New SFC Measures to Increase the Accountability of Licensed Corporations’ Senior Management

1. Introduction

The Securities and Futures Commission (SFC) issued a circular¹ to licensed corporations on 16 December 2016 setting out new measures increasing the accountability of their senior management and aimed at increasing awareness of senior management obligations under the regulatory framework.

The new measures will come into effect on 18 April 2017. Key issues to note are that:

• A licensed corporation’s “senior management” includes, among others:

  • its directors (executive and non-executive and shadow directors)

  • its responsible officers (ROs) and

  • its Managers-in-Charge of Core Functions (MICs).

• One or more MICs must be appointed to have primary responsibility for each of 8 Core Functions: Overall Management Oversight; Key Business Line; Operational Control and Review; Risk Management; Finance and Accounting; Information Technology; Compliance; and Anti-Money Laundering and Counter-Terrorist Financing.

• MICs of the Overall Management Oversight and Key Business Line Core Functions, and of other Core Functions which comprise regulated activities, must be ROs of the licensed corporation.

• From 18 April 2017, all licence applicants and all existing licensed corporations must submit a formal document, approved by their board of directors, setting out their management structure. This must include the roles, responsibilities, accountability and reporting lines of senior management personnel and information required in respect of MICs (see further at section 6 below). Existing licensed corporations must submit the required information by 17 July 2017.

• Any change to a licensed corporation’s MICs (appointment or termination) must be notified to the SFC within 7 business days.

• The SFC can exercise its disciplinary powers under section 194 of the Securities and Futures Ordinance (SFO) against a “regulated person” guilty of “misconduct”.

  • “regulated persons” mean: a licensed corporation, a responsible officer or licensed representative, or a “person involved in the management of the business” of a licensed corporation (section 194(7) of the SFO). Members of licensed corporations’ senior management may thus be disciplined irrespective of whether they are licensed or registered with the SFC.

  • “misconduct” is defined widely and includes an act or omission relating to the carrying on of a regulated activity for which a person is licensed. Liability may therefore be incurred in respect of a business activity which is not a regulated activity but relates to the conduct of a regulated activity for which the corporation is licensed.

  • The disciplinary sanctions the SFC can impose under section 193 SFO are civil in nature. Officers of licensed corporations may be criminally liable where the licensed corporation is found guilty of an offence under the SFO, and the offence is proved to have been aided, abetted, counselled, procured or induced by, or committed with the consent or connivance of, or attributable to any recklessness of, any officer of the corporation (section 390(1) of the SFO). “Officers” include a director, manager or secretary, or any other person involved in the management of a corporation.

The SFC has issued 40 FAQs² on the new measures, which are summarized at section 8 below.

2. Background

General Principle 9 of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (the Code of Conduct) provides that the senior management of a licensed or registered entity bears primary responsibility for ensuring that appropriate standards of conduct are maintained and proper procedures are adhered to. In determining where responsibility lies, and the degree of responsibility borne by a particular individual, the SFC will have regard to an individual’s apparent or actual authority in relation to the particular business operations. It is therefore important that each senior manager’s duties are clear and that senior managers are fully aware of their obligations under Hong Kong’s regulatory regime.

The stated aims of the circular are to:

• set out the SFC’s view as to who should be regarded as members of senior management of licensed corporations;

• promote awareness of the regulatory obligations and potential liabilities of senior management;

• express the SFC’s general expectation that certain members of senior management should seek SFC approval to be responsible officers;

• outline certain roles and responsibilities of a licensed corporation’s board of directors (Board); and

• provide more guidance as to the information a licensed corporation (or licence applicant) should submit in respect of its human resources and organisational structure.

3. Meaning of Senior Management

The SFC considers the following to be members of a licensed corporation’s senior management:

• directors of the corporation (including shadow directors and persons occupying the position of director);

• the corporation’s responsible officers (ROs); and

• individuals referred to as “Managers-In-Charge of Core Functions” (MICs).

These three categories are not mutually exclusive and an individual may simultaneously be a director, RO and MIC of a licensed corporation.

