Hong Kong issues new guideline on virtual bank authorisation

The Hong Kong Monetary Authority (HKMA) published its revised Guideline on Authorization of Virtual Banks (the Guideline) on 30 May 2018 following a public consultation which closed in March 2018.  The Guideline is intended to encourage virtual banking in Hong Kong, one of seven HKMA initiatives to move Hong Kong to a “new era of smart banking”.^[1] Other key initiatives include a faster payment system (FPS) for banks and stored value facilities which is scheduled for launch in September 2018.^[2] It is hoped that virtual banks will expand the range of products available to consumers and improve financial inclusion.

The HKMA has said that applicants wishing to be in the first batch of authorized online banks should submit a substantially complete application to the HKMA by 31 August 2018.^[3]  In processing applications, the HKMA has said that it will give priority to applicants which can demonstrate that:

• they have sufficient financial, technology and other relevant resources to operate a virtual bank;
• they have a credible and viable business plan that would provide new customer experience and promote financial inclusion and fintech development;
• they have developed or can develop an appropriate IT platform to support their business plan; and
• they are ready to commence operation soon after a licence is granted.

Standard Chartered, WeLab and another 50 parties are reportedly interested in obtaining a virtual bank licence, and the first licences are expected to be issued towards the end of 2018 or early in 2019.^[4]  

A virtual bank is defined by the Guideline as “a bank which primarily delivers retail banking services through the internet or other forms of electronic channels instead of physical branches”.  An entity wishing to be licensed as a virtual bank will need to meet:

1. the criteria for authorization for conventional banks, including the HK$300 million share capital requirement, as set out in the Seventh Schedule to the Banking Ordinance; and
2. additional criteria for authorization as a virtual bank set out in the Guideline.

Key criteria specific to virtual banks are that they:

• must be incorporated in Hong Kong (this is not required for conventional banks);
• must have at least one physical office to handle customer complaints;
• must provide an exit plan at the time of their application for authorization to ensure that they would be able to unwind the business in an orderly manner, if required;
• are subject to prohibitions on minimum balance requirements and predatory practices such as extremely low prices or excessively high interest rates; and
• must be members of the deposit protection scheme.

The following is a summary of the principal requirements for authorization as a virtual bank.

1. Authorization as a licensed bank

   A company wanting to operate a virtual bank in Hong Kong will need to satisfy HKMA that it meets the minimum criteria for authorization as a bank set out in the Seventh Schedule to the Banking Ordinance (the Ordinance). The HKMA’s Guideline on Minimum Criteria for Authorization (Minimum Criteria) sets out how HKMA interprets the authorization criteria.  The Minimum Criteria are summarized in Schedule 1 to this note.

2. Additional criteria for authorization as a virtual bank

   2.1   Ownership

   Virtual banks need to be established in the form of a Hong Kong-incorporated bank. Both financial and non-financial firms may apply for authorization.

   The HKMA further requires that a holder of 50% or more of the share capital of a Hong Kong-incorporated bank should be a bank or a financial institution in good standing which is supervised by a recognised Hong Kong or overseas authority.  If a Hong Kong virtual bank applicant is not owned by such a bank or financial institution, HKMA will expect it to be held through an intermediate holding company incorporated in Hong Kong which is subject to supervisory conditions.  The supervisory conditions which will be imposed will likely include requirements in relation to: (i) capital adequacy; (ii) liquidity; (iii) large exposures; (iv) intragroup exposures and charges over assets; (v) group structure; (vi) activities undertaken; (vii) risk management; (viii) fitness and propriety of directors and senior management; and (ix) the submission of financial and other information to the HKMA.  Given that virtual banks are typically new ventures which are potentially susceptible to higher risks when they first set up, the HKMA requires their parent companies to provide strong financial, technological and other support.

   2.2   Ongoing supervision

   The supervisory requirements for conventional banks will apply to virtual banks, with modifications appropriate for virtual banks’ business models under a risk-based and technology neutral approach. For example, the board of directors and senior management of virtual banks will need to have the requisite knowledge and experience to perform their duties effectively.

   2.3   Physical presence

   A virtual bank must have a physical Hong Kong office which will also be its principal place of business in Hong Kong.  The Hong Kong office will be required to interface with both the HKMA and customers who have enquiries or complaints.  Otherwise, there is no requirement for physical branches.  

   A full set of books, accounts and transaction records will need to be maintained and be accessible to the HKMA.

   2.4   Technology risk

   Virtual bank applicants must engage a qualified, independent expert to prepare an independent assessment report of the adequacy of their planned IT governance and systems.  A copy of this report must be submitted to the HKMA with the application for licensing.

   Another, more detailed independent assessment is required in relation to the actual design, implementation and effectiveness of the applicant’s computer hardware, systems, security, procedures and controls.  The report of this detailed assessment is required to be given to the HKMA before the virtual bank commences operation.  A virtual bank is also required to implement procedures for the regular review of its security and technology arrangements and to ensure that they remain appropriate in view of continuing technological developments.  

