Briefing

March 02 2021

Hong Kong regulatory enforcement trends – annual review and look ahead

Enforcement in 2020 was affected by the Covid-19 pandemic in a variety of ways. Regulatees were expected to do whatever they reasonably could to maintain "business as usual", and to continue to comply with their regulatory obligations¹. The Securities and Futures Commission (SFC) vowed to do everything that it reasonably could to keep Hong Kong’s markets open for business². Nevertheless, it was perhaps inevitable that we would see some delay to parts of the regulatory agenda³. The level of SFC enforcement outcomes also showed a downward trend. We analyse this below (see Tables 1 and 2). On the other hand, Hong Kong’s regulators accelerated their efforts in several key areas, partly driven by pre-existing regulatory policies, and partly in response to market developments closely linked to the pandemic. AML, regulation of virtual assets, and the use, storage and surveillance of data have all been key areas of focus.

In the field of AML, in addition to a stream of enforcement actions during the year (including a record-breaking HK$2.71 billion fine on a global bank⁴), regulators helped to guide the market with best practices and supervisory guidance in light of various AML challenges specifically brought about by the pandemic.

Data was another regulatory focus area, with both the SFC and the Hong Kong Monetary Authority (HKMA) continuing to refine their supervisory approach to data ethics, data processing, data storage, cybersecurity, and the use of regtech to meet regulatory obligations and suptech to monitor regulated entities.

The regulators’ “staple diet”, including market misconduct, IPO sponsor failures, and senior management accountability, all remained targets. The SFC reorganised its market surveillance and investigation functions and established a Market Misconduct Team to target complex and sophisticated market misconduct schemes⁵. Meanwhile, in the insurance space, the Insurance Authority (IA) continued to build a head of steam after taking over direct regulation of insurance intermediaries in September 2019. We explore some of these themes later in this briefing.

On a broader policy level, the focus has been one of balance for Hong Kong’s regulators. While various measures were introduced to allow firms slightly greater flexibility to remain compliant given the challenges posed by the pandemic, social unrest and geopolitical tensions, regulators have been focused on the importance of upholding the usual conduct and prudential standards and, in turn, market integrity. As the SFC’s CEO, Ashley Alder, put it at the 2020 Compliance Forum, “the fundamentals have not changed in any way, and that our stance as the regulator of Hong Kong’s capital markets remains the same”⁶ – but was this approach reflected in the actual levels of enforcement in 2020?

While one might expect that the SFC’s activities would have slowed down because of Covid and the recalibration of operational arrangements, the annualised figures would suggest that it was largely business as usual for the SFC in terms of investigating new potential infractions. Both the number of inquiries ⁷ and formal investigations commenced were on par with 2019 figures. However, enforcement outcomes (i.e. the number of Notices of Proposed Disciplinary Action and Notices of Decision issued), show a downward trend which, when viewed with the fluctuating figures in recent years, would appear to be in line with the fact that investigations take time to conclude. Interestingly, the SFC also reported in its October – December 2020 quarterly report⁸ that it had conducted 74 inspections (both remote and on-site) of intermediaries during Q4 2020 alone, whilst there was a slight 2.6% year-on-year decrease in the number of inspections during the nine months ended 31 December 2020. That confirms the SFC’s business as usual approach, even where remote inspections might be required.

As for financial penalties in 2020, after the one blockbuster fine is excluded, the total fines imposed in 2019 (largely due to IPO sponsor cases) exceeded those in 2020 by more than ten times.

AML – a busy year of enforcement and supervisory guidance

Following on from its work in 2019, the SFC took further action against licensed firms⁹ and their senior management¹⁰  in 2020 for failures to comply with AML requirements, with a continued focus on third party fund flows¹¹.