Managers-In-Charge of Core Functions (MIC)

A “Manager-In-Charge of Core Functions” (MIC) is an individual appointed by a licensed corporation to be principally responsible, alone or with others, for managing any of 8 “Core Functions” which are:

• Overall Management Oversight

• Key Business Line

• Operational Control and Review

• Risk Management

• Finance and Accounting

• Information Technology

• Compliance

• Anti-Money Laundering and Counter-Terrorist Financing

The SFC considers that for each Core Function, a licensed corporation should appoint at least one individual as its MIC responsible for managing that function. Depending on its scale of operations and control measures, a licensed corporation may appoint one individual as the MIC for several Core Functions and/or appoint two or more individuals as MICs to jointly manage a Core Function. The SFC does not mandate any particular organisational or governance structure for licensed corporations. The Board of a licensed corporation is thus responsible for delegating authority and responsibilities among its senior management (including MICs).

In determining whether any particular individual is an MIC, licensed corporations should take into account the individual’s apparent or actual authority. An individual may be an MIC if one or more of the following applies:

1. he/she occupies a position within the corporation which is of sufficient authority to enable the individual to exert a significant influence on the conduct of that Core Function;

2. he/she has authority to make decisions (e.g. assume business risks within pre-set parameters or limits) for that Core Function;

3. he/she has authority to allocate resources or incur expenditure in connection with the particular department, division or functional unit carrying on that Core Function; and

4. he/she has authority to represent the particular department, division or functional unit carrying on that Core Function (e.g. in senior management meetings or in meetings with outside parties).

The seniority of the individual should also be taken into account. The SFC generally expects an MIC to:

1. report directly to the corporation’s Board, or to the MIC who assumes the overall management oversight function of the corporation; and

2. be accountable for the performance or achievement of business objectives set by the Board, or by the MIC who assumes the overall management oversight function.

MICs may or may not be employees of the licensed corporation and may be located in or outside Hong Kong. Depending on the particular functions they perform in relation to the business, they may or may not be licensed under the SFO. However, since they hold positions of authority within the licensed corporation, they must not be external parties who merely provide outsourced services. An MIC who is not a licensed person does not require SFC approval. However, the licensed corporation will need to ensure that any person it employs or appoints to conduct business is fit and proper and qualified to act in the capacity in which he or she is employed or appointed (see Paragraph 4.1 of the Code of Conduct).

MICs heading certain Core Functions should be ROs

The SFC expects MICs of the Overall Management Oversight function and the Key Business Line function to be ROs in respect of the regulated activities they oversee, since they will normally be responsible for supervising these regulated activities or will actively participate in those activities. MICs of other Core Functions are not expected to be ROs, nor does the SFC require every RO to be an MIC.

In considering an RO application or waiver application, the SFC takes into account specific facts of the case. In assessing whether an RO applicant, who is or will be an MIC of the Overall Management Oversight function, satisfies the industry experience tests under the Guidelines on Competence, the SFC will consider the applicant’s overall career history within the industry, his/her proposed activities and the licensed corporation’s resources including systems and expertise.

An applicant who has held a senior position to manage a control or operational function (e.g. risk management, compliance, etc.) for a long time may be approved as an RO subject to appropriate licensing conditions. This is so even if he or she has not had any experience in conducting or directly supervising the regulated activity concerned. In this situation, a typical licensing condition may be that the applicant would be required to work together with another fully competent RO. After accumulating sufficient experience in the regulated activity, the applicant may apply for a waiver of the licensing condition under section 134(1) of the SFO.

There are also various exemptions to the licensing examinations recognised under Appendices D and E to the Guidelines on Competence.

4. Standard of Conduct and Liabilities of Senior Management

Standard of Conduct of Senior Management

The responsibilities of senior management are set out in various SFC codes and guidelines. In particular:

• General Principle 9 of the Code of Conduct states that the senior management of a licensed corporation should bear primary responsibility for ensuring the maintenance of appropriate standards of conduct and adherence to proper procedures by the corporation.

• Paragraph 14.1 of the Code of Conduct specifies that senior management of a licensed corporation should:

  1. properly manage the risks associated with the business of the corporation, including performing periodic evaluation of its risk management processes;

  2. understand the nature of the business of the corporation, its internal control procedures and its policies on the assumption of risk; and

  3. understand the extent of their own authority and responsibilities.