   2.5   Risk management

   A virtual bank applicant must put in place systems to identify, measure, monitor and control risks to which it is exposed.  As a minimum requirement, the applicant must analyze to what extent it will be subject to the eight basic types of risk identified in the HKMA’s risk-based supervisory framework (i.e. credit, interest rate, market, liquidity, operational, reputation, legal and strategic risk).

   2.6   Business plan

   A virtual bank applicant will need to present a credible and viable business plan which balances the desire to build market share and the need to earn a reasonable return.  Although the HKMA will not normally interfere with the business decisions of individual virtual banks, it would be concerned if a virtual bank planned to aggressively build market share at the expense of recording substantial losses in the early years of operation, without any credible plan for profitability in the medium term.

   HKMA stresses the undesirability of predatory tactics and the potential threat they pose to banking sector stability and public confidence in individual virtual banks.  Virtual banks are discouraged from allowing rapid business expansion to put undue strains on their systems and risk management capability.

   2.7   Exit plan

   Virtual bank applicants will need to provide an exit plan in case its business model is unsuccessful. The exit plan is intended to ensure that a virtual bank could, if necessary, unwind its business operations in an orderly manner.  Exit plans should cover the circumstances in which the plan will be triggered, the authority to trigger the plan, the channels to be used to repay depositors and the source of funding for making the payments.

   2.8   Customer protection

   Virtual banks will need to comply with the Treat Customers Fairly Charter and the Standards of Code of Banking Practice of the Hong Kong Association of Banks and the DTC Association.

   Virtual banks’ terms and conditions must clearly set out the respective rights and obligations of the bank and its customers, including how losses caused by security breaches, systems failure or human error should be apportioned between the bank and its customers. HKMA considers that if an unauthorized transaction is conducted through a customer’s account, the customer should not be held responsible for any direct loss suffered, except where the customer acted fraudulently or with gross negligence (e.g. by failing to properly safeguard devices or secret codes for accessing the bank’s e-banking service).

   2.9   Outsourcing

   HKMA does not object in principle to outsourcing the computer or business operations of a virtual bank to a third party service provider, including the use of cloud computing, provided that a virtual bank discusses its plans for material outsourcing with the HKMA in advance and can demonstrate compliance with the principles of the Supervisory Policy Manual module on “Outsourcing” (SA-2). HKMA will need to be satisfied that the outsourced operations are subject to adequate security controls, and that confidentiality and integrity of customer information will not be compromised, and that the Personal Data (Privacy) Ordinance and common law requirements for customer confidentiality requirements are met.

   In the consultation conclusions, the HKMA indicated that it will take an open-minded approach to different forms of outsourcing and will not insist on compliance with the SPM module on “Outsourcing” word by word if the candidate can fulfil the HKMA’s supervisory expectations through alternative arrangements. Under the revised Guideline, HKMA will have the right to conduct inspections of the security arrangements and other controls in place in the service provider and the right to obtain reports from a relevant supervisory authority, external auditors or other experts. The HKMA must also be satisfied that its powers and duties under the Banking Ordinance (in particular, section 52 relating to the power of control over an institution) will not be hindered by the outsourcing arrangements.

   2.10 Capital Requirement

   Virtual banks must maintain adequate capital commensurate with the nature of their operations and banking risks undertaken.

Schedule 1

Minimum Criteria for Authorization of a Bank under the Seventh Schedule to the Banking Ordinance

The following sets out the minimum criteria an institution intending to apply for authorization should meet under the Seventh Schedule and how the HKMA interprets them.

1. Adequacy of home supervision (paragraph 2 of the Seventh Schedule)

   1.1 If the institution intending to apply for authorization is incorporated outside Hong Kong, that institution must:

   1. be a bank – that is a company which:
      1. is authorized or recognized as a bank in its jurisdiction of incorporation; or
      2. may lawfully take deposits from the general public (inside or outside of its place of incorporation) whether on current account or not;
   2. not be an authorized institution or recognized as the central bank of its place of incorporation; and
   3. be adequately supervised (in the opinion of the HKMA) by the relevant banking supervisory (normally the home supervisor located in the bank’s jurisdiction of incorporation).

   1.2 In considering whether the requirement of adequate supervision is met, the HKMA will consider the extent to which the supervisor has established, or is actively working to establish, the necessary capabilities to meet the Basel standards relating to the supervision of international banks. These standards require all international banking groups and international banks to be supervised by a home country authority that capably performs consolidated supervision. In making this assessment, the HKMA will consider the following:

   1. the legal and administrative powers of the home supervisor;
   2. the supervisory framework of the home supervisor;
   3. the bank resolution regime of the home jurisdiction, and the approach of the home resolution authority to resolution planning;
   4. the method of supervision adopted by, and the resources available to, the home supervisor;
   5. the information and analysis published by international organisations, such as:
      1. the International Monetary Fund (“IMF”) country reports on the IMF’s assessments of the home jurisdiction’s compliance with the Basel Core Principles for Effective Banking Supervision carried out within the framework of the Financial Sector Assessment Programme;
      2. the reports issued by the Basel Committee on Banking Supervision (Basel Committee) in respect of assessment of the home jurisdiction’s completeness and consistency of implementation of Basel II/2.5/III standards under the Regulatory Consistency Assessment Programme; and
      3. the Financial Stability Board (FSB) reports on assessments of the home jurisdiction’s compliance with the FSB Key Attributes of Effective Resolution Regimes for Financial Institutions and assessments of resolution or crisis management frameworks as conducted by other international organisations such as the IMF and World Bank; and
   6. past experience in dealings with the home supervisor and home resolution authority.

