Disclosure of internal investigations – the Hong Kong SFC’s FAQs fail to relieve industry concerns

The Hong Kong Securities and Futures Commission (SFC) has released frequently-asked questions (FAQs) to clarify its Internal Investigation Disclosure Obligation – a measure introduced in February 2019 to stop the “roll” of “bad apples” within the financial industry.

The Obligation requires licensed corporations (LCs) and registered institutions (RIs) to provide the SFC with extra information about the circumstances of any licensed employee’s departure. This includes whether the individual was subject to an internal investigation in the six months prior to their departure.

The FAQs cover:

• what must be reported under the Obligation;
• the level of detail required for an Internal Investigation Disclosure; and
• how the SFC will treat the confidentiality of information reported under the Obligation.

While the aims of the Obligation and the clarity provided by the new FAQs are generally welcomed by the industry, serious concerns remain about the practicalities of implementation by firms and the usefulness of the disclosed information to the SFC.

We have been following the developments of the Obligation since its introduction in February and have been part of the industry discussion on this new requirement led by the Asia Securities Industry & Financial Markets Association (ASIFMA). 

BACKGROUND

SUMMARY OF THE SFC’S FAQS

CHALLENGES

CONCLUSION
 

BACKGROUND

On 20 April 2018, the Financial Stability Board (FSB) released its regulatory toolkit for misconduct risk. Amongst its aims, the FSB encouraged regulators to do more to prevent individuals who engage in misconduct moving between financial institutions without their misconduct being disclosed to their new employer (for further details, please see our April 2018 bulletin).

On 1 February 2019, the SFC announced significant changes to its licensing forms and processes. Included in these changes was the introduction of the new compulsory Internal Investigation Disclosure Obligation through the new Form 5U, which came into effect on 11 April 2019.

Specifically, under the new Form 5U, firms need to:

• identify whether departing licensed representatives, responsible officers and executive officers (outgoing employees) were the subject of an internal investigation in the six months prior to their departure;
• provide details of this investigation if such details have not previously been provided to the SFC; and

notify the SFC as soon as practicable if an internal investigation into that individual is commenced after making the initial notification of cessation.

SUMMARY OF THE SFC’S FAQS

Apart from providing an introduction and explaining the purpose of the new Obligation, the SFC has clarified various key aspects of this new requirement, including:

• the scope of reportable investigations;
• the level of detail required for disclosures; and
• the confidentiality applied to any disclosures made.

Scope of reportable investigations

The SFC acknowledges that firms may adopt different terms, such as checking, inquiry, enquiry, review, examination, inspection or investigation, in respect of their investigative actions. However, the SFC has made it clear that it expects firms to proactively disclose information about all “investigative actions” (no matter how they are described), regardless of whether the subject matter covers regulated or unregulated activities.

The SFC has further provided a non-exhaustive list of examples of investigations involving an outgoing employee that should be reported:

• investigations about suspected or actual breaches of applicable laws, rules and regulations;
• investigations about suspected or actual breaches of a firm’s internal policies or procedures;
• investigations about misconduct that is likely to give rise to concerns about the fitness and properness of an outgoing employee;
• investigations about any matter that may have an adverse market or client impact; and
• investigations about any matter potentially involving fraud, dishonesty and misfeasance.

In addition, the SFC has clarified that, even where a firm has completed its investigation and made no negative findings against an outgoing employee, the firm will still be required to notify the SFC of the investigation. However, in such situations, only a brief description of the nature of the matter and an explanation about the basis of conclusion will be required.

Whilst it was understood that a firm had to disclose any investigations that began after the departure of its outgoing employee as soon as practicable, the SFC has further clarified that such investigations must be disclosed regardless of the length of time that has elapsed since the outgoing employee left the firm, i.e. there is no time limit on the on-going requirement.

Level of detail required for disclosures

Broadly speaking, firms should disclose information that they can lawfully disclose to the SFC for its thorough understanding of the subject matter of an investigation.

Generally, firms should include in their disclosures:

• the nature and background of the matter;
• the date(s) when the matter occurred;
• the duration of the matter;
• the role played by the outgoing employee in the matter;
• the actual and/or potential impact to the market and client(s) and assessment of materiality;
• the status of the investigation; and
• the outcome of the investigation and basis of its conclusion (if the investigation is complete).

Where there are any developments such as new information or updates on the status of an investigation that has already been disclosed to the SFC, firms should provide such information to the SFC as soon as practicable, irrespective of whether the investigation had previously been concluded.

Confidentiality applied to any disclosures made

The SFC has reiterated its statutory obligation under section 378 of the Securities and Futures Ordinance (SFO) to preserve secrecy in respect of information obtained during the performance of its regulatory functions including disclosures made to the SFC under the new Obligation and will treat such information as confidential.

In particular, the SFC will not disclose information obtained under the new Obligation to any other persons, including the outgoing employee and his/her prospective employer unless otherwise permitted by law.

CHALLENGES

Won’t this be a heavy administrative and logistical burden on firms?

The SFC has made clear that no materiality threshold will apply to exclude investigations that are of minimal significance and/or impact to the market and client(s) from the Obligation.

The scope of reportable investigations is therefore very wide given that any and all potentially wrongful acts committed by an outgoing employee could trigger the Obligation regardless of the eventual outcome of investigations.

The administrative and logistical burden therefore imposed on firms raises issues as to the practicality of implementing the requirement properly, especially for smaller firms in Hong Kong with limited resources.

How should firms navigate the potential pitfalls as to conflicts with other laws and regulations?

Whilst the SFC has clarified that disclosures need only be made where the same would be lawful, no further guidance has been published on how this would work in practice.

As such, firms will likely have to consider each reportable investigation on a case-by-case basis and decide whether a disclosure may breach any laws or regulations, e.g. relating to personal privacy, data privacy or employment, in turn increasing the burden on firms to ensure compliance.

What is the utility of collecting so much information and won’t this cause undue delays in the licensing process?

The information collected through the disclosures could potentially assist the SFC in considering whether an individual is a fit and proper person to remain licensed under the SFO.

However, the catch-all nature of the Obligation raises questions as to the utility of this information if the SFC is flooded with disclosure reports that are not relevant for these purposes. It also raises concerns as to the length of time required by the SFC to complete the licensing process in circumstances where a disclosure has been made on Form 5U.

CONCLUSION

The new Internal Investigation Disclosure Obligation is a significant enhancement of the prior notification requirements. It is clearly the intention of the SFC to ensure that individuals will no longer be permitted to escape regulatory scrutiny by simply resigning during the course of an investigation.

Whilst the enhanced Obligation, which forms part of a broader focus by the SFC on individuals’ fitness and properness, is generally welcomed by industry participants, serious concerns remain about the practicalities and challenges of implementation, as well as the scale and usefulness of the information to be disclosed to the SFC.