Circular to Licensed Corporations Regarding Measures for Augmenting the Accountability of Senior Management

16 Dec 2016



A.   Introduction

1.   General Principle 9 of the Code of Conduct for Persons Licensed by or Registered with the
      Securities and FuturesCommission (Code of Conduct) states that the “senior management of a
      licensed or registered person should bear primary responsibility for ensuring the maintenance
      of appropriate standards of conduct and adherence to proper procedures by the firm.  In
      determining where responsibility lies, and the degree of responsibility of a particular individual,
      regard shall be had to that individual’s apparent or actual authority in relation to the particular
      business operations…”.

2.   It is therefore important that the scope of each senior manager’s duties is clear and that each
      senior manager is fully aware of his or her obligations under Hong Kong’s regulatory regime. 

3.   This circular aims to:

      (a)   articulate the SFC’s view as to who should be regarded as members of senior management
             of licensed corporations (see Parts B and C);

      (b)   promote awareness of the regulatory obligations and potential liabilities of senior
             management (see Parts D and E);

      (c)   express the SFC’s general expectation that certain members of senior management should
             seek the SFC’s approval to be responsible officers (ROs) (see Part F);

      (d)   outline certain roles and responsibilities of a licensed corporation’s board of directors (Board)
             (see Part G); and

      (e)   provide more guidance as to the information a licensed corporation (or corporate applicant
             for a licence) should submit in respect of its human resources and organisational structure
             (see Part H).

4.   The measures set out in this circular are consistent with the existing provisions of the Securities
      and Futures Ordinance (SFO), subsidiary legislation made by the SFC, and  codes and guidelines
      published by it under the SFO. 

 
B.   Meaning of “senior management”

5.   The SFC is of the view that senior management of a licensed corporation includes, among others:

      (a)   directors [1] of the corporation,
      (b)   ROs of the corporation, and
      (c)   individuals whom we call the Managers-In-Charge of Core Functions (MICs),
             as elaborated in Part C. 

6.   These three categories are not mutually exclusive.  For instance, an individual can simultaneously
      be a director, RO and MIC of a licensed corporation.

 
C.   Managers-In-Charge of Core Functions

7.   For the purposes of this circular, the term “Manager-In-Charge of Core Function(s)” or “MIC”,
      refers to an individual appointed by a licensed corporation to be principally responsible, either
      alone or with others, for managing any of the following functions of the corporation (referred
      to as “Core Functions” and further explained in Annex 1): 

      (i)     Overall Management Oversight
      (ii)     Key Business Line
      (iii)    Operational Control and Review
      (iv)    Risk Management
      (v)     Finance and Accounting
      (vi)    Information Technology
      (vii)    Compliance
      (viii)   Anti-Money Laundering and Counter-Terrorist Financing

8.   The SFC considers that for each Core Function of a licensed corporation, there should be at least
      one individual appointed by the corporation as its MIC responsible for managing that function. 
      However, the SFC recognises that licensed corporations may adopt different organisational and
      governance structures based on their commercial and operational needs.  For instance, a licensed
      corporation may appoint one individual to act as the MIC for several Core Functions where
      appropriate considering its scale of operations and control measures.  Also, a licensed corporation
      may appoint two or more individuals as MICs to jointly manage a particular Core Function (also
      see paragraph 28).

9.   In determining whether an individual is an MIC of a particular Core Function, a licensed
      corporation should take into account the apparent or actual authority of that individual in relation
      to that Core Function.  For example, an individual may be an MIC of a particular Core Function if
      he or she has one or more of the following attributes:

      (a)   occupies a position within the corporation which is of sufficient authority to enable the
             individual to exert a significant influence on the conduct of that Core Function;

      (b)   has authority to make decisions (eg, assume business risks within pre-set parameters or
             limits) for that Core Function;

      (c)   has authority to allocate resources or incur expenditures in connection with the particular
             department, division or functional unit carrying on that Core Function; and

      (d)   has authority to represent the particular department, division or functional unit carrying
             on that Core Function, eg, in senior management meetings or in meetings with outside
             parties.

10.  A licensed corporation should also take into account an individual’s seniority.  In this regard, 
      the SFC generally expects that an MIC should:

       (a)  report directly to the Board of the corporation, or to the MIC who assumes the Overall
             Management Oversight function of the corporation; and

       (b)  be accountable for the performance or achievement of business objectives set by the
             Board, or by the MIC who assumes the Overall Management Oversight function.

11.   The SFC does not mandate any particular organisational or governance structure for licensed
       corporations.  It is the responsibility of a licensed corporation’s Board to determine the proper
       delegation of authority and responsibilities among its senior management (including MICs).