2. Identity of controllers (paragraph 3 of the Seventh Schedule)

   2.1 The HKMA must be satisfied that it knows the identity of each controller of the institution and it may seek information as to the identity of the institution’s controllers from the home supervisor of an institution incorporated outside Hong Kong.

   2.2 “Controller” is defined in the Banking Ordinance to mean:

   1. an indirect controller – a person in accordance with whose directions or instructions, the institution’s directors or the directors of a holding company of the institution are accustomed to act;
   2. a minority shareholder controller – a person who either alone or with associates controls 10% or more, but less than 50%, of the voting rights of the institution or of its holding company; and
   3. a majority shareholder controller – a person who either alone or with associates controls over 50% of the voting rights of the institution or its holding company.

3. Fitness and propriety of directors, controllers, chief executives and executive officers (paragraphs 4 and 5 of the Seventh Schedule)

   3.1 If the institution is incorporated in Hong Kong, the HKMA must be satisfied that each director, controller, chief executive or executive officer of the company is a fit and proper person to hold the particular position. Different factors are considered in respect of different roles, as detailed below.

   3.2 If the institution is incorporated outside Hong Kong, the HKMA must be satisfied of the fitness and propriety of each:

   1. chief executive and executive officer of its business in Hong Kong; and
   2. director, controller or chief executive of the institution in its place of incorporation.

   3.3   Directors and chief executives

   In addition to the minimum criteria imposed in the Seventh Schedule, section 71 of the Banking Ordinance requires that the HKMA must give its written consent for a person to become the chief executive or a director of an AI which is incorporated in Hong Kong. HKMA consent can be given subject to conditions. A similar approval must also be given for the chief executive of the business in Hong Kong of an institution incorporated outside Hong Kong. However HMKA approval is not needed for the directors and chief executive of an offshore institution in the place of its incorporation.  However, the HKMA will still need to be satisfied that such persons are fit and proper for their role and will rely on the home supervisor’s views, while reserving the right to consider any other available information.

   3.4   Independent non-executive directors

   One-third or three of the bank’s board members (whichever is higher) should be independent non-executive directors and at least two of them are required to have an accounting, banking or financial industry background. The independent non-executive directors cannot participate in the management of the bank and should not have business or other arrangement which could materially affect their exercise of independent judgment in relation to the bank’s affairs. Restricted licence banks and deposit-taking companies are encouraged to appoint at least three independent non-executive directors if practicable and at least one of them should have a background in accounting, banking or another relevant financial industry.

   3.5 Fitness and propriety assessment

   The HKMA may conduct a face-to-face meeting with a person for the purposes of assessing whether he or she is fit and proper to carry out his or her duties.  Each person will be assessed on a case-by-case basis and in general, the HKMA will consider a number of factors including but not limited to:

   1. sufficiency of skills, knowledge, experience and competence. In making its assessment, the HKMA will consider the person’s previous experience of similar responsibilities, his record in fulfilling them and, where appropriate, whether he has appropriate qualifications and training;
   2. soundness of judgment which HKMA will assess on the basis of (among others) the degree of balance, rationality and maturity shown in his conduct and decision making; 
   3. the person’s reputation and character, including whether the person has any criminal conviction for fraud or dishonesty;
   4. the person’s record of compliance with various non-statutory codes and any record of censorship, disciplinary action or disqualification by regulators (including overseas regulators) or professional bodies;
   5. whether the person has been a director of a company which has been wound up by the court or on the application of creditors, and whether the person has been investigated by the Financial Secretary;
   6. the person’s business record and other business interests, financial soundness and strength, to ensure that the person’s adverse financial position would not undermine the confidence of depositors and that the AI’s business decisions will be made on arm’s length terms; and
   7. in the case of an independent non-executive director, whether the person has any direct or indirect financial or other interests in the institution and any relationship with significant shareholders of the institution.

   3.6 Executive officers

   If an AI wishes to carry on any regulated activities (i.e. dealing in and/or advising on securities, dealing in and/or advising on futures contracts, advising on corporate finance, providing automated trading services, asset management and providing credit rating services), it must be registered with the Securities and Futures Commission (“SFC”) under the Securities and Futures Ordinance.  For each regulated activity, the institution must appoint at least two responsible officers to directly supervise the conduct of such activity in Hong Kong. In this regard, the HKMA will have to be satisfied that the person has sufficient authority and is fit and proper to hold the position.