The SFC and the HKMA also sought to fine-tune the AML regulatory framework. Shortly before the SFC closed its consultation on updating its AML/CFT Guidelines¹² to further align them with the latest Financial Action Task Force standards and to reflect evolving transaction methods and money laundering trends, it shared its observations¹³ from recent inspections focused on AML/CFT policies, procedures and controls. While the critical areas on which the SFC remained focused were familiar (i.e. procedures and oversight, staff training and escalation channels, ongoing monitoring of changes to risk factors/levels, and potential issues posed by third-party fund flows), the SFC also emphasised that senior management, including the AML/CFT Manager-in-Charge, bear primary and personal responsibility for ensuring their firms’ compliance. In 2021, we expect more granular guidance on risk assessment and customer due diligence (CDD), including in the context of cross-border correspondent relationships, and further regulatory scrutiny.

The HKMA closely monitored the AML/CFT measures that banks adopted to meet various challenges arising from the pandemic, and shared with the industry best practices¹⁴ in areas including CDD, resource optimisation, responding to changing customer behaviour and the corresponding financial crime risks, as well as the application of regtech to banks’ AML/CFT efforts¹⁵. The HKMA also issued guidance¹⁶ on appropriately calibrated processes for remote client onboarding, an ongoing hot topic for banks.

Tech and data – benefitting supervision and compliance

While developments in fintech, regtech, and data practices have undergone rapid transformations over the past several years, the pandemic has confirmed the critical importance of technology and data to the resilience of firms and market infrastructures alike.

Since publication of its 2019 Circular¹⁷ on the use of external electronic data storage, the SFC has been in close dialogue with the industry about implementation challenges. In December 2020, a welcome set of FAQs¹⁸ was released to offer further clarification. The FAQs offer Licensed Corporations (LCs) greater flexibility to satisfy the Circular’s requirements, and that in turn allows firms to better leverage efficiencies offered by cloud storage and related technologies. The guidance now also applies to affiliates where they hold regulatory records. The key aim is to secure the SFC’s ability to gain prompt access to reliable and complete regulatory records. Now that the requirements appear to be settled, LCs should review as soon as practicable their internal governance, policies and procedures, as well as those of their data storage providers, to ensure that they can satisfy future data requests from the SFC¹⁹. In a similar vein, the SFC is currently consulting on an investor identification regime²⁰ for the securities market, which would allow the SFC to collect information on the identity of each trade originator. If and when implemented, this regime would facilitate more timely and effective market surveillance, and reduce firms’ ongoing compliance costs in dealing with SFC enquiries.

Another tech-focused development that is likely to lead to heightened regulatory scrutiny is the proposal to bring all virtual asset trading platforms operating in Hong Kong under the SFC’s purview²¹. Once implemented (which we think is likely in 2021, even though the consultation conclusions remain pending at the time of writing), the new mandatory licensing regime would run alongside the current SFC opt-in framework²². For platforms that have so far remained unregulated, 2021 will see them grapple with questions such as “how should I structure my business such that I can secure an SFC licence?”, and “should I opt-in now for more certainty before the proposed regime comes into force?”. For platforms with a retail focus, an important strategic decision may be pressing: “should I change the business to focus on professional investors? Or should I simply exit the Hong Kong market?”.²³

Aside from refining the relevant regulatory requirements, Hong Kong’s regulators have also focused on upgrading their in-house technological capabilities. The SFC highlighted in their 2019/2020 annual report²⁴ that an internal data analytics platform was being developed to automate the analysis of trading data when inspecting large securities brokers. There are also plans to leverage more AI technology to bolster the regulator’s automatic risk detection and market monitoring capabilities, something that appears to be having some impact on the assessment of Business Risk Management Questionnaires submitted to the SFC. Similarly, the HKMA aims to become a more data-driven regulator, and is increasingly relying on the use of suptech including automated supervisory processes, data science, and network analytics to help identify emerging risks and trends²⁵, including AML-related risks²⁶. The HKMA is also seeking to collect richer data from banks that might support the analysis of interconnectedness, concentration and distribution of risks in the financial system. This could have the potential to replace many template-based regulatory reports and reduce compliance burden on banks.