12.   MICs will not necessarily be employees of the licensed corporation.  However, they hold positions
       of authority within the licensed corporation, so they will not be external parties merely providing
       outsourced services.  They may be located in Hong Kong or overseas.  Furthermore, depending
       on the particular functions they perform in relation to the business of the corporation, they may
       or may not be licensed under the SFO.

13.  The SFC does not seek to apply regulatory approval to an MIC who is not a licensed person or
       a licence applicant.  However, a licensed corporation should ensure that any person it employs
       or appoints to conduct business is fit and proper and qualified to act in the capacity so
       employed or appointed (see Paragraph 4.1 of the Code of Conduct).


D.    Standard of conduct expected of senior management

14.  Various SFC codes and guidelines [2] provide guidance on the responsibilities of senior
      management of licensed corporations.  In particular:

       (a)   General Principle 9 of the Code of Conduct states that the senior management of a
              licensed corporation should bear primary responsibility for ensuring the maintenance
              of appropriate standards of conduct and adherence to proper procedures by the
              corporation.

       (b)   Paragraph 14.1 of the Code of Conduct further specifies that senior management of
              a licensed corporation should:

              (i)   properly manage the risks associated with the business of the corporation, including
                    performing periodic evaluation of its risk management processes;

              (ii)  understand the nature of the business of the corporation, its internal control
                    procedures and its policies on the assumption of risk;

              (iii)  understand the extent of their own authority and responsibilities.

       (c)  The Internal Control Guidelines state that members of a licensed corporation’s senior
             management, including its directors, chief executive officer, managing director or other
             senior operating management personnel (as the case may be), are ultimately responsible
             for the adequacy and effectiveness of the corporation’s internal control systems.  The
             Internal Control Guidelines also contain specific control guidelines for certain important
             areas, including information management, compliance, audit or related reviews, operational
             controls and risk management.

      (d)   The Guideline on Anti-Money Laundering and Counter-Terrorist Financing sets out detailed 
             expectations regarding compliance and control functions that will be particularly relevant to
             MICs responsible for managing the Anti-Money Laundering and Counter-Terrorist Financing
             function.

15.   Where policies, practices and actions are determined or formulated by or together with other
       companies in the group, the senior management of a licensed corporation should examine their
       appropriateness and make any necessary amendments or changes so that they are appropriate
       for the operations of the corporation’s regulated business activities in Hong Kong. 

 
E.    Legal liabilities of senior management

16.   Under Part IX of the SFO, the SFC may exercise its disciplinary powers to sanction a regulated
       person if the person is, or was at any time, guilty of misconduct or is considered not fit and
       proper to be or to remain the same type of regulated person. The term “regulated person” means
       a person who is or at the relevant time was any of the following types of person:-

       (a)   a licensed person
       (b)   an RO of a licensed corporation; or
       (c)   a person involved in the management of the business of a licensed corporation
              (regardless of whether he or she is licensed).

17.   All members of the senior management of a licensed corporation (even if they are not licensed)
       are regulated persons because of their involvement in the management of the licensed
       corporation’s business.  

18.   Where a licensed corporation is (or was) guilty of misconduct as a result of the commission of
       any conduct occurring with the consent or connivance of, or attributable to any neglect on the
       part of, a person involved in the management of the business of  the licensed corporation, then 
       that person is also guilty of misconduct (see section 193(2) of the SFO).

19.  “Misconduct” includes an act or omission relating to the carrying on of any regulated activity for
       which a person is licensed or registered which, in the opinion of the SFC, is or is likely to be
       prejudicial to the interest of the investing public or to the public interest.  Before forming any
       opinion for this purpose, the SFC shall have regard to its various codes and guidelines (see
       section 193(3) of the SFO).

20.   Furthermore, in determining whether a regulated person, including a person involved in the
       management of a licensed corporation, is a fit and proper person for the purpose of considering
       taking disciplinary action, the SFC may, among other matters, take into account the past or
       present conduct of the person (see section 194(3) and section 129 of the SFO).  For instance,
       if an MIC fails to ensure a licensed corporation’s compliance with the codes or guidelines
       published by the SFC, the failure may call into question the MIC’s fitness and properness, having
       regard to his or her level of responsibility within the firm.

21.  Whether the SFC is to discipline a regulated person depends on the specific facts of each case.
       In determining where responsibility lies, and the degree of responsibility of a particular member
       of senior management, the SFC will take into account the individual’s apparent or actual
       authority in relation to the particular business and operations, his or her level of responsibility
       within the licensed corporation concerned, any supervisory duties he or she may perform, and
       the level of control or knowledge he or she may have concerning any failure by the corporation
       or persons under his or her supervision to follow the Code of Conduct (see General Principle 9
       and Paragraph 1.3 of the Code of Conduct).