   To determine if a person is fit and proper to be an executive officer, the HKMA will consider a number of factors including but not limited to:

   1. the person’s financial status including any bankruptcy record or failure to meet a judgment debt;
   2. the person’s educational or other qualifications or experience relevant to the functions to be performed as an executive officer, and the person’s competence to perform in carrying on the regulated activity; and
   3. the person’s reputation, character, reliability, financial integrity, honesty and fairness. The HKMA’s assessment will refer to whether the person (or any corporation of which the person has been a director or controller) has any record of:
      1. a finding by a court or other competent authority of fraud, dishonesty or misfeasance;
      2. a conviction of a criminal offence or being the subject of unresolved criminal charges;
      3. censorship, disciplinary action or disqualification by professional or regulatory bodies;
      4. being refused or restricted from carrying on any trade, business or profession for which a specific licence, registration or other authorization is required by law;
      5. a court disqualification from being a director;
      6. a finding of culpability of market misconduct by the Market Misconduct Tribunal, or having failed to comply with the codes or guidelines of any regulatory body or exchange in Hong Kong or overseas;
      7. being involved in a corporation or business that: (i) has been wound up (other than by members’ voluntary dissolution while solvent) or was otherwise insolvent or had a receiver or administrator appointed; (ii) was found guilty of fraud; (iii) has not met all obligations to clients; and (iv) has been found to have committed acts described in (a), (b), (c), (d) or (f) above.

   The HKMA may also request a face-to-face meeting for the purposes of making its assessment.  The HKMA will take into consideration any relevant decision made by, and information received from, the SFC and other financial regulators in Hong Kong and offshore.

   In determining whether a person has sufficient authority, the basic concept is that an executive officer should be the highest ranking staff member among those carrying on the regulated activity within the institution. In determining whether the person in fact has sufficient authority, the HKMA will take into account the institution’s size and the significance of the regulated activity in relation to its overall business, its management structure and the reporting line of the relevant person.

   3.7 Controllers

   The general assumption is that the greater the influence of a controller on the authorized institution, the higher the standard will be for the controller to fulfil the criterion of being fit and proper.

   The Seventh Schedule provides that the HKMA must be satisfied as to the fitness and propriety of the controller of an AI which is incorporated in Hong Kong and it must also approve any controller under section 70 of the Banking Ordinance. The controllers of an institution incorporated outside Hong Kong do not require approval by the HKMA, although the HKMA will still need to be satisfied that such persons are fit and proper for their role under Paragraph 5 of the Seventh Schedule and will rely on the views of the home supervisor, while reserving the right to consider any other information.

   The degree of a controller’s influence on the conduct of affairs of the institution will affect the HKMA’s assessment of the controller. If a person exercises close control over the institution’s business, the HKMA will assess whether the person has the knowledge and experience, competence, soundness of judgment and diligence required for operating an AI. The HKMA will thus consider the same factors used for assessing an AI’s executive directors. If however the controller is unlikely to influence the institution’s directors and management in the day to day conduct of its business, these qualities and experience will not be required of the controller. The size of the controller’s shareholding in the relevant institution will be taken into account in determining the extent of the controller’s influence on the institution. The probity of the controller and any potential conflict of interest arising from the controller’s influence on the institution will also be considered by the HKMA, in the same way as for directors and chief executives.

   Majority (and, if appropriate, minority) shareholder controllers are required to submit clear and detailed indications of their intentions or plans for the institution for assessment of the suitability of such plans and the applicant’s capacity to fulfill them. The HKMA will take into account the controller’s track record in holding similar or other relevant positions and its financial capacity to realize the plans. Whether the controller’s financial position, reputation or conduct could have a negative impact on confidence in the AI through contagion, will also be considered.  The higher the shareholding, the greater the risk of contagion. Shareholder controllers are also expected to show long-term commitment to the institution, and the willingness and capacity to contribute more capital if required. The controllers of a Hong Kong incorporated institution will generally be required to provide the HKMA with a letter of comfort committing to provide capital and/or liquidity support to the institution if necessary.

4. Adequate systems of control for appointment of manager (paragraph 5A of the Seventh Schedule)

   4.1 The HKMA will also need to be satisfied that the senior executives (referred to as “managers” in the Banking Ordinance) of the institution are fit and proper.  Paragraph 5A of the Seventh Schedule requires that the HKMA must be satisfied that the institution has, and will continue to have, adequate systems to ensure that persons appointed as managers of the institution are fit and proper to hold the relevant position.

   4.2 Under the Banking Ordinance, a manager of an institution incorporated in Hong Kong is defined as an individual, other than a director or chief executive, appointed to be principally responsible (whether alone or with others) for the conduct of any affairs or business specified in the Fourteenth Schedule to the Banking Ordinance. For an institution incorporated in Hong Kong, this refers to the institution’s overall operations (whether inside or outside Hong Kong). For an institution incorporated outside Hong Kong, only the affairs or business in Hong Kong is relevant.

   4.3 “Affairs and business” means:

   1. the carrying on of retail banking, private banking, corporate banking, international banking, institutional banking, treasury or any other business material to the AI;
   2. the maintenance of the accounts or the accounting systems of an AI;
   3. the maintenance of systems of control of an AI, including systems intended to manage the risks of the AI;
   4. the maintenance of systems of control of an AI to protect it against involvement in money laundering;
   5. the development, operation and maintenance of computer systems for an AI;
   6. the conduct of internal audits or inspections of the AI’s affairs or business; and
   7. the function of ensuring that an AI complies with laws, regulations or guidelines that are applicable to it.

