Isolated complaint or systemic issue? Hong Kong Monetary Authority strengthens requirements for complaints handling and investigating control deficiencies to be implemented by 5 April 2023

What are authorised institutions (AIs) required to do when they receive a customer complaint? On 6 January 2023, the Hong Kong Monetary Authority (HKMA) issued its updated Supervisory Policy Manual (SPM) module IC-4 on complaints handling and redress. The updated IC-4 imposes new requirements on AIs under an enhanced complaints handling framework, in line with one of the priority areas – “Principle 12: Complaints Handling and Redress” – in the recently updated G20/OECD High-Level Principles on Financial Consumer Protection (High-Level Principles). The High-Level Principles are also included in the Compendium of Standards of the Financial Stability Board.¹

AIs are required to implement the updated SPM module by 5 April 2023.

The updated module IC-4 has been given an elevated status as a “statutory guideline” issued under section 7(3) of the Banking Ordinance. Although it does not have the force of law, it sets out the minimum standards which AIs are expected to comply with in order to satisfy the requirements under the Ordinance. It supersedes the previous “non-statutory guideline”, which was issued in February 2002 as a best practice guide setting out the HKMA’s recommendations to AIs in respect of the standards they should aim to achieve (see paragraph 3.2 of the HKMA’s SPM Introduction (version 1)).

The updated SPM module forms part of the HKMA’s overall initiative to promote a sound bank and customer-centric culture. The Hong Kong Securities and Futures Commission similarly issued a circular to licensed corporations on handling of client complaints (with appendix) in March 2022.

New regulatory requirements on AIs

The following is a high-level snapshot of the new requirements under the updated IC-4, which will be discussed in more detail in this briefing.

• Monitoring and addressing recurring or serious issues of concern and control deficiencies – Apart from handling complaints on a case-by-case basis, AIs are expected to have a parallel follow-up process to investigate issues of concern or control deficiencies identified when handling customer complaints, and to identify serious or recurring issues and/or systemic impacts. AIs should also be identifying possible regulatory breaches and/or misconduct during this process.
• Senior management accountability and oversight – Senior management is responsible for ensuring the effectiveness of the AI’s complaints handling and redress mechanisms. Emerging risks, possible regulatory breaches and/or misconduct, and concerns about an AI’s culture and conduct, identified during the complaint follow-up procedure, should be escalated to senior management and/or the board of directors, which should institute prompt remediation as appropriate.
• Accessible and affordable mechanism and alternate dispute resolution for monetary disputes – AIs’ complaints handling mechanisms should be transparent, accessible, and affordable. Where complaints involve monetary disputes, AIs are required to proactively make use of alternate dispute resolution channels (eg, the Hong Kong Financial Dispute Resolution Centre (FDRC)².

Effective complaints handling mechanism

The key elements of an effective complaints handling mechanism include (IC-4 2.1, 2.3-2.5):

Accessibility

• Information about the mechanisms should be clear, easily understood and available through a variety of channels.
• Staff should be trained so that they are able to answer general queries about the mechanisms.
• There should be no barriers (eg, imposition of a fee) to lodging complaints.
• Special assistance should be given to complainants experiencing vulnerability (eg, with disability or language problems).
• AIs should acknowledge receipt of complaints within 7 calendar days (IC-4 3.1.1).

Confidentiality

• The identity of the complainants should be protected and AIs should comply with the Personal Data (Privacy) Ordinance and any codes of practice issued by the Privacy Commissioner for Personal Data.

Objectivity and authority

• Complaints should be handled by staff who are competent to investigate the allegations or concerns raised and were not directly involved in the matter which is the subject of the complaint.
• An impartial approach should be adopted when following up on complaints.
• The follow-up should be a fact-finding process not affected by any undue influence.
• The findings and result of the handling of complaints should be supported by objective evidence as far as practicable to address the concerns of the complainants.

Affordability

• Affordability is a new element under the updated requirements.
• Where monetary disputes are involved, AIs should proactively consider subscribing to independent mediation and arbitration services such as those provided by the FDRC to resolve the matter with complainants in a fair manner (IC-4 1.1.4).

Customer redress and remediation

• If the AI considers that redress is appropriate, a fair compensation should be provided to the complainant – which may or may not involve a financial element (IC-4 2.7.1 and 2.7.2).
• Remedial actions should be taken to avoid recurrence of similar incidents (IC-4 2.9.2).
• If settlement cannot be reached on financial redress bilaterally, the AI should make sufficient efforts to invite the complainant to seek mediation and/or arbitration services (IC-4 2.7.3).
• AIs should also set service pledges for complaints handling and redress (IC-4 2.1.1).

Response to complainant and review mechanism

An AI’s response should include whether it:

• Accepts the matters complained (and offers redress where appropriate); or
• Offers redress without accepting the matters complained; or
• Rejects the matters complained and gives reasons for doing so.

If the complainant raises further enquiries and/or dissatisfaction about the complaint handling result, the AI concerned should review the complainant’s enquiries to see if there is new objective information to support the allegation(s) and provide further response to the complainant within a reasonable time (IC-4 2.8).

