New FAQs from Hong Kong SFC fail to relieve concerns about new Internal Investigation Disclosure Obligation

New guidance from the Hong Kong Securities and Futures Commission (SFC) has clarified many aspects of a new reporting regime for licensed persons in Hong Kong, but concern remains over the logistical and administrative burden imposed, according to ASIFMA and Herbert Smith Freehills.

On 21 May, the Hong Kong Securities and Futures Commission (SFC) issued FAQs on its Internal Investigation Disclosure Obligation, a new reporting requirement introduced in February 2019.

While the industry had expected and welcomed the reporting requirements when introduced, the industry was keen to ensure that the Obligation worked, administratively and logistically, and to ensure a level playing field between reporting firms and reported employees.

The new FAQs do enhance clarity, providing welcome guidance on what is and is not reportable and the wide scope of this new requirement.

It is now clear that the regime captures investigations into both regulated and non-regulated activity, and that the SFC will require reports of internal investigations even when there are no adverse findings.

The FAQs also clarify that very high standards of confidentiality apply to these disclosures, as do existing SFC appeal procedures, which is also welcome.

"A clear understanding of what is in scope and what is not in scope, coupled with the realities of what it takes administratively and logistically to capture and report incidences, are important, and we welcome those aspects of the new FAQs," said Patrick Pang, Managing Director - Compliance and Tax at ASIFMA.   "However, we remain concerned that by requiring firms to capture and report every investigative action that takes place that the scope will impose a huge administrative burden. This burden falls not only on the reporting firms but also on the SFC, which will potentially have to screen and handle a huge number of reports – many of which may not even prove very useful to the SFC."   

 "We are already seeing firms reporting thoroughly under this new system, even including events that occurred long before the new Obligation was introduced," said partner Hannah Cassidy at Herbert Smith Freehills, who helped lead ASIFMA’s consultation response on the FAQs.  "Practically, this Obligation applies to a very mobile group of over 30,000 people in a high-pressure financial market. Our concern is that if reporting levels climb, firms may look for ways to reduce the burden. If firms trimmed back internal policies to stem the number of reports triggered, it could impact standards overall and possibly impact those in other areas, such as security or IT."

 The FAQs' clarification that the SFC will require all information that can be "lawfully" provided could also reduce the level of reporting, as much of the information will also be covered by a web of potentially conflicting laws on employment, personal privacy and data privacy.

 "Another potential issue is with how the reporting requirements dovetail with other legal regimes and the legal risks that reporting firms will face," said Patrick. "For instance, an employee reporting sick repeatedly without a medical certificate could technically breach company internal policies. If the firm opens an inquiry and subsequently clears the employee, concluding that there is no breach, it will still be a reportable investigative action under the SFC’s requirements – and the firm may face potential privacy issues by reporting."

 Firms may also find this difficult to enforce in practice without the force of a clear legal provision behind the reporting, particularly when they are potentially contravening other, legally supported standards.

 Lastly, while the importance of one standard for the market is recognised, the burden will fall unequally on smaller firms or branches of firms in Hong Kong under the current regime.