   In assessing whether an institution meets the requirement of Paragraph 5A, the HKMA will consider, among others, whether:

   1. the responsibilities of, and the skills, knowledge and experience required for, individual managerial positions are clearly defined and supported by up-to-date job descriptions, organisation charts and levels of authority;
   2. the institution has a set of proper procedures for selecting and appointment managers and for satisfying itself about the fitness and propriety of managers, taking into account the factors applicable to directors;
   3. there are effective and clearly defined systems for appraising the performance of managers, which should not give excessive emphasis to financial performance;
   4. the institution has clearly defined policies and procedures for investigating apparent violation of internal guidelines or regulations by managers or complaints against managers and for taking disciplinary action;
   5. there are clearly defined systems for the replacement of managers whose performance is considered to be unsatisfactory;
   6. managerial vacancies are filled promptly and there are clearly defined arrangements to provide cover in the case of temporary vacancies;
   7. there is adequate training of managers; and
   8. the systems of control for appointing managers are subject to periodic review by the internal audit function.

   These factors are also set out in CG-2 “Systems of Control for the Appointment of Managers” of the Supervisory Policy Manual.

   4.5 Pursuant to section 72B of the Banking Ordinance, an AI should notify the HKMA and the relevant person in writing, of the appointment or removal of a manager, detailing the date of appointment, particulars of the affairs and business the manager will be or cease to be responsible for and any subsequent changes, within 14 days of the appointment or ceasing to be a manager or any other relevant changes.

5. Adequate financial resources (paragraph 6 of the Seventh Schedule)

   5.1   The HKMA must be satisfied that the institution has, and will continue to have, adequate financial resources (actual or contingent) for the nature and scale of its operations.

   5.2 As the HKMA is a member of the Basel Committee, in making an assessment of the financial strength of the institution, the eHKMA will have primary regard to the adequacy of its capital measured in a way which is consistent with the latest applicable capital standards issued by the Basel Committee.

   5.3 A Hong Kong-incorporated AI is required by the Seventh Schedule to comply on and after authorization with the Banking (Capital) Rules (Chapter 155L of the Laws of Hong Kong) (the “Banking (Capital) Rules”), which set out, among others: (i) the minimum capital adequacy ratios, the buffer level and the minimum leverage ratio; (ii) the constraints on distribution for an institution operating within the buffer zone; (iii) items that can be included as capital when calculating the actual capital adequacy ratios and buffer level; (iv) how the applicable countercyclical capital buffer ratio should be determined; and (v) various approaches to calculating authorized institutions’ capital requirements for credit, market and operational risks. The Banking (Capital) Rules are supplemented by various guidelines. The HKMA is entitled to require an AI with one or more subsidiaries to comply with the minimum capital adequacy ratios, the buffer level, and the minimum leverage ratio on a consolidated basis, in addition to a solo or solo-consolidated basis.

   5.4 The general principle is that if a locally incorporated institution fails to meet any of the minimum capital adequacy ratios and the minimum leverage ratio set for such institution, the criterion under paragraph 6 may not be considered to be satisfied. The HKMA will then discuss remedial action (such as a capital injection) with the institution, failing which the HKMA may take further action. However, meeting the minimum ratios does not necessarily mean that the HKMA will be satisfied as to the adequacy of the institution’s financial resources. The HKMA’s assessment will be forward looking and will consider the adequacy of provision for bad and doubtful debts and the possibility of future deterioration in asset quality, anticipated losses and excessive business risks. The ability and willingness of the institution’s shareholders to inject additional capital or liquidity if necessary, as  reflected in the form of a letter of comfort referred to in paragraph 33 above, is also taken into account by the HKMA.

   5.5 Institutions should have internal capital targets, which are agreed with the HKMA, and monitoring tools in place. They are also required to maintain minimum levels of share capital. The minimum level of share capital for licensed banks is HK$300 million.

   5.6 For institutions incorporated outside Hong Kong, the minimum share capital requirement applies to the institution as a whole and the home supervisor is primarily responsible for supervising their capital adequacy. The HKMA will consider the home supervisor’s view in its own assessment of the institution’s financial strength. The HKMA will usually require an applicant to submit its Capital Adequacy Assessment Process and the most recent assessment of its capital adequacy under different stress scenarios, which should reflect the position not more than three months before the submission. The basis for assessment should also be submitted.

   5.7 Overseas banks which wish to establish a branch or subsidiary in Hong Kong will also be required to maintain capital levels consistent with the latest applicable capital standards issued by the Basel Committee and the HKMA generally accepts calculations of capital requirements based on the methodology of the home supervisor if it is consistent with the various national discretions allowed under the Basel Committee’s capital standards. The HKMA is however still entitled to require the capital requirements to be recalculated on the basis of the methodology used in Hong Kong.

   5.8 In assessing financial strength, the HKMA also considers the adequacy of the institution’s loss-absorbing capacity, which may facilitate loss-absorption and recapitalisation of the institution in an orderly manner using stabilization options provided for under the Financial Institutions (Resolution) Ordinance in the event of its failure.