Conduct, culture and competency

It is perhaps timely that the HKMA proposed in 2020 measures to address the “rolling bad apples” phenomenon, while both the HKMA²⁷ and the SFC²⁸ continue to look for ways to enhance the competency framework for regulated individuals. After all, the “new normal” of remote working, reduced physical oversight and face-to-face interaction (both within a business and between a business and its customers), plus pressure on both businesses and their employees to meet financial targets amid challenging market conditions, may all contribute to a weakening of corporate culture and increased incidents of misconduct²⁹. The issues that the HKMA is seeking to tackle via its consultation proposals³⁰ are not new to regulators – the SFC addressed its concerns about “rolling bad apples” when it introduced its strategic licensing reforms in 2019 against a backdrop of rising numbers of SFC licence applications and increasing mobility in the financial industry. Likewise, a paper³¹ published by the Financial Stability Board in 2018 explored ways in which firms and regulators might tackle this phenomenon. Nevertheless, the HKMA proposals complement its existing management accountability regime, and in light of its findings in its Report on Review of Self-assessments on Bank Culture³², banks are expected to make greater effort to foster sound internal culture. Culture and accountability remain high on the HKMA’s supervisory agenda.

Insurance Authority – enforcement toolkit ready to be deployed

Since taking over the direct supervision of insurance intermediaries in 2019, the IA has ramped up its preparatory efforts and issued in 2020 several consultations and new guidance that offer insights into its likely direction when regulating and developing Hong Kong’s insurance industry. Of particular interest are the proposals on group capital rules³³, which will help to facilitate the IA’s group-wide regulation of insurance companies.

The IA has also been putting the finishing touches to its enforcement toolkit by publishing an overview of its disciplinary process³⁴, and has established the new Disciplinary Panel Pool³⁵, as well as an Expert Advisor Panel³⁶ which will act as a source of technical advice and market intelligence. Much like its supervisory and enforcement powers in the Insurance Ordinance, the IA’s disciplinary process bears much similarity to the SFC’s disciplinary process, perhaps reflecting the IA’s team heritage. Now that the various components of the IA’s enforcement process have been put in place, we can expect more investigations and enforcement actions to come through the pipeline this year³⁷.

The IA’s new periodic update “Conduct in Focus” offers further illustration of its regulatory approach and the topical issues facing the industry. The inaugural issue³⁸ reports that of all the complaints that the IA received during the year since the new regulatory regime for insurance intermediaries came into operation, 30% related to conduct issues. Again, similar to the SFC, the IA follows a multi-pronged regulatory approach, and will deploy “alternative tools” such as compliance advice letters or letters of concern in order to drive improvements to firms’ compliance and culture. It is also worth noting that the IA set out in the newsletter a roadmap for building a “high integrity culture”, attesting to the IA’s focus on sound culture within insurance businesses.

What might be on the horizon?

Focus on risk management

The SFC commenced a variety of thematic reviews and surveys in 2020, many of which were driven by the increasingly complex and cross-border nature of financial services businesses and the inherent risks in them. These include:

• a joint review with the HKMA of spread charging practices, disclosure of trading capacity and monetary benefits, and management oversight of distributions of non-exchange traded investment products. The SFC made clear in a disciplinary action in late 2019³⁹ that charging practices and conflicts of interest are particular matters of focus; and
• a thematic review focusing on operational and data risks and firms’ remote booking models. The SFC has been collaborating with local and overseas regulators to inspect institutional risk management practices for remote booking and transfer pricing.

Other projects in the pipeline might also inform future regulatory guidance and help set enforcement priorities. The SFC has most recently commenced a consultation⁴⁰ which builds on the findings of its inspection of bookbuilding and placing activities of institutions involved in capital markets fundraising, which proposes conduct requirements for market participants who engage in such activities as well as a “sponsor coupling” proposal. The funds industry is also likely to come under increased scrutiny. As the SFC highlighted in its Compliance Bulletin⁴¹, market volatility and persisting economic uncertainty means prudent liquidity risk management is more critical than ever, and the SFC might well inquire into group liquidity profiles and identify potential problems for early supervisory action.

Cross-border/cross-agency collaboration

The SFC continues to foster closer working relationships with its counterparts, both locally and overseas. With the further expansion of the Stock Connect scheme⁴², growth of the Mainland China bond market’s investor base via Bond Connect⁴³, and the launch of the Wealth Management Connect pilot⁴⁴, cross-border market activities and capital flows are set to rise, necessitating more information sharing and investigative cooperation between Hong Kong and mainland Chinese regulators.