• The Internal Control Guidelines state that members of a licensed corporation’s senior management, including its directors, chief executive officer, managing director or other senior operating management personnel, are ultimately responsible for the adequacy and effectiveness of the corporation’s internal control systems. The Internal Control Guidelines also contain specific control guidelines for important areas such as information management, compliance, audit, operational controls and risk management.

• The Guideline on Anti-Money Laundering and Counter-Terrorist Financing provides detailed expectations regarding compliance and control functions that will be particularly relevant to MICs responsible for managing the Anti-Money Laundering and Counter-Terrorist Financing function.

Where such policies, practices and actions are determined by or together with other companies in the group, the senior management should examine the appropriateness of the polices or practices and make any changes that are necessary to make them appropriate for the corporation’s performance of its regulated business activities in Hong Kong.

Legal Liabilities of Senior Management

Legal Liability

Persons Liable

The SFC may exercise its disciplinary powers against a regulated person who commits misconduct or is considered not fit and proper to be or to remain the same type of regulated person under Part IX of the SFO.

“Regulated person” means a licensed person (i.e. a licensed corporation or licensed representative), an RO of a licensed corporation or a person involved in the management of the business of a licensed corporation. All members of the senior management of a licensed corporation (even if they are not licensed) are regulated persons.

Where a licensed corporation is (or was) guilty of misconduct as a result of the commission of any conduct occurring with the consent or connivance of, or attributable to any neglect on the part of, a person involved in the management of the business of the licensed corporation, then that person is also guilty of misconduct (section 193(2) of the SFO).

Conduct Subject to Liability

“Misconduct” is defined in the SFO to include:

1. a contravention of any provision of: (i) the SFO; (ii) Parts II and XII of the Companies (Winding Up and Miscellaneous Provisions) Ordinance (Cap. 32) in relation to prospectuses or an advertisement referred to in section 38B(1) of the Ordinance; (iii) Part 5 of the Companies Ordinance (Cap. 622) relating to a corporation’s buy-back of its own shares or giving financial assistance for the acquisition of its own shares; and (iv) Part 2 (except section 6) of the Anti-Money Laundering and Counter-Terrorist Financing (Financial Institutions) Ordinance (Cap. 615);

2. a contravention of the terms and conditions of any SFC licence or registration;

3. a contravention of any other condition imposed under or pursuant to the SFO Ordinance, or of any condition attached or amended under section 71C(2)(b) or (9) or 71E(3) of the Banking Ordinance (Cap. 155); or

4. an act or omission relating to the carrying on of any regulated activity for which a person is licensed or registered which, in the opinion of the SFC, is or is likely to be prejudicial to the interest of the investing public or to the public interest. Note that the SFC is required to have regard to its various codes issued under section 169 of the SFO and guidelines issued under section 399 SFO before forming such an opinion (see section 193(3) of the SFO) (emphasis added).

With regard to (d) above, it is worth noting that depending on how broadly the term “relating to” is interpreted, ROs, licensed representatives and senior management members may face SFC disciplinary action with respect to business activities which are not “regulated activities” for which they are licensed, if they are considered to be “related to” the conduct of a corporation’s regulated business activities.

A case in point is the Securities and Futures Appeal Tribunal’s (SFAT) decision³ with respect to Moody’s Investors Service Hong Kong Limited (Moody’s) and the publication of its report “Red Flags for Emerging-Market Companies: A Focus on China” (the Red Flags Report). Moody’s is licensed for regulated activity Type 10 – providing credit rating services. It appealed the SFC’s findings that it had breached various provisions of the SFC’s Code of Conduct for Persons Licensed by or Registered with the SFC (the Code of Conduct) in preparing the report. Moody’s submitted that its preparation of the Red Flags Report was not a regulated activity for which Moody’s was licensed (i.e. it was not part of its credit rating services) and that the Code of Conduct did not therefore apply to its preparation of that report.

The SFAT found that, whether or not this was Moody’s intention, the Red Flags Report constituted a credit rating and that its publication was a regulated activity. It went on to say that even if it was wrong on this point, the Red Flags Report was intended to be read “as amplifying and supplementing Moody’s ratings … and became part and parcel of Moody’s ratings themselves” and thus fell within the definition of “regulated activity” by virtue of being connected to Moody’s licensed activities. Considering the definition of “misconduct” in section 193 SFO, the SFAT’s opinion was that the report so clearly clarified and/or expanded on Moody’s ratings in respect of the companies reviewed by the report that the publication of the report must be an act relating to those earlier ratings.

