Certain controls to ensure fitness and properness of potential employees (1) History of terminated employment – Authorized institutions (AIs) should perform stringent due diligence when they recruit employees to handle client assets and / or provide financial intermediary services1 . AIs should seek the potential employee’s specific confirmation on whether his / her employment has ever been terminated by any previous employer, and if so, the reason for the termination. If a candidate is found to have employment terminated by any previous employer, AIs should take all reasonable steps to obtain reference from the previous employer in relation to the terminated employment, and perform an assessment on the applicant’s fitness and properness for the particular capacity having regard to all relevant factors – including the reason for the termination of employment. (2) Convictions of offence – AIs should implement sufficient controls to ensure compliance with section 73(1)(b) of the Banking Ordinance (BO). This section prohibits any person who has been convicted in any place of an offence involving fraud or dishonesty, without the consent in writing of the Monetary Authority, from becoming an employee of an AI. It is important to note that this provision is applicable to convictions that have been spent by virtue of the Rehabilitation of Offenders Ordinance (Cap 297)2 . In this connection, before employing any person, AIs should seek the person’s specific confirmation on whether he / she has been convicted (including a conviction that has been spent under the Rehabilitation of Offenders Ordinance3 ) in any place of an offence involving fraud or dishonesty. If the person confirms that he / she has been so convicted, AIs should request the person to demonstrate that he / she has obtained the consent in writing of the Monetary Authority granted under section 73(1) of the BO. 1 The relevant potential employees include, but are not limited to, persons to be engaged by AIs as –

• tellers;
• relevant individuals / executive officers in the conduct of any regulated activity under the Securities and Futures Ordinance;
• technical representatives / responsible officers in the conduct of any regulated activity under the Insurance Ordinance; or
• subsidiary intermediaries / responsible officers in the conduct of any regulated activity under the Mandatory Provident Fund Schemes Ordinance. 2 Refer to section 4(1)(g) of the Rehabilitation of Offenders Ordinance. 3 According to section 4(2)(f) of the Rehabilitation of Offenders Ordinance, the protection of rehabilitated individual shall not apply to any question asked for the assessment of the suitability to act as the employees of AIs.

1 Annex 5 Previous guidance superseded Relevant guidance on registration and related matters previously issued by the Hong Kong Monetary Authority (HKMA) as set out in the following circulars are superseded by this circular: • HKMA’s circular dated 5 July 2002 on “Banking (Amendment) Ordinance 2002 and Securities and Futures Ordinance” • HKMA’s circular dated 12 September 2002 on “Register of relevant individuals to be maintained by the HKMA under the Banking (Amendment) Ordinance 2002” • HKMA’s circular dated 18 November 2002 on “Subsidiary legislation under the Securities and Futures Ordinance (SFO)” • HKMA’s circular dated 20 December 2002 on “Commencement of the Banking (Amendment) Ordinance 2002 (BAO 2002) and the Securities and Futures Ordinance (SFO)” • HKMA’s circular dated 27 February 2003 on “New securities supervisory regime Register to be maintained by the HKMA and Specific guidance in relation to relevant individuals” • HKMA’s circular dated 7 March 2003 on “Miscellaneous provisions of the Banking (Amendment) Ordinance 2002 (BAO 2002)” • HKMA’s circular dated 13 March 2003 on “Application for Registration by an Authorized Institution to become a Registered Institution under the Securities and Futures Ordinance” • HKMA’s circular dated 24 March 2003 on “Executive officers of registered institutions” • HKMA’s circular dated 21 February 2005 on “Register of Relevant Individuals under Section 20(1)(ea) of the Banking Ordinance (BO)” • HKMA’s circular dated 28 September 2006 on “Controls to ensure the fitness and propriety of staff of authorized institutions”

2 • HKMA’s circular dated 13 June 2007 on “Controls to ensure compliance with Section 114(3) of the Securities and Futures Ordinance (SFO) and Section 20(4) of the Banking Ordinance (BO)” • HKMA’s circular dated 12 March 2008 on “Thematic Examinations on Controls to Ensure Fitness and Propriety of Relevant Individuals” • HKMA’s circular dated 31 May 2019 on “Frequently Asked Questions issued by the Securities and Futures Commission (“SFC”) on disclosure of investigations commenced by licensed corporations in the notifications of cessation of accreditation (“the FAQ”)” • HKMA’s circular dated 12 January 2021 on “Revised Form for Application for Approval to become an Executive Officer of a Registered Institution under Section 71C of the Banking Ordinance”