The SFC also appears to be broadening its regulatory focus to new areas, including competition issues in the securities markets, in light of the new Memorandum of Understanding between the SFC and the Hong Kong Competition Commission⁴⁵, while it establishes new cooperation arrangements with the IA in light of the new regulatory regime for the Hong Kong insurance industry⁴⁶. The market can expect more case referrals and joint investigations involving multiple regulators.

Institutionalising sustainability factors

ESG and broader sustainability-related developments have gathered pace around the world in recent years. The message from regulators is clear: sustainability is no longer a “nice-to-have”; it is both a risk and a responsibility. In Hong Kong, we have witnessed initiatives from individual regulators as well as cross-agency collaboration, with the Green and Sustainable Finance Cross-Agency Steering Group being the most ambitious example of government authorities and regulators collaborating and coordinating management of climate and environmental risks to the financial sector. For the SFC and the HKMA, the emphasis is on self-assessment, disclosure and risk management, with the HKMA having set out in a White Paper⁴⁷ its initial thinking on the appropriate supervisory approach to address climate-related issues, to be followed by formal consultation this year. The SFC is seeking to introduce a regulatory requirement where fund managers must consider and disclose climate risks as part of their investment and risk management processes⁴⁸, so we can expect related supervisory and enforcement efforts to follow.

Offshore services into Hong Kong

Finally, as the last batch of private equity and family offices conclude their licensing updates, and the SFC considers the new online channels for offering products and services into Hong Kong without being physically present, we can also expect to see greater scrutiny from the SFC on the conduct of regulated activities. This will be particularly acute for those businesses which are currently not licensed and engage with Hong Kong customers from offshore while hoping to stay under the SFC’s radar.

¹ https://www.sfc.hk/en/Information-for-firms-and-the-market-on-COVID-19
² https://apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announcements/news/doc?refNo=20PR35
³ https://apps.sfc.hk/edistributionWeb/gateway/EN/circular/intermediaries/supervision/doc?refNo=20EC26
⁴ https://apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announcements/news/enforcement-news/doc?refNo=20PR103
⁵ https://www.sfc.hk/-/media/files/ER/Annual-Report/2019-20/EN/SFC-Annual-Report-2019-20_EN.pdf ⁶ https://www.sfc.hk/-/media/EN/files/ER/PDF/CEO_Speech_SFC_Compliance_Forum_Oct2020.pdf
⁷ Under sections 179 and 181 of the Securities and Futures Ordinance
⁸ https://www.sfc.hk/-/media/EN/files/ER/Reports/QR/202010-12/0-SFC-Quarterly-Report-OctoberDecember-2020E.pdf
⁹ https://apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announcements/news/enforcement-news/doc?refNo=20PR45; https://apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announcements/news/enforcement-news/doc?refNo=20PR58
¹⁰ https://apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announcements/news/enforcement-news/doc?refNo=20PR57
¹¹ See also the 2019 SFC guidance where firms were urged to implement control measures to mitigate risks arising from third-party deposits and payments: https://apps.sfc.hk/edistributionWeb/gateway/EN/circular/aml/doc?refNo=19EC39
¹² https://apps.sfc.hk/edistributionWeb/api/consultation/openFile?lang=EN&refNo=20CP4
¹³ https://apps.sfc.hk/edistributionWeb/gateway/EN/circular/aml/doc?refNo=20EC73
¹⁴ https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and-circular/2020/20200730e1.pdf
¹⁵ https://www.hkma.gov.hk/eng/news-and-media/press-releases/2021/01/20210121-3/
¹⁶ https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and-circular/2020/20200924e1.pdf ¹⁷ https://apps.sfc.hk/edistributionWeb/gateway/EN/circular/intermediaries/supervision/doc?refNo=19EC59
¹⁸ https://www.sfc.hk/en/faqs/intermediaries/supervision/Use-of-External-Electronic-Data-Storage/Use-of-External-Electronic-Data-Storage#A59D7A4064EF4DE290027E82B523EEC4
¹⁹ See our client briefing: http://knowledge.freshfields.com/en/Global/r/4376/an_ascent_to_the_cloud__sfc_updates_electronic_data
²⁰ https://apps.sfc.hk/edistributionWeb/api/consultation/openFile?lang=EN&refNo=20CP7
²¹ https://www.fstb.gov.hk/fsb/ppr/consult/consult_amlo.htm
²² Under which the first virtual asset trading platform has been licensed: https://apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announcements/news/doc?refNo=20PR127
²³ See our blog post for further analysis of the proposed licensing regime: https://digital.freshfields.com/post/102gjzt/proposal-for-mandatory-sfc-licence-for-all-virtual-asset-trading-platforms
²⁴ https://www.sfc.hk/-/media/files/ER/Annual-Report/2019-20/EN/SFC-Annual-Report-2019-20_EN.pdf
²⁵ https://www.hkma.gov.hk/media/eng/publication-and-research/annual-report/2019/AR2019_E.pdf
²⁶ https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and-circular/2020/20200929e1a1.pdf
²⁷ Enhanced competency framework on operational risk management: https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and-circular/2020/20201218e2.pdf
²⁸ Consultation on proposed enhancements to the competency framework for intermediaries and individual practitioners: https://apps.sfc.hk/edistributionWeb/gateway/EN/consultation/openFile?refNo=20CP8
²⁹ For example, the SFC has reported an over 44% year-on-year rise in the number of complaints made against SFC licensees in its October – December 2020 quarterly report