6. Adequate liquidity (paragraph 7 of the Seventh Schedule)

   6.1 An institution is required to maintain on application for authorization, and to continue to maintain after authorization, adequate liquidity to meet its obligations as they will or may fall due, and to comply with the rules made under section 97H(1) of the Banking Ordinance (i.e. the Banking (Liquidity) Rules) which set out the liquidity requirements applicable to AIs. These include, among other things, minimum required levels of the four liquidity ratios (the Liquidity Coverage Ratio (LCR), the Net Stable Funding Ratio (NSFR), the Liquidity Maintenance Ratio (LMR), and the Core Funding Ratio (CFR)). Each category of AIs has to observe the requirements for the different ratios and the requirement to report the occurrence of any relevant liquidity event to the HKMA. For a Hong Kong-incorporated AI, the four liquidity ratios may be applied on an unconsolidated basis, a consolidated basis or both, in addition to the Hong Kong office basis that applies to all AIs irrespective of where they are incorporated. The minimum required levels for an AI may be varied by the HKMA.

   6.2 In assessing liquidity adequacy, the HKMA also considers liquidity risk management and compliance with the relevant standards set out in “Sound Systems and Controls for Liquidity Risk Management” of the SPM. Institutions are required to have a sound liquidity risk management framework, including the articulation of a clear liquidity risk tolerance, a comprehensive approach to management, identification, measurement and control of the full range of liquidity risks to which the institution is exposed, appropriate funding strategies and internal risk process together with viable operational contingency funding plans. The framework should be commensurate with the nature, scale and complexity of the authorized institution’s business activities.

   6.3 Institutions are required to measure, monitor and control their cash-flow and maturity mismatch positions within various time bands under different operating conditions. They should have appropriate systems and procedures in place for monitoring net funding requirements on a daily basis under normal business conditions; conducting regular cash-flow analyses based on a range of stress scenarios; and developing reasonable assumptions for making these cash-flow projections. Positive cash-flow position should be maintained, or, sufficient cash should be able to be generated from the institutions’ assets or funding sources on a daily basis to meet funding requirements. The HKMA will also review the adequacy of the institution’s liquidity cushion and stress tests conducted by AIs and the stability of the their funding sources, as well as the viability of its contingency funding plans.

   6.4 Each AI should formulate a liquidity risk tolerance and a statement of its liquidity management policy which should be approved by its board and reviewed regularly (at least annually) by the board. The statement needs to cover at least the liquidity risk tolerance set by the board, the liquidity risk management strategy, the liquidity risk governance and management systems and the institution’s contingency plan for dealing with various types of liquidity crisis. Liquidity policies and strategies should be formulated for the currencies in which an AI has significant exposure.

   6.5 AIs which are branches of banks incorporated outside Hong Kong should formulate a policy statement for their operations in Hong Kong irrespective of whether liquidity risk management is centralized at their head office. The policy statement for the Hong Kong operations should include the line of responsibility for monitoring the liquidity in Hong Kong and the reporting arrangements to head office. For AIs which are branches or subsidiaries of foreign banks, their liquidity risks may be managed on an integrated global basis. The HKMA typically expects such AIs to comply with the standards in “Sound Systems and Controls for Liquidity Risk Management” of the SPM in all major respects. Such AIs are however allowed to adapt their group liquidity risk management framework to their Hong Kong operations to comply with the standards. In assessing the overall liquidity of an institution incorporated outside Hong Kong, the HKMA will consider the views of the home supervisor and other available information.

   6.6 If an AI fails to meet the liquidity requirements, the criterion under Paragraph 7 of the Seventh Schedule may not be considered to be satisfied and the HKMA will discuss remedial action with the institution, failing which the HKMA may take further action.

7. Adequate control of large exposures (paragraph 8 of the Seventh Schedule)

   7.1 The HKMA must be satisfied that an institution will, on and after authorization, comply with the provisions of Part XV of the Banking Ordinance in relation to limitations on loans by and interests of AIs. The HKMA has issued various policy guidelines within the SPM to provide guidance to AIs on how it proposes to exercise its powers and discretion under Part XV, including CR-G-8 “Large Exposures and Risk Concentrations” (attached to this Note as Appendix C), CR-G-9 “Exposures to Connected Parties” (attached to this Note as Appendix D) and a series of CR-L modules in relation to limitations on credit exposures under Part XV.

   7.2 Part XV sets out limitations on exposures and concentration risks of AIs, including the following:

   1. lending against the security of the shares of the AI or its related companies (section 80);
   2. limitation on exposures to a customer or a group of related customers (section 81);
   3. power of the HKMA to publish guidelines on business practices which should not be engaged in by AIs (section 82);
   4. limitation on exposures to directors and connected persons and companies and businesses related to them (section 83);
   5. limitation on advances to employees (section 85);
   6. powers of the HKMA in relation to moneys placed with a foreign bank by an AI (section 86);
   7. limitation on holding of shares (section 87);
   8. acquisition by AIs incorporated in Hong Kong of share capital in companies equal to or exceeding 5% of the capital base of the institution (section 87A);
   9. limitation on holding of interest in land (section 88);
   10. limitation on aggregate holdings under sections 83, 87 and 88 (section 90); and
   11. proof of compliance with sections 80, 81, 83, 85, 86, 87, 88 or 90 (section 91).