22.   The disciplinary sanctions which the SFC may impose on a regulated person under Part IX of the
       SFO (eg, licence revocation or suspension, pecuniary fine and reprimand) are civil rather than
       criminal in nature.  In addition to potential disciplinary sanctions, senior management of licensed
       corporations should also be aware of potential criminal liability. When a corporation (which may
       or may not be a licensed corporation) has been found guilty of an offence under the SFO, under
       section 390(1) of the SFO, where the offence is proved to have been aided, abetted,
       counselled, procured or induced by, or committed with the consent or connivance of, or
       attributable to any recklessness of, any officer of the corporation, then that officer is also guilty
       of the offence.


F.     MICs who head certain Core Functions should be ROs

23.   The SFC generally expects that MICs of the Overall Management Oversight function and the Key
       Business Line function should be ROs in respect of the regulated activities they oversee.  This is
       because, in most cases, MICs of these Core Functions actively participate in or are responsible
       for directly supervising the business of the regulated activities. For the avoidance of doubt, the
       SFC does not expect MICs of Core Functions other than these two to be ROs. The SFC also
       does not require every RO to be an MIC.

24.   In considering whether an RO applicant, who is or will be an MIC of the Overall Management
       Oversight function, meets the industry experience tests set out in the Guidelines on
       Competence, the SFC takes into account, among other things, the applicant’s overall career
       history within the industry, as well as his or her proposed activities and the resources (including
       system and expertise) available to the licensed corporation in totality.  An applicant who has
       held a senior position to manage a control or operational function (eg, risk management,
       compliance, financial or operational control) for a long time may be approved as RO subject to
       appropriate licensing conditions, even if he or she has not had any experience in conducting
       or directly supervising regulated activity.  Typically in this situation, a licensing condition may be
       imposed to the effect that he or she should work together with another RO who is fully
       competent.  After accumulating sufficient experience in regulated activity, he or she may apply
       for waiving the licensing condition under section 134(1) of the SFO.   The SFC will consider
       every RO application or waiver application based on the specific facts of the case.

25.   As regards licensing examinations, Appendices D and E to the Guidelines on Competence
       currently provide various exemptions from the recognised industry qualification requirement
       and the local regulatory framework paper requirement.  For instance, an RO applicant, who
       is assuming a very senior management position in a licensed corporation, may be exempt from
       taking the local regulatory framework paper if he or she has sufficient industry experience and
       there is regulatory support available to him or her from other personnel within a controlled
       environment. [3]


G.    Roles and responsibilities of the Board

26.   The Board of a licensed corporation has the ultimate responsibility for the conduct, operations
       and financial soundness of the corporation.  The Board works with senior management (including
       MICs) to achieve the objective of a soundly and efficiently run corporation, and senior
       management is accountable to the Board.

27.   Any member of the Board (regardless of whether he or she plays an executive or non-executive
       role with respect to the business of the licensed corporation) has a duty to exercise independent
       judgement in relation to the exercise and delegation of the Board’s powers.  The Board retains
       responsibility for delegated decisions and is required to have systems and controls in place to
       supervise those who act under the delegated authority.

28.   The Internal Control Guidelines state that a licensed corporation should establish, document and
       maintain an effective management and organisational structure.   To this end, the SFC expects
       that a licensed corporation should adopt a formal document, approved by the Board, clearly
       setting out the management structure of the corporation, including the roles, responsibilities,
       accountability and reporting lines of its senior management personnel.  Where a licensed
       corporation designates more than one individual to be the MICs of a particular Core Function, 
       the Board should ensure that the aforesaid document contains sufficient details regarding the
       specific responsibilities of each MIC concerned.  The SFC may request a licensed corporation to
       provide the document for its review.  Certain key information regarding a licensed corporation’s
       management structure should be submitted to the SFC under the Securities and Futures 
       (Licensing and Registration)(Information) Rules (Information Rules), as further explained in
       Part H.

29.  The management structure of a licensed corporation (including its appointment of MICs) should
       be approved by the Board of the corporation.  Furthermore, the Board should ensure that each
       of the corporation’s MICs has acknowledged his or her appointment as MIC and the particular
       Core Function(s) for which he or she is principally responsible.


H.    Submission of management structure information

30.   When applying for a licence under section 116(1) of the SFO, a corporation is required to provide
       information about its human resources and organisational structure showing that it is capable of
       carrying on regulated activities competently [4]. This information is relevant to the SFC’s
       assessment, under section 129 of the SFO, of the corporation’s fitness and properness for
       carrying on regulated activities.  It is also relevant to the performance of the SFC’s other
       regulatory functions, including ongoing intermediaries supervision and enforcement. Accordingly,
       the SFC expects the corporation to provide information regarding its MICs and its organisational
       chart in its application. 