Disciplinary Sanctions

The disciplinary sanctions which the SFC may impose on a regulated person under Part IX of the SFO (e.g., licence revocation or suspension, pecuniary fine and reprimand) are civil rather than criminal in nature. But senior management of licensed corporations should also be aware of potential criminal liability. When a corporation (which may or may not be a licensed corporation) has been found guilty of an offence under the SFO, where the offence is proved to have been aided, abetted, counselled, procured or induced by, or committed with the consent or connivance of, or attributable to any recklessness of, any officer of the corporation, that officer is also guilty of the offence under section 390(1) of the SFO. An “officer” is defined as a director, manager or secretary, or any other person involved in the management of a corporation.

How the SFC exercises its disciplinary power

In determining whether a regulated person, including a person involved in the management of a licensed corporation, is a fit and proper person for the purpose of considering taking disciplinary action, the SFC may take into account the past or present conduct of the person (see sections 194(3) and 129 of the SFO).

Whether the SFC will discipline a regulated person depends on the specific facts of each case. In determining where responsibility lies, and the degree of responsibility of a particular member of senior management, the SFC will take into account the individual’s apparent or actual authority in relation to the particular business and operations, his or her level of responsibility within the licensed corporation concerned, any supervisory duties he or she may perform, and the level of control or knowledge he or she may have concerning any failure by the corporation or persons under his or her supervision to follow the Code of Conduct (see General Principle 9 and Paragraph 1.3 of the Code of Conduct).

5. Roles and Responsibilities of Board

The Board has ultimate responsibility

The Board of a licensed corporation has the ultimate responsibility for the conduct, operations and financial soundness of the corporation. All members of the board (whether he or she plays an executive or non-executive role) have a duty to exercise independent judgement in relation to the exercise and delegation of the Board’s powers. The Board retains responsibility for delegated decisions and is required to have systems and controls in place to supervise those who act under its delegated authority.

Organisational structure must be documented

The Internal Control Guidelines state that a licensed corporation should establish, document and maintain an effective management and organisational structure. The SFC thus requires the Board to approve a formal document setting out the licensed corporation’s management structure, including the roles, responsibilities, accountability and reporting lines of its senior management personnel.

Where a licensed corporation designates more than one individual to be the MICs of a particular Core Function, the Board should ensure that the aforesaid document contains sufficient details regarding the specific responsibilities of each MIC concerned. The SFC may request licensed corporations to provide the document for its review.

In addition, certain key information regarding a licensed corporation’s management structure is required to be submitted to the SFC under the Securities and Futures (Licensing and Registration)(Information) Rules (Information Rules), as set out below.

The Board must approve the management structure and ensure knowledge of its MICs

The management structure of a licensed corporation (including its appointment of MICs) should be approved by the Board of the corporation. Furthermore, the Board should ensure that each of the corporation’s MICs has acknowledged his or her appointment as MIC and the particular Core Function(s) for which he or she is principally responsible.

6. Submission of Management Structure Information

Submissions on licence application

When applying for a licence under section 116(1) of the SFO, a corporation is required to submit information on its human resources and organisational structure showing that it is capable of carrying on regulated activities competently (see section 3(1)(a) and Part 1 of Schedule 2 (items 11 and 12) of the Information Rules). The SFC takes this information into account in its assessment of the corporation’s fitness and properness under section 129 of the SFO. The SFC expects licence applicants to submit information regarding their MICs and an organisational chart as part of their application.

For each MIC, the following particulars should be submitted:

1. full name;

2. identification information;

3. job title indicating the individual’s position and his/her particular business or operational area (e.g. Chief Executive Officer, Chief Investment Officer, Head of Risk Management, etc.);

4. place of residence;

5. the Core Function(s) which he or she is in charge of; and

6. the job title(s) of the person(s) to whom he or she reports within the corporation and, if applicable, within its corporate group.

In addition, the SFC requires the submission of an organisational chart depicting the corporation’s management and governance structure, business and operational units and key human resources and their respective reporting lines. All MICs of the corporation must be included in the chart together with their respective reporting lines.

Changes in information to be notified within 7 business days

The SFC should be notified of any changes in a licensed corporation’s appointment of MICs (including new appointments and any cessation of appointment) or any changes in the particulars of the MICs within 7 business days of the change.

