Hong Kong: amended SFC self-reporting requirements to come into force 1 December 2012

The Hong Kong Securities and Futures Commission (SFC) has confirmed its intention to extend the scope of the existing self-reporting requirement under paragraph 12.5 of the Code of Conduct to include any suspected material breach, infringement or non-compliance with the civil or criminal market misconduct provisions of the Securities and Futures Ordinance by clients of licensed and registered persons.  Firms will wish to review their internal controls to ensure compliance with this enhanced requirement, and with other miscellaneous amendments, including restrictions on the use of mobile phones in certain circumstances and extended telephone recording retention requirements.

In November 2010, the SFC published its "Consultation paper on proposals to amend the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission in relation to the establishment of the Financial Dispute Resolution Centre Ltd and the enhancement of the regulatory framework" (Consultation).  The Financial Dispute Resolution Centre Ltd (FDRC) is aimed at helping customers resolve monetary disputes with financial institutions involving HK$500,000 or less.

The SFC's two-month consultation on the amendments to the Code of Conduct to enhance the regulatory framework and facilitate the establishment of the FDRC ended in January 2012.  The SFC recently published its consultation conclusions (Consultation Conclusions) setting out the proposed amendments.

FDRC

Four specific amendments to the Code of Conduct relate to the establishment of the FDRC :

• the inclusion of a provision obliging licensees to participate in the FDRC process;
• enhancement of the complaints handling procedures in paragraph 12.3 of the Code;
• enhancement of the reporting obligations in paragraph 12.5 of the Code; and
• the inclusion of a "full and frank disclosure" provision in dealing with the FDRC.

These provisions will come into effect on 19 June 2012. 

Extension of the self-reporting requirement

Separately to the establishment of the FDRC, the SFC proposed a number of miscellaneous amendments to the Code of Conduct, including an extension of the existing self-reporting requirement under paragraph 12.5.  The existing self-reporting requirement provides that a licensed or registered person, as a firm, should immediately report to the SFC any actual or suspected material breach, infringement or non-compliance with, amongst others, law, rules, regulations and codes administered or issued by the SFC (whether by themselves or their employees), and to give relevant information and documents. In the Consultation, the SFC proposed to extend the requirement to include any actual or suspected material breach, infringement or non-compliance with, amongst others, law, rules, regulations and codes administered or issued by the SFC by clients of the licensed corporation or registered institution.

Most of the respondents to the Consultation objected to the proposed extension of the self-reporting requirement.  Concerns were, for example, raised about potential conflicts with the duty of confidentiality to clients and potentially exposing licensed corporations and registered institutions to possible liability to clients that might arise as a result of filing such self-reports.  The SFC, in its Consultation Conclusions, considered these concerns to be misplaced.  It considers that the law is clear that the duty of confidentiality can be overridden in various situations including where a firm may have an obligation to disclose information to the proper authorities in the public interest.

Respondents also commented that the proposed reporting obligations were too broad.  In response, the SFC has, in its Consultation Conclusions, limited the scope of the extension of the self-reporting requirement.  The SFC will now introduce a new paragraph 12.5(f) to require a licensed or registered person, as a firm, immediately to report to the SFC where there is "any material breach, infringement or non-compliance of market misconduct provisions set out in Part XIII or Part XIV of the Securities and Futures Ordinance that it reasonably suspects may have been committed by its client, giving particulars of the suspected breach, infringement or non-compliance and relevant information and documents".  The amendments to the self-reporting requirement will come into effect on 1 December 2012.

In its Consultation Conclusions, the SFC has made various clarifications to address respondents' concerns in relation to compliance with the extended requirement.  The SFC has clarified, for example, that it does not require firms to conduct any investigation or make any decision on whether a client has been guilty of misconduct.  Instead, firms will be required to report the facts or matters indicating that a client might be guilty of misconduct (e.g. credible information from a third party which suggests that a breach or suspected breach has occurred).  There is no duty to make a report based on unsupported speculation or vexatious comments.

At present, firms have a statutory obligation under Hong Kong's money laundering legislation to report certain types of suspicious transactions to the Joint Financial Intelligence Unit (JFIU).  As set out in the Consultation Conclusions, the SFC expects a report to the SFC and the JFIU to be made concurrently if the matter is within the jurisdiction of both.  Contrary to concerns expressed by some respondents, the SFC considers that a concurrent report would not give rise to the criminal offence of "tipping-off" under the relevant money laundering legislation as it is a defence to prove that "he did not know or suspect the disclosure concerned was likely to be prejudicial… or that he had lawful authority or reasonable excuse for making that disclosure."  Nonetheless, the SFC expects firms to take care to avoid committing the "tipping-off" offence.

Importantly, the SFC has indicated that an investor in a fund would be regarded as a "client" of fund managers for the purpose of the extended self-reporting requirement.

Other proposed changes

Other amendments to the Code include:

• a ban on the use of mobile phones for accepting client orders in certain circumstances
• the extension of the minimum telephone recording retention period from at least three to six months
• a requirement to accept orders placed by a third party for a client's account only with the client's written authority, and
• a requirement not to prohibit employees from performing expert witness services for the SFC or the Hong Kong Monetary Authority (without reasonable excuse). 

These changes, and the self-reporting requirement, will come into effect on 1 December 2012.

Comment

In anticipation of the extended self-reporting requirement coming into effect on 1 December 2012, firms will need to ensure that frontline staff are properly trained to monitor their clients' activities to ensure that compliance concerns are escalated promptly where appropriate, and that existing internal controls are sufficiently robust to ensure that any apparent "red flags" which might give rise to a reporting obligation under the extended self-reporting requirement are appropriately identified and acted upon.  Firms may also wish to consider the way in which those internal controls will interact with the firm's existing escalation procedures for reporting suspicious transactions to the JFIU.

The SFC has noted in its Consultation Conclusions that it considers the requirement for firms to report suspected client market misconduct to the SFC as a very important measure to maintain the integrity of the market. The SFC's Executive Director of Enforcement, Mr Mark Steward stressed the importance of timely self-reporting in a recent enforcement case:

"Intermediaries know they have a duty to report misconduct to the SFC immediately upon discovery, not when they have plumbed to the bottom of it.  Delay in reporting simply helps the wrongdoer.  This public reprimand should make it clear that the SFC condemns such delay in the strongest terms."

The case illustrates the regulator's tough stance in enforcing the self-reporting obligation.