31.   In respect of each of its MICs, the corporation should submit the following particulars:

        (a)    full name;
        (b)    identification information;
        (c)    job title [5];
        (d)    place of residence;
        (e)    the Core Function(s) which he or she is in charge of; and
        (f)    the job title(s) of the person(s) to whom he or she reports within the corporation
               and, if applicable, within its corporate group. 

32.   In addition, the corporation should submit an organisational chart depicting its management
       and governance structure, business and operational units and key human resources and their
       respective reporting lines.  The chart should capture all MICs engaged by the corporation, their
       respective reporting lines (as described in paragraph 31, item (f)) and the job titles of the
       persons reporting directly to these MICs in relation to the operations of the corporation.

33.   A licensed corporation should notify the SFC of any changes in its appointment of MICs
       (including any new appointment and cessation of appointment) or any changes in the
       particulars of its MICs (see paragraph 31) within seven business days of the changes.
       Where a change involves a new appointment or cessation of appointment, or a change in the
       particulars referred to in items (e) and (f) of paragraph 31, the licensed corporation should
       also submit an updated organisational chart in its notification of that change. [6]

34.  The Board of a licensed corporation or a corporate licence applicant should ensure that the
       information submitted to the SFC is complete and accurate.  Under section 383 or 384 of the
       SFO, a person may commit an offence if he provides false or misleading information in support
       of a licence application or in relation to a notification (as the case may be). 

35.   To facilitate the submission of the required MIC information and organisational charts by
       corporations applying for a licence under section 116(1) of the SFO, the SFC will (a)
       revise the existing form, Supplement 8 – Business Plan and Proposed Business Activities,
       and (b) make a new form, Supplement 8A – Manager-In-Charge of Core Function(s).   A draft
       of the new Supplement 8A is at Annex 2 for reference.

36.   Upon implementation of these measures, we will expect existing licensed corporations to submit
       the required information about their MICs and their organisational charts via the SFC Online
       Portal.  Any subsequent changes (as mentioned in paragraph 33) should also be submitted to
       the SFC via the SFC Online Portal.

37.  The SFC will, by notice published in the Gazette, specify the revised Supplement 8 and the new
       Supplement 8A as well as the related online portal forms (for both application and notification
       purposes) under section 402 of the SFO.


I.      Implementation

38.   The SFC understands that some licensed corporations may need time to revisit their
       management structures and RO appointments in light of the matters outlined in this circular. 
       The SFC intends to commence the information collection initiative (outlined in Part H) on
       18 April 2017 (commencement date).

39.   Before the commencement date, the SFC will organise industry workshops to introduce the
       new features of the SFC Online Portal for submitting the MIC information and organisational
       charts.  The SFC will expect licensed corporations to submit the MIC information and
       organisational charts within three months from the commencement date (ie, on or before
       17 July 2017).

40.   The SFC generally expects that on or before 16 October 2017 (ie, within six months from the
       commencement date), MICs of the Overall Management Oversight function and the Key
       Business Line function, who are not already ROs, will have applied for approval to become ROs
       (see Part F).

41.  Alongside this circular, the SFC has published on its website a series of Frequently Asked
      Questions under the topic “Measures for augmenting senior management accountability in
      licensed corporations”. 

 

Intermediaries Division
Securities and Futures Commission


[1]   The term “director” is defined in Schedule 1 to the SFO to include a shadow director and
        any person occupying the position of director by whatever name called.

[2]   For example, the Code of Conduct, the Management, Supervision and Internal Control
       Guidelines for Persons Licensed by or Registered with the Securities and Futures Commission
       (Internal Control Guidelines), the Fund Manager Code of Conduct, the Corporate Finance
       Adviser Code of Conduct, the Code of Conduct for Persons Providing Credit Rating Services
       and the Guideline on Anti-Money Laundering and Counter-Terrorist Financing.

[3]   See Paragraph 6, Part II, Appendix E of the Guidelines on Competence.

[4]   See section 3(1)(a) and Part 1 of Schedule 2 (items 11 and 12) of the Information Rules.

[5]   The job title should indicate an individual’s position and his or her particular business or
        operational area (eg, Chief Executive Officer, Chief Investment Officer, Chief Administrative
        Officer, Head of Risk Management, Head of Corporate Finance).

[6]   See section 4 and Part 1 of Schedule 3 (item 9) of the Information Rules.


Click here to download the document

Supplementary document:
Annex 1 and Annex 2


Page last updated : 16 Dec 2016