In the case of a new appointment or cessation of appointment, or a change in the particulars of MICs referred to in items (e) and (f) above, an updated organisational chart should be submitted with the notification of change.

Submissions by existing licensed corporations

Once the new measures take effect, all existing licensed corporations will be required to submit the required information about their MICs and organisational charts through the SFC Online Portal. They will also be required to submit notice of subsequent changes to information about their MICs.

Submissions must be complete and accurate

The Board of a licensed corporation is responsible for making sure the information submitted to the SFC is complete and accurate. A person may commit an offence if he provides false or misleading information in support of a licence application or in relation to a notification under section 383 or 384 of the SFO.

Formalities

The SFC will revise the existing form, Supplement 8 – Business Plan and Proposed Business Activities) and make a new form, Supplement 8A – Manager-In-Charge of Core Function(s) to facilitate the submission of the required MIC information and organisational charts. A draft of the new Supplement 8A is available at http://www.sfc.hk/edistributionWeb/gateway/EN/circular/openAppendix?refNo=16EC68&appendix=0. The SFC will specify the revised Supplement 8, the new Supplement 8A and the related online portal forms under section 402 of the SFO by notice published in the Gazette.

7. Implementation

The commencement date of the new measures is 18 April 2017. The SFC will organize industry workshops to introduce the new features of the SFC Online Portal for submitting the required information.

MIC information and organisational charts will need to be submitted within three months from the commencement date (on or before 17 July 2017). MICs of the Overall Management Oversight function and the Key Business Line function who are not already ROs are expected to apply for approval to become ROs on or before 16 October 2017.

8. FAQs

The SFC has issued FAQs⁴ on the new measures. The issues to be aware of which are not already covered above are summarised below.

Does the new regime apply to temporary licensed corporations (under section 117(1) of the SFO? (Q2) No. These corporations are already regulated by other authorities in their home jurisdictions and their licences last only for a short period of time.

If a licensed corporation is governed by an internal management committee, who will be regarded as the MIC of the Overall Management Oversight function? (Q8) A licensed corporation governed by an internal management committee is still required to designate an individual (e.g. chairperson of the committee) to be the MIC of the Overall Management Oversight function. If more than one MIC is designated to head the same Core Function, the Board of Directors should clearly set out the specific responsibilities of each MIC concerned in a formal document approved by the board which details how the responsibilities are to be shared.

Can an individual act as an MIC for more than one licensed corporation? (Q13) Yes, provided there is no conflict of interests. An MIC could serve multiple licensed corporations that are within the same corporate group or owned by the same controlling shareholder(s).

Regarding the “Key Business Line” core function, is there any financial threshold to determine whether a particular business line is “key” to a licensed corporation? (Q14) For the purpose of the new measures, the Key Business Line function comprises business activities constituting one or more type of regulated activity. There is no fixed financial threshold because it may be that a newly developed or developing Key Business Line may not generate any revenue. The combined business areas covered by all the MICs of the Key Business Line(s) should include all the regulated activities conducted by the licensed corporation.

Is a licensed corporation required to appoint an MIC for other business which a licensed corporation conducts in addition to regulated activities? (Q15) No. An MIC does not need to be appointed for a business activity which is not a regulated activity. But all business lines (including non-regulated activities) should still be included in the organisational chart submitted.

If the internal legal counsel function and compliance function of a licensed corporation are headed by two different individuals, are both of them regarded as MICs? (Q16) In this case, only the compliance function falls within the scope of Core Functions. The internal legal counsel function does not. Thus only the head of the compliance function would be regarded as an MIC. If an in-house legal counsel also serves as an MIC of the Compliance function, the new measures focus on his or her capacity in the compliance function only.

Do MICs of Core Functions that do not constitute regulated activity (e.g. Finance and Accounting, Information Technology) need to be approved by the SFC? What are the criteria for determining whether an MIC, who is not a licensed person or licence applicant, is a fit and proper person? (Q17) The SFC is not imposing any regulatory approval requirement to assess the fitness and properness of MICs who are not licensed persons. But a corporation is unlikely to be considered fit and proper if non-executive directors, key personnel (e.g. a manager, officer, director, chief executive), substantial shareholders or other controllers of the corporation fail to meet the Fit and Proper Guidelines other than that on competence to perform regulated activities (unless those guidelines are otherwise applicable).