   7.3 For an AI incorporated outside Hong Kong, section 79(4) provides that sections 80, 82, 85, 86 and, where relevant, section 91, shall apply only to the Hong Kong operations of such an institution.

   7.4 An institution should have the necessary control systems to guard against concentration risks and to ensure the limits specified in Part XV will not be exceeded. A locally-incorporated institution should also establish a policy on the control of large exposures and risk concentration and set an internal clustering limit to control the aggregate of its large exposures which are not exempted under section 81 of the Banking Ordinance.

   7.5 Hong Kong incorporated AIs may be required to comply with Part XV on both an unconsolidated and consolidated basis and the HKMA has the discretion to decide which subsidiaries are to be included in the consolidation. Generally, consolidation in this context will include subsidiaries undertaking financial business and those which incur risks regulated by Part XV. In general, section 81 of the Ordinance limits the exposure to an individual customer or group of connected customers to not more than 25% of the capital base of an AI incorporated in Hong Kong.

   7.6 It should be noted that the HKMA plans to implement the new Basel large exposures framework to replace the current section 81 of the Banking Ordinance starting from 1 January 2019.

8. Maintenance of adequate provisions (paragraph 9 of the Seventh Schedule)

   8.1 Paragraph 9 of the Seventh Schedule requires that an institution should maintain adequate provisions for depreciation or diminution in the value of its assess (including provision for bad or doubtful debts), for liabilities which will or may fall to be discharged by it and for losses which will or may incur (such as expected losses on contingent liabilities for guarantees or off-balance sheet exposures and tax liabilities). The HKMA regards the accurate valuation of assets and adequate provisions as being of fundamental importance.

   8.2 In assessing the adequacy of provision, the HKMA may conduct on-site examinations or off-site analysis and consider factors, such as, the nature and volume of the asset portfolio including concentration of risks, systems for credit assessment, approval and monitoring, the policies and procedures for identifying bad debts and determining the appropriate level of provisions, the frequency of review of provisions, the policy and practice for the taking and valuation of security, and the extent to which valuation exceeds the balance sheet value of such security.

   8.3 In addition to their accounting provisions determined in accordance with International Financial Reporting Standards, the HKMA requires AIs incorporated in Hong Kong to maintain a non-distributable regulatory reserve. AIs are also expected to have in place an adequate country risk management system which is commensurate with the size, nature and complexity of its cross-border exposures and adequate provisions against country risk should also be made.

   8.4 For an institution with its place of incorporation outside Hong Kong, the HKMA will consider the home supervisor’s view and other available information.

9. Maintenance of adequate accounting systems and systems of control (paragraph 10 of the Seventh Schedule)

   9.1   The HKMA has to be satisfied that the institution has, and will continue to have, adequate accounting systems and adequate systems of control. In assessing adequacy, the HKMA will consider the nature, scale and complexity of the institution’s operations, the volume of transactions undertaken, its structure and organization, and the geographical distribution of the business. AIs are subject to examination of the adequacy of its accounting systems and internal control systems. Assessment of “adequacy” covers both the existence of records and controls and if they are working effectively.

   9.2 The institution should maintain adequate management information systems and adequate systems of control with a view to providing the HKMA with timely information as required for resolution planning and managing an orderly failure of the institution. The HKMA’s core information requirements for resolution planning are set out in the Code of Practice chapter on “Resolution Planning – Core Information Requirements” (attached to this Note as Appendix E). The institution should also maintain an internal audit function appropriate for the size, nature, scope and complexity of its operations. The HKMA’s expectations on the key role, responsibilities and qualities of an institution’s internal audit function, and its approach in assessing the effectiveness of the function are further set out in the SPM module on “Internal Audit Function” (IC-2).

   9.3 The HKMA also requires auditors’ reports to be submitted on an annual basis pursuant to section 63(3) and 63(3A) of the Banking Ordinance. Such auditors’ reports should cover:

   1. the accuracy of prudential returns or other information;
   2. controls relating to the compilation of prudential returns or other information;
   3. controls which enable compliance with statutory provisions in the Banking Ordinance; and
   4. for institutions incorporated in Hong Kong, controls to enable the maintenance of adequate provisions.

   9.4 Apart from the above annual submission, HKMA is also entitled to require submission of auditors’ reports on an ad hoc basis under section 59(2) of the Banking Ordinance and such reports may cover internal control matters such as:

   1. high level controls;
   2. controls relating to the financial accounting and management reporting systems;
   3. specific controls relating to particular areas of institutions’ business operations (such as loans and advances, internet banking etc.);
   4. computer controls;
   5. contingency planning; and
   6. controls to prevent money laundering and terrorist financing.