³⁰ Consultation paper on implementation of mandatory reference checking scheme to address the “rolling bad apples” phenomenon: https://www.hkma.gov.hk/media/eng/regulatory-resources/consultations/Enclosure_20200508.pdf

³¹ “Strengthening Governance Frameworks to Mitigate Misconduct Risk: A Toolkit for Firms and Supervisors”: https://www.fsb.org/wp-content/uploads/P200418.pdf
³² https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and-circular/2020/20200522e1a1.pdf ³³ https://www.ia.org.hk/en/infocenter/files/Consultation_Conclusions_Draft_Insurance_GC_Rules_Eng.pdf ³⁴ https://www.ia.org.hk/en/enforcement/lii/files/Overview_of_Disciplinary_Process_en.pdf
³⁵ https://www.ia.org.hk/en/infocenter/press_releases/20201030.html
³⁶ https://www.ia.org.hk/en/enforcement/Expert_Advisor_Panel.html
³⁷ In fact, the IA has reported in the first issue of “Conduct in Focus” that between September 2019 and September 2020, 37 investigations had been commenced under the Insurance Ordinance, and around 30% of cases transferred from the self-regulatory organisations were yet to be resolved
³⁸ https://www.ia.org.hk/en/infocenter/files/Conduct_In_Focus_English.pdf
³⁹ https://apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announcements/news/enforcement-news/doc?refNo=19PR111 
⁴⁰https://apps.sfc.hk/edistributionWeb/api/consultation/openFile?lang=EN&refNo=21CP1
⁴¹ https://www.sfc.hk/-/media/EN/files/ER/English-Bulletin.pdf
⁴² https://www.hkex.com.hk/news/news-release/2021/210122news?sc_lang=en
⁴³ https://www.chinabondconnect.com/en/Newsroom/News-Release/First-Latin-American-Bond-Connect-Transaction--By-Bocom-Bbm-S-A.html
⁴⁴ https://www.hkma.gov.hk/eng/news-and-media/press-releases/2020/06/20200629-4
⁴⁵ https://www.sfc.hk/-/media/EN/files/ER/MOU/CC-SFC-MOU-ENG.pdf
⁴⁶ https://www.sfc.hk/-/media/EN/files/ER/MOU/MOU_between_SFC_and_IA_Sep2020.pdf
⁴⁷ https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and-circular/2020/20200630e1a1.pdf
⁴⁸ https://apps.sfc.hk/edistributionWeb/api/consultation/openFile?lang=EN&refNo=20CP5