Are the training requirements under the Guidelines on Continuous Professional Training applicable to MICs who are not licensed? (Q18) No. But Section III of the Management, Supervision and Internal Control Guidelines for Persons Licensed by or Registered with the SFC (Internal Control Guidelines) set out guidance regarding personnel and training expected of licensed corporations. Management (among others) is expected to ensure that adequate training suitable for the specific duties which staff member(s) perform is provided initially and on an on-going basis. A firm’s training programme should ensure that staff have or acquire appropriate and practical experience “on-the-job” and, where appropriate, through structured courses.

Will SFC discipline individuals who are located outside Hong Kong? (Q24) Yes. The disciplinary powers under Part IX of the SFO apply to all regulated persons without differentiating between those located in and outside Hong Kong.

During an investigation, will the secrecy obligation (under section 378 of the SFO) prevent any communication/notification being made to the relevant MICs, regardless of the entity that they sit within? (Q25) The secrecy obligations remain unchanged after implementation of the new measures. The relevant persons should continue to observe the secrecy obligations applicable to them. In the case of a corporation, the consent of the SFC to notification to its Board and holding company can be presumed. Disclosure in other circumstances requires SFC consent.

Would a licensed corporation’s MIC of the Overall Management Oversight function who neither actively participates in nor directly supervises regulated activity be expected to become an RO? (Q27) No. In the rare situation, which may occur in a licensed credit rating agency, where there is a clear segregation of duties between the business functions performed by the CEOs and the rating functions performed by the rating analysts. In that case, the SFC would anticipate that this MIC may be responsible for the Overall Management Oversight function working together with one or more other MICs responsible for supervising the corporation’s regulated activity.

Does a new CEO of a licensed corporation, who will assume the Overall Management Oversight function, need to be approved as an RO before taking up the post? (Q28) No. But the licensed corporation should clearly indicate to the SFC its intention for the CEO to apply to become an RO.

Does the SFC allow an offshore MIC of the Overall Management Oversight function or the Key business Line function to become an RO? (Q31) Yes. The SFC will consider imposing appropriate conditions on the licence of these individuals, such as a condition that he or she must act together with another Hong Kong-based fully competent RO.

What exemptions are available from the requirement to pass local regulatory framework papers? (Q33) A person may be exempt from this requirement under Paragraph 6, Part II, Appendix E of the Guidelines on Competence where he or she: (a) has sufficient industry experience; (b) is assuming a very senior management position; and (c) has regulatory support from other personnel, and there are appropriate control systems in place.

Who should be appointed as an MIC of the Overall Management Oversight function when both the regional CEO and the local CEO of a financial group are located in Hong Kong? (Q34) The answer depends on the roles and responsibilities of the two individuals. If either of them is in charge of overseeing the overall operations of any licensed corporation within the group on a day-to-day basis, he or she is regarded as the MIC of the Overall Management Oversight function (and is therefore expected to become an RO). If both are responsible, both are MICs.

Is the status of ROs, who are not MICs of the Overall Management Oversight function or the Key Business Line function, being downgraded to licensed representatives? (Q35) A licensed corporation may propose to appoint any other individuals who possess sufficient authority to be ROs to supervise its regulated activities in addition to the MICs of the Overall Management Oversight function and the Key Business Line function. At least two ROs are required to supervise each regulated activity for which the corporation is licensed.

Where an MIC’s appointment is temporary (e.g. an appointment to cover the temporary absence of another MIC), does the licensed corporation need to submit his or her information to the SFC? (Q37) No, provided that the appointment is expected to last no more than a few months and is not expected to continue permanently. If it becomes a permanent appointment, the SFC should be notified within 7 business days.

Will the MIC information be displayed in the Public Register of Licensed Persons and Registered Institutions?(Q40) No. The information displayed will not change, i.e. it will continue to show the names of licensed representatives and ROs as provided under Schedule 4 of the Securities and Futures (Licensing and Registration) (Information) Rules.

Do the requirements for submitting annual returns to the SFC or notifying the SFC regarding his or her outside directorships or other business interests apply to all MICs? (Q41) Only MICs who are licensed persons are subject to these requirements.