   9.5 The HKMA has issued a Guideline on Anti-Money Laundering and Counter-Terrorist Financing (For Authorized Institutions) (attached to this Note as Appendix F) on the designing and implementing of policies, procedures and controls to meet the relevant statutory and regulatory requirements, including those under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. The HKMA conducts examinations on the adequacy of AIs’ controls in this area. For institutions incorporated outside Hong Kong, HKMA will consider if the home jurisdiction is identified by the Financial Action Task Force (“FATF”) in public statements as a jurisdiction that has strategic deficiencies in its anti-money laundering and counter-terrorist financing regimes or a country that does not, or insufficiently, apply the FATF Recommendations. We note that Russia has not been identified by the FATF as has having strategic deficiencies.

   9.6 The institution should also develop comprehensive risk management systems to control the trading of securities and derivatives and the conduct of insurance and MPF intermediary activities. Adequate controls should be in place including segregation of duties and responsibilities between business units and the risk management and settlement functions. AIs should also ensure there are effective systems of control to ensure compliance with the relevant regulations and minimum standards, such as margin and other risk mitigation techniques which are set out in the SPM module on “Non-centrally Cleared OTC Derivatives Transactions – Margin and Other Risk Mitigation Standards” (CR-G-14) and those under the SFO.

   9.7 For institutions incorporated outside Hong Kong, the HKMA will consider the home supervisor’s views, while reserving the right to consider any other information.

10. Adequate disclosure of information (paragraph 11 of the Seventh Schedule)

    10.1 For Hong Kong-incorporated institutions, the HKMA must be satisfied that the institution discloses, and will disclose, adequate information about its state of affairs including:

    1. its profit and loss and its financial resources (including capital resources and liquidity resources);
    2. its audited annual accounts;
    3. any supplementary information to the audited annual accounts;
    4. report of the directors under section 388 of the Companies Ordinance (Chapter 622 of the Laws of Hong Kong); and
    5. its cash flow statement with any notes thereon, where the statement does not already form part of the audited annual accounts.

    10.2 The Banking (Disclosure) Rules (Chapter 155M of the Laws of Hong Kong) set out the minimum standards for public disclosure an AI should make in respect of its state of affairs, including its profit and loss and financial resources. These rules apply to Hong Kong-incorporated institutions (including those that are subsidiaries of overseas banks) and overseas incorporated AIs. Although paragraph 11 relates specifically to locally incorporated AIs, the HKMA, in practice, requires adequate financial disclosure by larger AIs incorporated outside Hong Kong in accordance with the standards of the Banking (Disclosure) Rules.

11. Business to be conducted with integrity, prudence and competence (paragraph 12 of the Seventh Schedule)

    11.1 The HKMA has to be satisfied that the business of an AI (including any business that is not banking business or the business of taking deposits) is carried on with integrity, prudence and appropriate degree of professional competence and in a manner which is not detrimental, or likely to be detrimental, to the interests of depositors or potential depositors.

    11.2 In considering whether this criterion is met, the HKMA will consider the institution’s compliance with the prudential requirements set out in the Seventh Schedule and factors including:

    1. the institution’s general strategy and objectives and its ability to plan ahead;
    2. the institution’s track record, including its ability to deal with external shocks and unexpected contingencies;
    3. the general level of competence associated with the institution as demonstrated, for example, in its resistance to internal and external fraud and avoidance of operational errors;
    4. the institution’s general reputation and standing in the financial community;
    5. the quality of the institution’s staff and management, including recruitment and training arrangements and institution’s compliance with the requirements in the SPM module on “Competence and Ethical Behaviour” (CG-6); and
    6. the quality of the institution’s computer systems.

    11.3 Further, the HKMA may also consider the extent to which the institution is structured and operates in such a way under normal circumstances that it is feasible and credible for its failure to be handled in an orderly manner by taking into account, among others, the following factors:

    1. the nature (including the complexity) and scale of activities that an institution carries on or seeks to carry on;
    2. the risks to the continuity of the services provided or to be provided;
    3. the effect that the disruption to the continued performance of such functions and activities might be expected to have on the stability and effective working of the financial system of Hong Kong; and
    4. the institution’s preparation and planning with a view to enabling its failure, if any, to be handled in an orderly manner, either in or outside resolution.

    11.4 The criterion of “integrity” relates to the manner in which the institution’s business is carried on. It should not be confused with the fitness and propriety of its directors, controllers, chief executives and executive officers, as discussed above. High ethical standards are expected in the institution’s conduct of its business. Any criminal offences, breaches of law, in particular, contraventions of any provision designed to protect members of the public against financial loss due to dishonesty, incompetence or malpractice, any non-compliance with recognized ethical standards of conduct may call into question whether this criterion is satisfied. The HKMA will consider the seriousness of the breach and whether the breach was intentional, unusual or potentially detrimental to depositors.

12. Other criteria (paragraph 13 of the Seventh Schedule)

    12.1 For institutions incorporated outside Hong Kong, at the time of authorization, there must be an acceptable degree of reciprocity in respect of banks incorporated in Hong Kong seeking to carry on banking business in the jurisdiction of incorporation of the institution and that place must be, or be part of the territory of, a member of the World Trade Organization. It is noted that Russia is a member of the World Trade Organization.