AIs should record and retain details of complaints, including anonymous complaints, for a minimum period of two years from the date of their receipt. Details to be recorded should include, where applicable, follow-up including investigation process (IC-4 4).

Monitoring and addressing recurring or serious issues of concern and control deficiencies

• AIs are expected to have parallel processes of: (i) complaint handling; and (ii) following up on issues of concerns or control deficiencies as identified during the complaint handling (IC-4 1.2.5).
• The purpose of having parallel processes is to ensure that systemic or recurring issues are identified and resolved, to strengthen customer protection and enhance overall consumer experience (IC-4 1.1.1 and 2.2.5).
• In the following up process, AIs are expected to identify possible misconduct, internal control weaknesses, emerging operational and reputational risks, and concerns about the AI’s culture and conduct. They should also take prompt remedial actions (IC-4 1.2.2, 2.2.5 and 2.11.3).
• The complaints handling staff should keep themselves abreast of the latest regulatory requirements and be capable of identifying possible regulatory breach and misconduct during the follow-up including investigation process. Where necessary, assistance from the Compliance or other relevant function(s) of the AI should be sought (IC-4 2.6.4).
• In formulating practical procedures for: (i) complaint handling; and (ii) following up on issues, AIs should keep up to date of the latest international standards and take into account guidance provided by the HKMA, including IC-4, from time to time, as well as relevant principles and provisions of the Treat Customers Fairly Charter and the Code of Banking Practice (IC-4 2.2.1).
• There should be appropriate integration of the complaint handling and redress mechanisms with the AI’s business operations as well as other risk management and control systems (IC-4 2.2.3).

Senior management accountability and oversight

Senior management of AIs should be responsible for ensuring (IC-4 2.11.2):

• The effectiveness of the complaints handling and redress mechanisms;
• Deficiencies identified are promptly and properly rectified;
• Sufficient resources are allocated to the complaints handling function;
• Issues identified in the audits of the complaints handling and redress mechanisms or other independent reviews are followed up appropriately;
• Enhancements to the mechanisms are put in place when warranted, taking into account latest developments in the scale and scope of products or services offered, the regulatory landscape and technological innovations; and
• Prompt reporting to the board of directors regarding any concerns about the AI’s culture and conduct, and prompt enhancement or remediation as appropriate.

Other issues of note

Partnering with service providers (IC-4 2.2.2)

• The conduct expected of business partners and/or service providers engaged by AIs for the provision of services or products should be clearly set out in the relevant service agreements.
• Where there are complaints concerning the services and/or products provided by their business partners or service providers, AIs should have appropriate arrangements with these parties and inform customers of such arrangements to ensure that complaints are properly dealt with.
• Customers should be informed of such arrangements.
• AIs may need to consider amending existing service agreements and to set up new complaint handling arrangements with their business partners and service providers.

Reporting of potential breaches

• Where there is possible regulatory breach and/or misconduct identified during follow-up including investigation of a complaint, escalation to senior management and self-reporting to the HKMA or other regulators should be made as soon as reasonably practicable (IC-4 2.9.1).

Time limits for handling complaints

• The updated requirements provide additional clarity that the timeframe for complaints handling is based on calendar days, eg, the timeframe for acknowledging receipt of a complaint is 7 calendar days (IC-4 3.1.1).
• If an AI’s previous complaint handling policy made reference to business days, then the AI should align its procedure with the updated requirements.

Handling whistleblowing reports

• Although there are currently no statutory protections for whistleblowers in Hong Kong, AIs are required to take appropriate steps to handle anonymous complaints, or whistleblowing reports, albeit not being able to issue written acknowledgement or reply to the complainants. Even if a complaint is anonymous, as with other complaints, any issues alleged by the complainant and substantiated after investigation should be rectified as soon as practicable (IC-4 2.2.6).
• Such reports may contain useful intelligence allowing AIs to identify possible misconduct or internal control weaknesses (IC-4 1.2.2).
• We note that the HKMA has also set out requirements for the handling of whistleblower reports by AIs in the HKMA Circular entitled “Bank Culture Reform” dated 2 March 2017.

How we can help

With the deadline of 5 April 2023 in mind, we can assist in the following ways:

• Review, design or update internal complaints handling and investigation policies and procedures and service agreements with AIs’ business partners;
• Assist in the investigation of customer complaints;
• Prepare documentation required for the complaint handling process, such as follow-up replies, requests for clarification, further information or supporting documents to assist in the investigation;
• Assist in conducting follow-up investigations on issues or areas of concern identified during the complaint handling process;
• Conduct comprehensive training on the handling of complaints and whistleblower reports;
• Provide briefings on the latest regulatory requirements and developments in the regulatory landscape that may warrant enhancement of the complaints handling mechanism; and
• Advise on self-reporting obligations.

If you have any questions or are interested to know more about how we can assist, please contact any of our representatives below.

____________

¹ The HKMA is a member of the Financial Stability Board Consultative Group and the Task Force on Financial Consumer Protection of the OECD.

² The FDRC was established in 2011 to administer an independent and impartial financial dispute resolution scheme for resolving monetary disputes with financial institutions, which has since implemented a range of reforms in relation to such claims (see our September 2017 briefing).